diff --git a/advisories/unreviewed/2024/08/GHSA-ww4c-q949-79pp/GHSA-ww4c-q949-79pp.json b/advisories/unreviewed/2024/08/GHSA-ww4c-q949-79pp/GHSA-ww4c-q949-79pp.json index 5d8a4750c65..eddb836e4ea 100644 --- a/advisories/unreviewed/2024/08/GHSA-ww4c-q949-79pp/GHSA-ww4c-q949-79pp.json +++ b/advisories/unreviewed/2024/08/GHSA-ww4c-q949-79pp/GHSA-ww4c-q949-79pp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-ww4c-q949-79pp", - "modified": "2024-08-17T12:30:33Z", + "modified": "2024-10-25T15:31:24Z", "published": "2024-08-17T12:30:33Z", "aliases": [ "CVE-2024-43848" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix TTLM teardown work\n\nThe worker calculates the wrong sdata pointer, so if it ever\nruns, it'll crash. Fix that.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-17T10:15:10Z" diff --git a/advisories/unreviewed/2024/10/GHSA-26q7-wp6g-349w/GHSA-26q7-wp6g-349w.json b/advisories/unreviewed/2024/10/GHSA-26q7-wp6g-349w/GHSA-26q7-wp6g-349w.json index 19ef931ea59..e45faa95690 100644 --- a/advisories/unreviewed/2024/10/GHSA-26q7-wp6g-349w/GHSA-26q7-wp6g-349w.json +++ b/advisories/unreviewed/2024/10/GHSA-26q7-wp6g-349w/GHSA-26q7-wp6g-349w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-26q7-wp6g-349w", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49931" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix array out-of-bound access in SoC stats\n\nCurrently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a\nmaximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process()\nfunction access ath12k_soc_dp_stats::hal_reo_error using the REO\ndestination SRNG ring ID, which is incorrect. SRNG ring ID differ from\nnormal ring ID, and this usage leads to out-of-bounds array access. To\nfix this issue, modify ath12k_dp_rx_process() to use the normal ring ID\ndirectly instead of the SRNG ring ID to avoid out-of-bounds array access.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-129" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-2mfj-xm96-46wm/GHSA-2mfj-xm96-46wm.json b/advisories/unreviewed/2024/10/GHSA-2mfj-xm96-46wm/GHSA-2mfj-xm96-46wm.json index f3b87d2cf8d..08429d0cc14 100644 --- a/advisories/unreviewed/2024/10/GHSA-2mfj-xm96-46wm/GHSA-2mfj-xm96-46wm.json +++ b/advisories/unreviewed/2024/10/GHSA-2mfj-xm96-46wm/GHSA-2mfj-xm96-46wm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2mfj-xm96-46wm", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50020" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()\n\nThis patch addresses an issue with improper reference count handling in the\nice_sriov_set_msix_vec_count() function.\n\nFirst, the function calls ice_get_vf_by_id(), which increments the\nreference count of the vf pointer. If the subsequent call to\nice_get_vf_vsi() fails, the function currently returns an error without\ndecrementing the reference count of the vf pointer, leading to a reference\ncount leak. The correct behavior, as implemented in this patch, is to\ndecrement the reference count using ice_put_vf(vf) before returning an\nerror when vsi is NULL.\n\nSecond, the function calls ice_sriov_get_irqs(), which sets\nvf->first_vector_idx. If this call returns a negative value, indicating an\nerror, the function returns an error without decrementing the reference\ncount of the vf pointer, resulting in another reference count leak. The\npatch addresses this by adding a call to ice_put_vf(vf) before returning\nan error when vf->first_vector_idx < 0.\n\nThis bug was identified by an experimental static analysis tool developed\nby our team. The tool specializes in analyzing reference count operations\nand identifying potential mismanagement of reference counts. In this case,\nthe tool flagged the missing decrement operation as a potential issue,\nleading to this patch.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-3fxp-j2vr-qqgv/GHSA-3fxp-j2vr-qqgv.json b/advisories/unreviewed/2024/10/GHSA-3fxp-j2vr-qqgv/GHSA-3fxp-j2vr-qqgv.json index ce4a6da3f3c..67a55b23cd1 100644 --- a/advisories/unreviewed/2024/10/GHSA-3fxp-j2vr-qqgv/GHSA-3fxp-j2vr-qqgv.json +++ b/advisories/unreviewed/2024/10/GHSA-3fxp-j2vr-qqgv/GHSA-3fxp-j2vr-qqgv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3fxp-j2vr-qqgv", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50031" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Stop the active perfmon before being destroyed\n\nWhen running `kmscube` with one or more performance monitors enabled\nvia `GALLIUM_HUD`, the following kernel panic can occur:\n\n[ 55.008324] Unable to handle kernel paging request at virtual address 00000000052004a4\n[ 55.008368] Mem abort info:\n[ 55.008377] ESR = 0x0000000096000005\n[ 55.008387] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 55.008402] SET = 0, FnV = 0\n[ 55.008412] EA = 0, S1PTW = 0\n[ 55.008421] FSC = 0x05: level 1 translation fault\n[ 55.008434] Data abort info:\n[ 55.008442] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n[ 55.008455] CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 55.008467] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 55.008481] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001046c6000\n[ 55.008497] [00000000052004a4] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n[ 55.008525] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\n[ 55.008542] Modules linked in: rfcomm [...] vc4 v3d snd_soc_hdmi_codec drm_display_helper\ngpu_sched drm_shmem_helper cec drm_dma_helper drm_kms_helper i2c_brcmstb\ndrm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight\n[ 55.008799] CPU: 2 PID: 166 Comm: v3d_bin Tainted: G C 6.6.47+rpt-rpi-v8 #1 Debian 1:6.6.47-1+rpt1\n[ 55.008824] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n[ 55.008838] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 55.008855] pc : __mutex_lock.constprop.0+0x90/0x608\n[ 55.008879] lr : __mutex_lock.constprop.0+0x58/0x608\n[ 55.008895] sp : ffffffc080673cf0\n[ 55.008904] x29: ffffffc080673cf0 x28: 0000000000000000 x27: ffffff8106188a28\n[ 55.008926] x26: ffffff8101e78040 x25: ffffff8101baa6c0 x24: ffffffd9d989f148\n[ 55.008947] x23: ffffffda1c2a4008 x22: 0000000000000002 x21: ffffffc080673d38\n[ 55.008968] x20: ffffff8101238000 x19: ffffff8104f83188 x18: 0000000000000000\n[ 55.008988] x17: 0000000000000000 x16: ffffffda1bd04d18 x15: 00000055bb08bc90\n[ 55.009715] x14: 0000000000000000 x13: 0000000000000000 x12: ffffffda1bd4cbb0\n[ 55.010433] x11: 00000000fa83b2da x10: 0000000000001a40 x9 : ffffffda1bd04d04\n[ 55.011162] x8 : ffffff8102097b80 x7 : 0000000000000000 x6 : 00000000030a5857\n[ 55.011880] x5 : 00ffffffffffffff x4 : 0300000005200470 x3 : 0300000005200470\n[ 55.012598] x2 : ffffff8101238000 x1 : 0000000000000021 x0 : 0300000005200470\n[ 55.013292] Call trace:\n[ 55.013959] __mutex_lock.constprop.0+0x90/0x608\n[ 55.014646] __mutex_lock_slowpath+0x1c/0x30\n[ 55.015317] mutex_lock+0x50/0x68\n[ 55.015961] v3d_perfmon_stop+0x40/0xe0 [v3d]\n[ 55.016627] v3d_bin_job_run+0x10c/0x2d8 [v3d]\n[ 55.017282] drm_sched_main+0x178/0x3f8 [gpu_sched]\n[ 55.017921] kthread+0x11c/0x128\n[ 55.018554] ret_from_fork+0x10/0x20\n[ 55.019168] Code: f9400260 f1001c1f 54001ea9 927df000 (b9403401)\n[ 55.019776] ---[ end trace 0000000000000000 ]---\n[ 55.020411] note: v3d_bin[166] exited with preempt_count 1\n\nThis issue arises because, upon closing the file descriptor (which happens\nwhen we interrupt `kmscube`), the active performance monitor is not\nstopped. Although all perfmons are destroyed in `v3d_perfmon_close_file()`,\nthe active performance monitor's pointer (`v3d->active_perfmon`) is still\nretained.\n\nIf `kmscube` is run again, the driver will attempt to stop the active\nperformance monitor using the stale pointer in `v3d->active_perfmon`.\nHowever, this pointer is no longer valid because the previous process has\nalready terminated, and all performance monitors associated with it have\nbeen destroyed and freed.\n\nTo fix this, when the active performance monitor belongs to a given\nprocess, explicitly stop it before destroying and freeing it.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -43,7 +46,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:16Z" diff --git a/advisories/unreviewed/2024/10/GHSA-3rvw-7pxp-g8xm/GHSA-3rvw-7pxp-g8xm.json b/advisories/unreviewed/2024/10/GHSA-3rvw-7pxp-g8xm/GHSA-3rvw-7pxp-g8xm.json index 6bbcc6d4471..0997c1a04a0 100644 --- a/advisories/unreviewed/2024/10/GHSA-3rvw-7pxp-g8xm/GHSA-3rvw-7pxp-g8xm.json +++ b/advisories/unreviewed/2024/10/GHSA-3rvw-7pxp-g8xm/GHSA-3rvw-7pxp-g8xm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3rvw-7pxp-g8xm", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49924" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: pxafb: Fix possible use after free in pxafb_task()\n\nIn the pxafb_probe function, it calls the pxafb_init_fbinfo function,\nafter which &fbi->task is associated with pxafb_task. Moreover,\nwithin this pxafb_init_fbinfo function, the pxafb_blank function\nwithin the &pxafb_ops struct is capable of scheduling work.\n\nIf we remove the module which will call pxafb_remove to make cleanup,\nit will call unregister_framebuffer function which can call\ndo_unregister_framebuffer to free fbi->fb through\nput_fb_info(fb_info), while the work mentioned above will be used.\nThe sequence of operations that may lead to a UAF bug is as follows:\n\nCPU0 CPU1\n\n | pxafb_task\npxafb_remove |\nunregister_framebuffer(info) |\ndo_unregister_framebuffer(fb_info) |\nput_fb_info(fb_info) |\n// free fbi->fb | set_ctrlr_state(fbi, state)\n | __pxafb_lcd_power(fbi, 0)\n | fbi->lcd_power(on, &fbi->fb.var)\n | //use fbi->fb\n\nFix it by ensuring that the work is canceled before proceeding\nwith the cleanup in pxafb_remove.\n\nNote that only root user can remove the driver at runtime.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/10/GHSA-4rgx-hjqw-p9f3/GHSA-4rgx-hjqw-p9f3.json b/advisories/unreviewed/2024/10/GHSA-4rgx-hjqw-p9f3/GHSA-4rgx-hjqw-p9f3.json index b0f496e92fc..fdb70d6b291 100644 --- a/advisories/unreviewed/2024/10/GHSA-4rgx-hjqw-p9f3/GHSA-4rgx-hjqw-p9f3.json +++ b/advisories/unreviewed/2024/10/GHSA-4rgx-hjqw-p9f3/GHSA-4rgx-hjqw-p9f3.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-4rgx-hjqw-p9f3", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49890" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: ensure the fw_info is not null before using it\n\nThis resolves the dereference null return value warning\nreported by Coverity.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-54gg-q7hm-55r6/GHSA-54gg-q7hm-55r6.json b/advisories/unreviewed/2024/10/GHSA-54gg-q7hm-55r6/GHSA-54gg-q7hm-55r6.json index 08f6aaea1cc..2bcbd04a27c 100644 --- a/advisories/unreviewed/2024/10/GHSA-54gg-q7hm-55r6/GHSA-54gg-q7hm-55r6.json +++ b/advisories/unreviewed/2024/10/GHSA-54gg-q7hm-55r6/GHSA-54gg-q7hm-55r6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-54gg-q7hm-55r6", - "modified": "2024-10-21T21:30:52Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:52Z", "aliases": [ "CVE-2022-49005" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Fix bounds check for _sx controls\n\nFor _sx controls the semantics of the max field is not the usual one, max\nis the number of steps rather than the maximum value. This means that our\ncheck in snd_soc_put_volsw_sx() needs to just check against the maximum\nvalue.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -55,7 +58,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:12Z" diff --git a/advisories/unreviewed/2024/10/GHSA-5frw-42jx-47v6/GHSA-5frw-42jx-47v6.json b/advisories/unreviewed/2024/10/GHSA-5frw-42jx-47v6/GHSA-5frw-42jx-47v6.json index efd472e075c..020b4912cef 100644 --- a/advisories/unreviewed/2024/10/GHSA-5frw-42jx-47v6/GHSA-5frw-42jx-47v6.json +++ b/advisories/unreviewed/2024/10/GHSA-5frw-42jx-47v6/GHSA-5frw-42jx-47v6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5frw-42jx-47v6", - "modified": "2024-10-21T18:30:59Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:59Z", "aliases": [ "CVE-2024-49981" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: fix use after free bug in venus_remove due to race condition\n\nin venus_probe, core->work is bound with venus_sys_error_handler, which is\nused to handle error. The code use core->sys_err_done to make sync work.\nThe core->work is started in venus_event_notify.\n\nIf we call venus_remove, there might be an unfished work. The possible\nsequence is as follows:\n\nCPU0 CPU1\n\n |venus_sys_error_handler\nvenus_remove |\nhfi_destroy\t \t\t |\nvenus_hfi_destroy\t |\nkfree(hdev);\t |\n |hfi_reinit\n\t\t\t\t\t |venus_hfi_queues_reinit\n |//use hdev\n\nFix it by canceling the work in venus_remove.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-362" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:18Z" diff --git a/advisories/unreviewed/2024/10/GHSA-5wgv-v8w4-hvpr/GHSA-5wgv-v8w4-hvpr.json b/advisories/unreviewed/2024/10/GHSA-5wgv-v8w4-hvpr/GHSA-5wgv-v8w4-hvpr.json index 7975387c2c0..722fdbb8f2e 100644 --- a/advisories/unreviewed/2024/10/GHSA-5wgv-v8w4-hvpr/GHSA-5wgv-v8w4-hvpr.json +++ b/advisories/unreviewed/2024/10/GHSA-5wgv-v8w4-hvpr/GHSA-5wgv-v8w4-hvpr.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5wgv-v8w4-hvpr", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49901" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs\n\nThere are some cases, such as the one uncovered by Commit 46d4efcccc68\n(\"drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails\")\nwhere\n\nmsm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL);\n\nis called on gpu->pdev == NULL, as the GPU device has not been fully\ninitialized yet.\n\nTurns out that there's more than just the aforementioned path that\ncauses this to happen (e.g. the case when there's speedbin data in the\ncatalog, but opp-supported-hw is missing in DT).\n\nAssigning msm_gpu->pdev earlier seems like the least painful solution\nto this, therefore do so.\n\nPatchwork: https://patchwork.freedesktop.org/patch/602742/", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:12Z" diff --git a/advisories/unreviewed/2024/10/GHSA-64w2-5c96-v3qj/GHSA-64w2-5c96-v3qj.json b/advisories/unreviewed/2024/10/GHSA-64w2-5c96-v3qj/GHSA-64w2-5c96-v3qj.json index 70bee719d2f..438502cf166 100644 --- a/advisories/unreviewed/2024/10/GHSA-64w2-5c96-v3qj/GHSA-64w2-5c96-v3qj.json +++ b/advisories/unreviewed/2024/10/GHSA-64w2-5c96-v3qj/GHSA-64w2-5c96-v3qj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-64w2-5c96-v3qj", - "modified": "2024-10-21T21:30:51Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:51Z", "aliases": [ "CVE-2022-48972" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()\n\nKernel fault injection test reports null-ptr-deref as follows:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nRIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114\nCall Trace:\n \n raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87\n call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944\n unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982\n unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879\n register_netdevice+0x9a8/0xb90 net/core/dev.c:10083\n ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659\n ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229\n mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316\n\nieee802154_if_add() allocates wpan_dev as netdev's private data, but not\ninit the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage\nthe list when device register/unregister, and may lead to null-ptr-deref.\n\nUse INIT_LIST_HEAD() on it to initialize it correctly.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:09Z" diff --git a/advisories/unreviewed/2024/10/GHSA-6pw8-39hw-qcp8/GHSA-6pw8-39hw-qcp8.json b/advisories/unreviewed/2024/10/GHSA-6pw8-39hw-qcp8/GHSA-6pw8-39hw-qcp8.json index def43eadb65..11fff962ebe 100644 --- a/advisories/unreviewed/2024/10/GHSA-6pw8-39hw-qcp8/GHSA-6pw8-39hw-qcp8.json +++ b/advisories/unreviewed/2024/10/GHSA-6pw8-39hw-qcp8/GHSA-6pw8-39hw-qcp8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6pw8-39hw-qcp8", - "modified": "2024-10-21T18:30:56Z", + "modified": "2024-10-25T15:31:24Z", "published": "2024-10-21T18:30:56Z", "aliases": [ "CVE-2024-49868" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix a NULL pointer dereference when failed to start a new trasacntion\n\n[BUG]\nSyzbot reported a NULL pointer dereference with the following crash:\n\n FAULT_INJECTION: forcing a failure.\n start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676\n prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642\n relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678\n ...\n BTRFS info (device loop0): balance: ended with status: -12\n Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667]\n RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926\n Call Trace:\n \n commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496\n btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430\n del_balance_item fs/btrfs/volumes.c:3678 [inline]\n reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742\n btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574\n btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[CAUSE]\nThe allocation failure happens at the start_transaction() inside\nprepare_to_relocate(), and during the error handling we call\nunset_reloc_control(), which makes fs_info->balance_ctl to be NULL.\n\nThen we continue the error path cleanup in btrfs_balance() by calling\nreset_balance_state() which will call del_balance_item() to fully delete\nthe balance item in the root tree.\n\nHowever during the small window between set_reloc_contrl() and\nunset_reloc_control(), we can have a subvolume tree update and created a\nreloc_root for that subvolume.\n\nThen we go into the final btrfs_commit_transaction() of\ndel_balance_item(), and into btrfs_update_reloc_root() inside\ncommit_fs_roots().\n\nThat function checks if fs_info->reloc_ctl is in the merge_reloc_tree\nstage, but since fs_info->reloc_ctl is NULL, it results a NULL pointer\ndereference.\n\n[FIX]\nJust add extra check on fs_info->reloc_ctl inside\nbtrfs_update_reloc_root(), before checking\nfs_info->reloc_ctl->merge_reloc_tree.\n\nThat DEAD_RELOC_TREE handling is to prevent further modification to the\nreloc tree during merge stage, but since there is no reloc_ctl at all,\nwe do not need to bother that.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:06Z" diff --git a/advisories/unreviewed/2024/10/GHSA-74qf-4594-qx2m/GHSA-74qf-4594-qx2m.json b/advisories/unreviewed/2024/10/GHSA-74qf-4594-qx2m/GHSA-74qf-4594-qx2m.json index f75318d3e32..7aa1a712331 100644 --- a/advisories/unreviewed/2024/10/GHSA-74qf-4594-qx2m/GHSA-74qf-4594-qx2m.json +++ b/advisories/unreviewed/2024/10/GHSA-74qf-4594-qx2m/GHSA-74qf-4594-qx2m.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-74qf-4594-qx2m", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49929" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: avoid NULL pointer dereference\n\niwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta\npointer is not NULL.\nIt retrieves this pointer using iwl_mvm_sta_from_mac80211, which is\ndereferencing the ieee80211_sta pointer.\nIf sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL\npointer.\nFix this by checking the sta pointer before retrieving the mvmsta\nfrom it. If sta is not NULL, then mvmsta isn't either.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/10/GHSA-74w9-c64j-qmcw/GHSA-74w9-c64j-qmcw.json b/advisories/unreviewed/2024/10/GHSA-74w9-c64j-qmcw/GHSA-74w9-c64j-qmcw.json index ad1ca858e25..87bef855251 100644 --- a/advisories/unreviewed/2024/10/GHSA-74w9-c64j-qmcw/GHSA-74w9-c64j-qmcw.json +++ b/advisories/unreviewed/2024/10/GHSA-74w9-c64j-qmcw/GHSA-74w9-c64j-qmcw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-74w9-c64j-qmcw", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49893" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check stream_status before it is used\n\n[WHAT & HOW]\ndc_state_get_stream_status can return null, and therefore null must be\nchecked before stream_status is used.\n\nThis fixes 1 NULL_RETURNS issue reported by Coverity.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-7fg8-fwgf-g9x2/GHSA-7fg8-fwgf-g9x2.json b/advisories/unreviewed/2024/10/GHSA-7fg8-fwgf-g9x2/GHSA-7fg8-fwgf-g9x2.json new file mode 100644 index 00000000000..ee2638de7b5 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-7fg8-fwgf-g9x2/GHSA-7fg8-fwgf-g9x2.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7fg8-fwgf-g9x2", + "modified": "2024-10-25T15:31:32Z", + "published": "2024-10-25T15:31:32Z", + "aliases": [ + "CVE-2024-48428" + ], + "details": "An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48428" + }, + { + "type": "WEB", + "url": "https://medium.com/%40powerful-/account-takeover-ato-via-the-reset-password-cve-2024-48428-84892d6211d6" + }, + { + "type": "WEB", + "url": "https://medium.com/h7w/full-account-takeover-via-password-reset-link-manipulation-840fb9402967" + }, + { + "type": "WEB", + "url": "https://www.linkedin.com/posts/said-al-ghammari-301972285_0day-bugbountytips-bugbountytip-activity-7227418100034412544-2ocu" + }, + { + "type": "WEB", + "url": "https://www.olivevle.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-25T15:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-858g-q943-3jmm/GHSA-858g-q943-3jmm.json b/advisories/unreviewed/2024/10/GHSA-858g-q943-3jmm/GHSA-858g-q943-3jmm.json index 34913d75910..d5c55cf2ea2 100644 --- a/advisories/unreviewed/2024/10/GHSA-858g-q943-3jmm/GHSA-858g-q943-3jmm.json +++ b/advisories/unreviewed/2024/10/GHSA-858g-q943-3jmm/GHSA-858g-q943-3jmm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-858g-q943-3jmm", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49920" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before multiple uses\n\n[WHAT & HOW]\nPoniters, such as stream_enc and dc->bw_vbios, are null checked previously\nin the same function, so Coverity warns \"implies that stream_enc and\ndc->bw_vbios might be null\". They are used multiple times in the\nsubsequent code and need to be checked.\n\nThis fixes 10 FORWARD_NULL issues reported by Coverity.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/10/GHSA-8w32-7xxp-mvxc/GHSA-8w32-7xxp-mvxc.json b/advisories/unreviewed/2024/10/GHSA-8w32-7xxp-mvxc/GHSA-8w32-7xxp-mvxc.json index d535963bb9e..ddfbe59d07e 100644 --- a/advisories/unreviewed/2024/10/GHSA-8w32-7xxp-mvxc/GHSA-8w32-7xxp-mvxc.json +++ b/advisories/unreviewed/2024/10/GHSA-8w32-7xxp-mvxc/GHSA-8w32-7xxp-mvxc.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8w32-7xxp-mvxc", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49928" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid reading out of bounds when loading TX power FW elements\n\nBecause the loop-expression will do one more time before getting false from\ncond-expression, the original code copied one more entry size beyond valid\nregion.\n\nFix it by moving the entry copy to loop-body.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/10/GHSA-9354-rmch-rmj8/GHSA-9354-rmch-rmj8.json b/advisories/unreviewed/2024/10/GHSA-9354-rmch-rmj8/GHSA-9354-rmch-rmj8.json index 1350d76fe99..f4ecc50c677 100644 --- a/advisories/unreviewed/2024/10/GHSA-9354-rmch-rmj8/GHSA-9354-rmch-rmj8.json +++ b/advisories/unreviewed/2024/10/GHSA-9354-rmch-rmj8/GHSA-9354-rmch-rmj8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9354-rmch-rmj8", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49930" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix array out-of-bound access in SoC stats\n\nCurrently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a\nmaximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx()\nfunction access ath11k_soc_dp_stats::hal_reo_error using the REO\ndestination SRNG ring ID, which is incorrect. SRNG ring ID differ from\nnormal ring ID, and this usage leads to out-of-bounds array access. To fix\nthis issue, modify ath11k_dp_process_rx() to use the normal ring ID\ndirectly instead of the SRNG ring ID to avoid out-of-bounds array access.\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-129" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/10/GHSA-9g6j-fh54-mg8j/GHSA-9g6j-fh54-mg8j.json b/advisories/unreviewed/2024/10/GHSA-9g6j-fh54-mg8j/GHSA-9g6j-fh54-mg8j.json index 7f23cf965d5..1c27bdcad84 100644 --- a/advisories/unreviewed/2024/10/GHSA-9g6j-fh54-mg8j/GHSA-9g6j-fh54-mg8j.json +++ b/advisories/unreviewed/2024/10/GHSA-9g6j-fh54-mg8j/GHSA-9g6j-fh54-mg8j.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9g6j-fh54-mg8j", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50030" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/ct: prevent UAF in send_recv()\n\nEnsure we serialize with completion side to prevent UAF with fence going\nout of scope on the stack, since we have no clue if it will fire after\nthe timeout before we can erase from the xa. Also we have some dependent\nloads and stores for which we need the correct ordering, and we lack the\nneeded barriers. Fix this by grabbing the ct->lock after the wait, which\nis also held by the completion side.\n\nv2 (Badal):\n - Also print done after acquiring the lock and seeing timeout.\n\n(cherry picked from commit 52789ce35c55ccd30c4b67b9cc5b2af55e0122ea)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:16Z" diff --git a/advisories/unreviewed/2024/10/GHSA-9gj6-xqgx-pv89/GHSA-9gj6-xqgx-pv89.json b/advisories/unreviewed/2024/10/GHSA-9gj6-xqgx-pv89/GHSA-9gj6-xqgx-pv89.json index fa1cb8c7b30..bdb0b839fb5 100644 --- a/advisories/unreviewed/2024/10/GHSA-9gj6-xqgx-pv89/GHSA-9gj6-xqgx-pv89.json +++ b/advisories/unreviewed/2024/10/GHSA-9gj6-xqgx-pv89/GHSA-9gj6-xqgx-pv89.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9gj6-xqgx-pv89", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49942" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Prevent null pointer access in xe_migrate_copy\n\nxe_migrate_copy designed to copy content of TTM resources. When source\nresource is null, it will trigger a NULL pointer dereference in\nxe_migrate_copy. To avoid this situation, update lacks source flag to\ntrue for this case, the flag will trigger xe_migrate_clear rather than\nxe_migrate_copy.\n\nIssue trace:\n<7> [317.089847] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 14,\n sizes: 4194304 & 4194304\n<7> [317.089945] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 15,\n sizes: 4194304 & 4194304\n<1> [317.128055] BUG: kernel NULL pointer dereference, address:\n 0000000000000010\n<1> [317.128064] #PF: supervisor read access in kernel mode\n<1> [317.128066] #PF: error_code(0x0000) - not-present page\n<6> [317.128069] PGD 0 P4D 0\n<4> [317.128071] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\n<4> [317.128074] CPU: 1 UID: 0 PID: 1440 Comm: kunit_try_catch Tainted:\n G U N 6.11.0-rc7-xe #1\n<4> [317.128078] Tainted: [U]=USER, [N]=TEST\n<4> [317.128080] Hardware name: Intel Corporation Lunar Lake Client\n Platform/LNL-M LP5 RVP1, BIOS LNLMFWI1.R00.3221.D80.2407291239 07/29/2024\n<4> [317.128082] RIP: 0010:xe_migrate_copy+0x66/0x13e0 [xe]\n<4> [317.128158] Code: 00 00 48 89 8d e0 fe ff ff 48 8b 40 10 4c 89 85 c8\n fe ff ff 44 88 8d bd fe ff ff 65 48 8b 3c 25 28 00 00 00 48 89 7d d0 31\n ff <8b> 79 10 48 89 85 a0 fe ff ff 48 8b 00 48 89 b5 d8 fe ff ff 83 ff\n<4> [317.128162] RSP: 0018:ffffc9000167f9f0 EFLAGS: 00010246\n<4> [317.128164] RAX: ffff8881120d8028 RBX: ffff88814d070428 RCX:\n 0000000000000000\n<4> [317.128166] RDX: ffff88813cb99c00 RSI: 0000000004000000 RDI:\n 0000000000000000\n<4> [317.128168] RBP: ffffc9000167fbb8 R08: ffff88814e7b1f08 R09:\n 0000000000000001\n<4> [317.128170] R10: 0000000000000001 R11: 0000000000000001 R12:\n ffff88814e7b1f08\n<4> [317.128172] R13: ffff88814e7b1f08 R14: ffff88813cb99c00 R15:\n 0000000000000001\n<4> [317.128174] FS: 0000000000000000(0000) GS:ffff88846f280000(0000)\n knlGS:0000000000000000\n<4> [317.128176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n<4> [317.128178] CR2: 0000000000000010 CR3: 000000011f676004 CR4:\n 0000000000770ef0\n<4> [317.128180] DR0: 0000000000000000 DR1: 0000000000000000 DR2:\n 0000000000000000\n<4> [317.128182] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7:\n 0000000000000400\n<4> [317.128184] PKRU: 55555554\n<4> [317.128185] Call Trace:\n<4> [317.128187] \n<4> [317.128189] ? show_regs+0x67/0x70\n<4> [317.128194] ? __die_body+0x20/0x70\n<4> [317.128196] ? __die+0x2b/0x40\n<4> [317.128198] ? page_fault_oops+0x15f/0x4e0\n<4> [317.128203] ? do_user_addr_fault+0x3fb/0x970\n<4> [317.128205] ? lock_acquire+0xc7/0x2e0\n<4> [317.128209] ? exc_page_fault+0x87/0x2b0\n<4> [317.128212] ? asm_exc_page_fault+0x27/0x30\n<4> [317.128216] ? xe_migrate_copy+0x66/0x13e0 [xe]\n<4> [317.128263] ? __lock_acquire+0xb9d/0x26f0\n<4> [317.128265] ? __lock_acquire+0xb9d/0x26f0\n<4> [317.128267] ? sg_free_append_table+0x20/0x80\n<4> [317.128271] ? lock_acquire+0xc7/0x2e0\n<4> [317.128273] ? mark_held_locks+0x4d/0x80\n<4> [317.128275] ? trace_hardirqs_on+0x1e/0xd0\n<4> [317.128278] ? _raw_spin_unlock_irqrestore+0x31/0x60\n<4> [317.128281] ? __pm_runtime_resume+0x60/0xa0\n<4> [317.128284] xe_bo_move+0x682/0xc50 [xe]\n<4> [317.128315] ? lock_is_held_type+0xaa/0x120\n<4> [317.128318] ttm_bo_handle_move_mem+0xe5/0x1a0 [ttm]\n<4> [317.128324] ttm_bo_validate+0xd1/0x1a0 [ttm]\n<4> [317.128328] shrink_test_run_device+0x721/0xc10 [xe]\n<4> [317.128360] ? find_held_lock+0x31/0x90\n<4> [317.128363] ? lock_release+0xd1/0x2a0\n<4> [317.128365] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10\n [kunit]\n<4> [317.128370] xe_bo_shrink_kunit+0x11/0x20 [xe]\n<4> [317.128397] kunit_try_run_case+0x6e/0x150 [kunit]\n<4> [317.128400] ? trace_hardirqs_on+0x1e/0xd0\n<4> [317.128402] ? _raw_spin_unlock_irqrestore+0x31/0x60\n<4> [317.128404] kunit_generic_run_threadfn_adapter+0x1e/0x40 [ku\n---truncated---", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-9mmp-2f66-mf43/GHSA-9mmp-2f66-mf43.json b/advisories/unreviewed/2024/10/GHSA-9mmp-2f66-mf43/GHSA-9mmp-2f66-mf43.json index 93c8339daeb..3817c2a0bdf 100644 --- a/advisories/unreviewed/2024/10/GHSA-9mmp-2f66-mf43/GHSA-9mmp-2f66-mf43.json +++ b/advisories/unreviewed/2024/10/GHSA-9mmp-2f66-mf43/GHSA-9mmp-2f66-mf43.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9mmp-2f66-mf43", - "modified": "2024-10-21T21:30:52Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:52Z", "aliases": [ "CVE-2022-49007" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()\n\nSyzbot reported a null-ptr-deref bug:\n\n NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP\n frequency < 30 seconds\n general protection fault, probably for non-canonical address\n 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n CPU: 1 PID: 3603 Comm: segctord Not tainted\n 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0\n Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google\n 10/11/2022\n RIP: 0010:nilfs_palloc_commit_free_entry+0xe5/0x6b0\n fs/nilfs2/alloc.c:608\n Code: 00 00 00 00 fc ff df 80 3c 02 00 0f 85 cd 05 00 00 48 b8 00 00 00\n 00 00 fc ff df 4c 8b 73 08 49 8d 7e 10 48 89 fa 48 c1 ea 03 <80> 3c 02\n 00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7\n RSP: 0018:ffffc90003dff830 EFLAGS: 00010212\n RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d\n RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010\n RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f\n R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158\n R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004\n FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000)\n knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fb1c08316a8 CR3: 0000000018560000 CR4: 0000000000350ee0\n Call Trace:\n \n nilfs_dat_commit_free fs/nilfs2/dat.c:114 [inline]\n nilfs_dat_commit_end+0x464/0x5f0 fs/nilfs2/dat.c:193\n nilfs_dat_commit_update+0x26/0x40 fs/nilfs2/dat.c:236\n nilfs_btree_commit_update_v+0x87/0x4a0 fs/nilfs2/btree.c:1940\n nilfs_btree_commit_propagate_v fs/nilfs2/btree.c:2016 [inline]\n nilfs_btree_propagate_v fs/nilfs2/btree.c:2046 [inline]\n nilfs_btree_propagate+0xa00/0xd60 fs/nilfs2/btree.c:2088\n nilfs_bmap_propagate+0x73/0x170 fs/nilfs2/bmap.c:337\n nilfs_collect_file_data+0x45/0xd0 fs/nilfs2/segment.c:568\n nilfs_segctor_apply_buffers+0x14a/0x470 fs/nilfs2/segment.c:1018\n nilfs_segctor_scan_file+0x3f4/0x6f0 fs/nilfs2/segment.c:1067\n nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1197 [inline]\n nilfs_segctor_collect fs/nilfs2/segment.c:1503 [inline]\n nilfs_segctor_do_construct+0x12fc/0x6af0 fs/nilfs2/segment.c:2045\n nilfs_segctor_construct+0x8e3/0xb30 fs/nilfs2/segment.c:2379\n nilfs_segctor_thread_construct fs/nilfs2/segment.c:2487 [inline]\n nilfs_segctor_thread+0x3c3/0xf30 fs/nilfs2/segment.c:2570\n kthread+0x2e4/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n \n ...\n\nIf DAT metadata file is corrupted on disk, there is a case where\nreq->pr_desc_bh is NULL and blocknr is 0 at nilfs_dat_commit_end() during\na b-tree operation that cascadingly updates ancestor nodes of the b-tree,\nbecause nilfs_dat_commit_alloc() for a lower level block can initialize\nthe blocknr on the same DAT entry between nilfs_dat_prepare_end() and\nnilfs_dat_commit_end().\n\nIf this happens, nilfs_dat_commit_end() calls nilfs_dat_commit_free()\nwithout valid buffer heads in req->pr_desc_bh and req->pr_bitmap_bh, and\ncauses the NULL pointer dereference above in\nnilfs_palloc_commit_free_entry() function, which leads to a crash.\n\nFix this by adding a NULL check on req->pr_desc_bh and req->pr_bitmap_bh\nbefore nilfs_palloc_commit_free_entry() in nilfs_dat_commit_free().\n\nThis also calls nilfs_error() in that case to notify that there is a fatal\nflaw in the filesystem metadata and prevent further operations.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:12Z" diff --git a/advisories/unreviewed/2024/10/GHSA-9r6q-3r52-hh42/GHSA-9r6q-3r52-hh42.json b/advisories/unreviewed/2024/10/GHSA-9r6q-3r52-hh42/GHSA-9r6q-3r52-hh42.json index e728c23251f..783afd375a6 100644 --- a/advisories/unreviewed/2024/10/GHSA-9r6q-3r52-hh42/GHSA-9r6q-3r52-hh42.json +++ b/advisories/unreviewed/2024/10/GHSA-9r6q-3r52-hh42/GHSA-9r6q-3r52-hh42.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9r6q-3r52-hh42", - "modified": "2024-10-21T18:30:56Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:56Z", "aliases": [ "CVE-2024-49880" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix off by one issue in alloc_flex_gd()\n\nWesley reported an issue:\n\n==================================================================\nEXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks\n------------[ cut here ]------------\nkernel BUG at fs/ext4/resize.c:324!\nCPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27\nRIP: 0010:ext4_resize_fs+0x1212/0x12d0\nCall Trace:\n __ext4_ioctl+0x4e0/0x1800\n ext4_ioctl+0x12/0x20\n __x64_sys_ioctl+0x99/0xd0\n x64_sys_call+0x1206/0x20d0\n do_syscall_64+0x72/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n==================================================================\n\nWhile reviewing the patch, Honza found that when adjusting resize_bg in\nalloc_flex_gd(), it was possible for flex_gd->resize_bg to be bigger than\nflexbg_size.\n\nThe reproduction of the problem requires the following:\n\n o_group = flexbg_size * 2 * n;\n o_size = (o_group + 1) * group_size;\n n_group: [o_group + flexbg_size, o_group + flexbg_size * 2)\n o_size = (n_group + 1) * group_size;\n\nTake n=0,flexbg_size=16 as an example:\n\n last:15\n|o---------------|--------------n-|\no_group:0 resize to n_group:30\n\nThe corresponding reproducer is:\n\nimg=test.img\nrm -f $img\ntruncate -s 600M $img\nmkfs.ext4 -F $img -b 1024 -G 16 8M\ndev=`losetup -f --show $img`\nmkdir -p /tmp/test\nmount $dev /tmp/test\nresize2fs $dev 248M\n\nDelete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE()\nto prevent the issue from happening again.\n\n[ Note: another reproucer which this commit fixes is:\n\n img=test.img\n rm -f $img\n truncate -s 25MiB $img\n mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img\n truncate -s 3GiB $img\n dev=`losetup -f --show $img`\n mkdir -p /tmp/test\n mount $dev /tmp/test\n resize2fs $dev 3G\n umount $dev\n losetup -d $dev\n\n -- TYT ]", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-193" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:10Z" diff --git a/advisories/unreviewed/2024/10/GHSA-cjwf-5vh9-w48g/GHSA-cjwf-5vh9-w48g.json b/advisories/unreviewed/2024/10/GHSA-cjwf-5vh9-w48g/GHSA-cjwf-5vh9-w48g.json index aeceab73627..fd2b9e1c6cb 100644 --- a/advisories/unreviewed/2024/10/GHSA-cjwf-5vh9-w48g/GHSA-cjwf-5vh9-w48g.json +++ b/advisories/unreviewed/2024/10/GHSA-cjwf-5vh9-w48g/GHSA-cjwf-5vh9-w48g.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-cjwf-5vh9-w48g", - "modified": "2024-10-21T18:30:59Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:59Z", "aliases": [ "CVE-2024-49993" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count\n\nIf qi_submit_sync() is invoked with 0 invalidation descriptors (for\ninstance, for DMA draining purposes), we can run into a bug where a\nsubmitting thread fails to detect the completion of invalidation_wait.\nSubsequently, this led to a soft lockup. Currently, there is no impact\nby this bug on the existing users because no callers are submitting\ninvalidations with 0 descriptors. This fix will enable future users\n(such as DMA drain) calling qi_submit_sync() with 0 count.\n\nSuppose thread T1 invokes qi_submit_sync() with non-zero descriptors, while\nconcurrently, thread T2 calls qi_submit_sync() with zero descriptors. Both\nthreads then enter a while loop, waiting for their respective descriptors\nto complete. T1 detects its completion (i.e., T1's invalidation_wait status\nchanges to QI_DONE by HW) and proceeds to call reclaim_free_desc() to\nreclaim all descriptors, potentially including adjacent ones of other\nthreads that are also marked as QI_DONE.\n\nDuring this time, while T2 is waiting to acquire the qi->q_lock, the IOMMU\nhardware may complete the invalidation for T2, setting its status to\nQI_DONE. However, if T1's execution of reclaim_free_desc() frees T2's\ninvalidation_wait descriptor and changes its status to QI_FREE, T2 will\nnot observe the QI_DONE status for its invalidation_wait and will\nindefinitely remain stuck.\n\nThis soft lockup does not occur when only non-zero descriptors are\nsubmitted.In such cases, invalidation descriptors are interspersed among\nwait descriptors with the status QI_IN_USE, acting as barriers. These\nbarriers prevent the reclaim code from mistakenly freeing descriptors\nbelonging to other submitters.\n\nConsidered the following example timeline:\n\tT1\t\t\tT2\n========================================\n\tID1\n\tWD1\n\twhile(WD1!=QI_DONE)\n\tunlock\n\t\t\t\tlock\n\tWD1=QI_DONE*\t\tWD2\n\t\t\t\twhile(WD2!=QI_DONE)\n\t\t\t\tunlock\n\tlock\n\tWD1==QI_DONE?\n\tID1=QI_DONE\t\tWD2=DONE*\n\treclaim()\n\tID1=FREE\n\tWD1=FREE\n\tWD2=FREE\n\tunlock\n\t\t\t\tsoft lockup! T2 never sees QI_DONE in WD2\n\nWhere:\nID = invalidation descriptor\nWD = wait descriptor\n* Written by hardware\n\nThe root of the problem is that the descriptor status QI_DONE flag is used\nfor two conflicting purposes:\n1. signal a descriptor is ready for reclaim (to be freed)\n2. signal by the hardware that a wait descriptor is complete\n\nThe solution (in this patch) is state separation by using QI_FREE flag\nfor #1.\n\nOnce a thread's invalidation descriptors are complete, their status would\nbe set to QI_FREE. The reclaim_free_desc() function would then only\nfree descriptors marked as QI_FREE instead of those marked as\nQI_DONE. This change ensures that T2 (from the previous example) will\ncorrectly observe the completion of its invalidation_wait (marked as\nQI_DONE).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-667" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:19Z" diff --git a/advisories/unreviewed/2024/10/GHSA-f43m-69ch-cggg/GHSA-f43m-69ch-cggg.json b/advisories/unreviewed/2024/10/GHSA-f43m-69ch-cggg/GHSA-f43m-69ch-cggg.json index 26851695d05..260d5401925 100644 --- a/advisories/unreviewed/2024/10/GHSA-f43m-69ch-cggg/GHSA-f43m-69ch-cggg.json +++ b/advisories/unreviewed/2024/10/GHSA-f43m-69ch-cggg/GHSA-f43m-69ch-cggg.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-f43m-69ch-cggg", - "modified": "2024-10-21T21:30:52Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:52Z", "aliases": [ "CVE-2022-49004" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Sync efi page table's kernel mappings before switching\n\nThe EFI page table is initially created as a copy of the kernel page table.\nWith VMAP_STACK enabled, kernel stacks are allocated in the vmalloc area:\nif the stack is allocated in a new PGD (one that was not present at the\nmoment of the efi page table creation or not synced in a previous vmalloc\nfault), the kernel will take a trap when switching to the efi page table\nwhen the vmalloc kernel stack is accessed, resulting in a kernel panic.\n\nFix that by updating the efi kernel mappings before switching to the efi\npage table.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-f5p8-rmgq-7jq5/GHSA-f5p8-rmgq-7jq5.json b/advisories/unreviewed/2024/10/GHSA-f5p8-rmgq-7jq5/GHSA-f5p8-rmgq-7jq5.json new file mode 100644 index 00000000000..5a424f349b1 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-f5p8-rmgq-7jq5/GHSA-f5p8-rmgq-7jq5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f5p8-rmgq-7jq5", + "modified": "2024-10-25T15:31:32Z", + "published": "2024-10-25T15:31:32Z", + "aliases": [ + "CVE-2024-9991" + ], + "details": "This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the vulnerable device.\n\nSuccessful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the Wi-Fi network to which vulnerable device is connected.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9991" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0329" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-312" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-25T13:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-fppc-fjqw-6gx5/GHSA-fppc-fjqw-6gx5.json b/advisories/unreviewed/2024/10/GHSA-fppc-fjqw-6gx5/GHSA-fppc-fjqw-6gx5.json index a96d18f75f1..c7d7b1c6cc7 100644 --- a/advisories/unreviewed/2024/10/GHSA-fppc-fjqw-6gx5/GHSA-fppc-fjqw-6gx5.json +++ b/advisories/unreviewed/2024/10/GHSA-fppc-fjqw-6gx5/GHSA-fppc-fjqw-6gx5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fppc-fjqw-6gx5", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49922" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before using them\n\n[WHAT & HOW]\nThese pointers are null checked previously in the same function,\nindicating they might be null as reported by Coverity. As a result,\nthey need to be checked when used again.\n\nThis fixes 3 FORWARD_NULL issue reported by Coverity.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/10/GHSA-fw79-wq25-6xpv/GHSA-fw79-wq25-6xpv.json b/advisories/unreviewed/2024/10/GHSA-fw79-wq25-6xpv/GHSA-fw79-wq25-6xpv.json index 2f5ac21b977..33d6366e6b9 100644 --- a/advisories/unreviewed/2024/10/GHSA-fw79-wq25-6xpv/GHSA-fw79-wq25-6xpv.json +++ b/advisories/unreviewed/2024/10/GHSA-fw79-wq25-6xpv/GHSA-fw79-wq25-6xpv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fw79-wq25-6xpv", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50029" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync\n\nThis checks if the ACL connection remains valid as it could be destroyed\nwhile hci_enhanced_setup_sync is pending on cmd_sync leading to the\nfollowing trace:\n\nBUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0x91b/0xa60\nRead of size 1 at addr ffff888002328ffd by task kworker/u5:2/37\n\nCPU: 0 UID: 0 PID: 37 Comm: kworker/u5:2 Not tainted 6.11.0-rc6-01300-g810be445d8d6 #7099\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nWorkqueue: hci0 hci_cmd_sync_work\nCall Trace:\n \n dump_stack_lvl+0x5d/0x80\n ? hci_enhanced_setup_sync+0x91b/0xa60\n print_report+0x152/0x4c0\n ? hci_enhanced_setup_sync+0x91b/0xa60\n ? __virt_addr_valid+0x1fa/0x420\n ? hci_enhanced_setup_sync+0x91b/0xa60\n kasan_report+0xda/0x1b0\n ? hci_enhanced_setup_sync+0x91b/0xa60\n hci_enhanced_setup_sync+0x91b/0xa60\n ? __pfx_hci_enhanced_setup_sync+0x10/0x10\n ? __pfx___mutex_lock+0x10/0x10\n hci_cmd_sync_work+0x1c2/0x330\n process_one_work+0x7d9/0x1360\n ? __pfx_lock_acquire+0x10/0x10\n ? __pfx_process_one_work+0x10/0x10\n ? assign_work+0x167/0x240\n worker_thread+0x5b7/0xf60\n ? __kthread_parkme+0xac/0x1c0\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x293/0x360\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2f/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n\nAllocated by task 34:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __hci_conn_add+0x187/0x17d0\n hci_connect_sco+0x2e1/0xb90\n sco_sock_connect+0x2a2/0xb80\n __sys_connect+0x227/0x2a0\n __x64_sys_connect+0x6d/0xb0\n do_syscall_64+0x71/0x140\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 37:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x101/0x160\n kfree+0xd0/0x250\n device_release+0x9a/0x210\n kobject_put+0x151/0x280\n hci_conn_del+0x448/0xbf0\n hci_abort_conn_sync+0x46f/0x980\n hci_cmd_sync_work+0x1c2/0x330\n process_one_work+0x7d9/0x1360\n worker_thread+0x5b7/0xf60\n kthread+0x293/0x360\n ret_from_fork+0x2f/0x70\n ret_from_fork_asm+0x1a/0x30", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:16Z" diff --git a/advisories/unreviewed/2024/10/GHSA-g3gx-vxgx-5xvc/GHSA-g3gx-vxgx-5xvc.json b/advisories/unreviewed/2024/10/GHSA-g3gx-vxgx-5xvc/GHSA-g3gx-vxgx-5xvc.json index 7e62f9bd49e..027cde01491 100644 --- a/advisories/unreviewed/2024/10/GHSA-g3gx-vxgx-5xvc/GHSA-g3gx-vxgx-5xvc.json +++ b/advisories/unreviewed/2024/10/GHSA-g3gx-vxgx-5xvc/GHSA-g3gx-vxgx-5xvc.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g3gx-vxgx-5xvc", - "modified": "2024-10-21T21:30:51Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:51Z", "aliases": [ "CVE-2022-48974" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: fix using __this_cpu_add in preemptible\n\nCurrently in nf_conntrack_hash_check_insert(), when it fails in\nnf_ct_ext_valid_pre/post(), NF_CT_STAT_INC() will be called in the\npreemptible context, a call trace can be triggered:\n\n BUG: using __this_cpu_add() in preemptible [00000000] code: conntrack/1636\n caller is nf_conntrack_hash_check_insert+0x45/0x430 [nf_conntrack]\n Call Trace:\n \n dump_stack_lvl+0x33/0x46\n check_preemption_disabled+0xc3/0xf0\n nf_conntrack_hash_check_insert+0x45/0x430 [nf_conntrack]\n ctnetlink_create_conntrack+0x3cd/0x4e0 [nf_conntrack_netlink]\n ctnetlink_new_conntrack+0x1c0/0x450 [nf_conntrack_netlink]\n nfnetlink_rcv_msg+0x277/0x2f0 [nfnetlink]\n netlink_rcv_skb+0x50/0x100\n nfnetlink_rcv+0x65/0x144 [nfnetlink]\n netlink_unicast+0x1ae/0x290\n netlink_sendmsg+0x257/0x4f0\n sock_sendmsg+0x5f/0x70\n\nThis patch is to fix it by changing to use NF_CT_STAT_INC_ATOMIC() for\nnf_ct_ext_valid_pre/post() check in nf_conntrack_hash_check_insert(),\nas well as nf_ct_ext_valid_post() in __nf_conntrack_confirm().\n\nNote that nf_ct_ext_valid_pre() check in __nf_conntrack_confirm() is\nsafe to use NF_CT_STAT_INC(), as it's under local_bh_disable().", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:09Z" diff --git a/advisories/unreviewed/2024/10/GHSA-g9c5-q45g-cc74/GHSA-g9c5-q45g-cc74.json b/advisories/unreviewed/2024/10/GHSA-g9c5-q45g-cc74/GHSA-g9c5-q45g-cc74.json index 30a2b8a3be7..2c3d3e5c5e9 100644 --- a/advisories/unreviewed/2024/10/GHSA-g9c5-q45g-cc74/GHSA-g9c5-q45g-cc74.json +++ b/advisories/unreviewed/2024/10/GHSA-g9c5-q45g-cc74/GHSA-g9c5-q45g-cc74.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g9c5-q45g-cc74", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50022" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevice-dax: correct pgoff align in dax_set_mapping()\n\npgoff should be aligned using ALIGN_DOWN() instead of ALIGN(). Otherwise,\nvmf->address not aligned to fault_size will be aligned to the next\nalignment, that can result in memory failure getting the wrong address.\n\nIt's a subtle situation that only can be observed in\npage_mapped_in_vma() after the page is page fault handled by\ndev_dax_huge_fault. Generally, there is little chance to perform\npage_mapped_in_vma in dev-dax's page unless in specific error injection\nto the dax device to trigger an MCE - memory-failure. In that case,\npage_mapped_in_vma() will be triggered to determine which task is\naccessing the failure address and kill that task in the end.\n\n\nWe used self-developed dax device (which is 2M aligned mapping) , to\nperform error injection to random address. It turned out that error\ninjected to non-2M-aligned address was causing endless MCE until panic.\nBecause page_mapped_in_vma() kept resulting wrong address and the task\naccessing the failure address was never killed properly:\n\n\n[ 3783.719419] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3784.049006] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3784.049190] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3784.448042] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3784.448186] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3784.792026] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3784.792179] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3785.162502] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3785.162633] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3785.461116] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3785.461247] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3785.764730] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3785.764859] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3786.042128] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3786.042259] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3786.464293] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3786.464423] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3786.818090] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3786.818217] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3787.085297] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3787.085424] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n\nIt took us several weeks to pinpoint this problem,  but we eventually\nused bpftrace to trace the page fault and mce address and successfully\nidentified the issue.\n\n\nJoao added:\n\n; Likely we never reproduce in production because we always pin\n: device-dax regions in the region align they provide (Qemu does\n: similarly with prealloc in hugetlb/file backed memory). I think this\n: bug requires that we touch *unpinned* device-dax regions unaligned to\n: the device-dax selected alignment (page size i.e. 4K/2M/1G)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -39,7 +42,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-g9fr-wfpx-28xj/GHSA-g9fr-wfpx-28xj.json b/advisories/unreviewed/2024/10/GHSA-g9fr-wfpx-28xj/GHSA-g9fr-wfpx-28xj.json index 176d07c5339..5cc4b41392f 100644 --- a/advisories/unreviewed/2024/10/GHSA-g9fr-wfpx-28xj/GHSA-g9fr-wfpx-28xj.json +++ b/advisories/unreviewed/2024/10/GHSA-g9fr-wfpx-28xj/GHSA-g9fr-wfpx-28xj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g9fr-wfpx-28xj", - "modified": "2024-10-21T18:30:59Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:59Z", "aliases": [ "CVE-2024-49982" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\naoe: fix the potential use-after-free problem in more places\n\nFor fixing CVE-2023-6270, f98364e92662 (\"aoe: fix the potential\nuse-after-free problem in aoecmd_cfg_pkts\") makes tx() calling dev_put()\ninstead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs\ninto use-after-free.\n\nThen Nicolai Stange found more places in aoe have potential use-after-free\nproblem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe()\nand aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push\npacket to tx queue. So they should also use dev_hold() to increase the\nrefcnt of skb->dev.\n\nOn the other hand, moving dev_put() to tx() causes that the refcnt of\nskb->dev be reduced to a negative value, because corresponding\ndev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(),\nprobe(), and aoecmd_cfg_rsp(). This patch fixed this issue.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:18Z" diff --git a/advisories/unreviewed/2024/10/GHSA-gr6g-pg36-368m/GHSA-gr6g-pg36-368m.json b/advisories/unreviewed/2024/10/GHSA-gr6g-pg36-368m/GHSA-gr6g-pg36-368m.json index 9385f86fdb4..ca280cb675f 100644 --- a/advisories/unreviewed/2024/10/GHSA-gr6g-pg36-368m/GHSA-gr6g-pg36-368m.json +++ b/advisories/unreviewed/2024/10/GHSA-gr6g-pg36-368m/GHSA-gr6g-pg36-368m.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gr6g-pg36-368m", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49884" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix slab-use-after-free in ext4_split_extent_at()\n\nWe hit the following use-after-free:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in ext4_split_extent_at+0xba8/0xcc0\nRead of size 2 at addr ffff88810548ed08 by task kworker/u20:0/40\nCPU: 0 PID: 40 Comm: kworker/u20:0 Not tainted 6.9.0-dirty #724\nCall Trace:\n \n kasan_report+0x93/0xc0\n ext4_split_extent_at+0xba8/0xcc0\n ext4_split_extent.isra.0+0x18f/0x500\n ext4_split_convert_extents+0x275/0x750\n ext4_ext_handle_unwritten_extents+0x73e/0x1580\n ext4_ext_map_blocks+0xe20/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n\nAllocated by task 40:\n __kmalloc_noprof+0x1ac/0x480\n ext4_find_extent+0xf3b/0x1e70\n ext4_ext_map_blocks+0x188/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n\nFreed by task 40:\n kfree+0xf1/0x2b0\n ext4_find_extent+0xa71/0x1e70\n ext4_ext_insert_extent+0xa22/0x3260\n ext4_split_extent_at+0x3ef/0xcc0\n ext4_split_extent.isra.0+0x18f/0x500\n ext4_split_convert_extents+0x275/0x750\n ext4_ext_handle_unwritten_extents+0x73e/0x1580\n ext4_ext_map_blocks+0xe20/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n==================================================================\n\nThe flow of issue triggering is as follows:\n\next4_split_extent_at\n path = *ppath\n ext4_ext_insert_extent(ppath)\n ext4_ext_create_new_leaf(ppath)\n ext4_find_extent(orig_path)\n path = *orig_path\n read_extent_tree_block\n // return -ENOMEM or -EIO\n ext4_free_ext_path(path)\n kfree(path)\n *orig_path = NULL\n a. If err is -ENOMEM:\n ext4_ext_dirty(path + path->p_depth)\n // path use-after-free !!!\n b. If err is -EIO and we have EXT_DEBUG defined:\n ext4_ext_show_leaf(path)\n eh = path[depth].p_hdr\n // path also use-after-free !!!\n\nSo when trying to zeroout or fix the extent length, call ext4_find_extent()\nto update the path.\n\nIn addition we use *ppath directly as an ext4_ext_show_leaf() input to\navoid possible use-after-free when EXT_DEBUG is defined, and to avoid\nunnecessary path updates.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-h7p9-f9r3-6533/GHSA-h7p9-f9r3-6533.json b/advisories/unreviewed/2024/10/GHSA-h7p9-f9r3-6533/GHSA-h7p9-f9r3-6533.json index 1f3ff2ab790..a6e83355821 100644 --- a/advisories/unreviewed/2024/10/GHSA-h7p9-f9r3-6533/GHSA-h7p9-f9r3-6533.json +++ b/advisories/unreviewed/2024/10/GHSA-h7p9-f9r3-6533/GHSA-h7p9-f9r3-6533.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-h7p9-f9r3-6533", - "modified": "2024-10-21T18:30:56Z", + "modified": "2024-10-25T15:31:24Z", "published": "2024-10-21T18:30:56Z", "aliases": [ "CVE-2024-49867" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: wait for fixup workers before stopping cleaner kthread during umount\n\nDuring unmount, at close_ctree(), we have the following steps in this order:\n\n1) Park the cleaner kthread - this doesn't destroy the kthread, it basically\n halts its execution (wake ups against it work but do nothing);\n\n2) We stop the cleaner kthread - this results in freeing the respective\n struct task_struct;\n\n3) We call btrfs_stop_all_workers() which waits for any jobs running in all\n the work queues and then free the work queues.\n\nSyzbot reported a case where a fixup worker resulted in a crash when doing\na delayed iput on its inode while attempting to wake up the cleaner at\nbtrfs_add_delayed_iput(), because the task_struct of the cleaner kthread\nwas already freed. This can happen during unmount because we don't wait\nfor any fixup workers still running before we call kthread_stop() against\nthe cleaner kthread, which stops and free all its resources.\n\nFix this by waiting for any fixup workers at close_ctree() before we call\nkthread_stop() against the cleaner and run pending delayed iputs.\n\nThe stack traces reported by syzbot were the following:\n\n BUG: KASAN: slab-use-after-free in __lock_acquire+0x77/0x2050 kernel/locking/lockdep.c:5065\n Read of size 8 at addr ffff8880272a8a18 by task kworker/u8:3/52\n\n CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.12.0-rc1-syzkaller #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n Workqueue: btrfs-fixup btrfs_work_helper\n Call Trace:\n \n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n __lock_acquire+0x77/0x2050 kernel/locking/lockdep.c:5065\n lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162\n class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]\n try_to_wake_up+0xb0/0x1480 kernel/sched/core.c:4154\n btrfs_writepage_fixup_worker+0xc16/0xdf0 fs/btrfs/inode.c:2842\n btrfs_work_helper+0x390/0xc50 fs/btrfs/async-thread.c:314\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \n\n Allocated by task 2:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n unpoison_slab_object mm/kasan/common.c:319 [inline]\n __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345\n kasan_slab_alloc include/linux/kasan.h:247 [inline]\n slab_post_alloc_hook mm/slub.c:4086 [inline]\n slab_alloc_node mm/slub.c:4135 [inline]\n kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4187\n alloc_task_struct_node kernel/fork.c:180 [inline]\n dup_task_struct+0x57/0x8c0 kernel/fork.c:1107\n copy_process+0x5d1/0x3d50 kernel/fork.c:2206\n kernel_clone+0x223/0x880 kernel/fork.c:2787\n kernel_thread+0x1bc/0x240 kernel/fork.c:2849\n create_kthread kernel/kthread.c:412 [inline]\n kthreadd+0x60d/0x810 kernel/kthread.c:765\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\n Freed by task 61:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:230 [inline]\n slab_free_h\n---truncated---", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:06Z" diff --git a/advisories/unreviewed/2024/10/GHSA-hw89-rwr4-65g5/GHSA-hw89-rwr4-65g5.json b/advisories/unreviewed/2024/10/GHSA-hw89-rwr4-65g5/GHSA-hw89-rwr4-65g5.json index d58eb6158f2..6c830d70ac4 100644 --- a/advisories/unreviewed/2024/10/GHSA-hw89-rwr4-65g5/GHSA-hw89-rwr4-65g5.json +++ b/advisories/unreviewed/2024/10/GHSA-hw89-rwr4-65g5/GHSA-hw89-rwr4-65g5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hw89-rwr4-65g5", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50026" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: wd33c93: Don't use stale scsi_pointer value\n\nA regression was introduced with commit dbb2da557a6a (\"scsi: wd33c93:\nMove the SCSI pointer to private command data\") which results in an oops\nin wd33c93_intr(). That commit added the scsi_pointer variable and\ninitialized it from hostdata->connected. However, during selection,\nhostdata->connected is not yet valid. Fix this by getting the current\nscsi_pointer from hostdata->selecting.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -39,7 +42,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-m7hg-2r4m-qcxr/GHSA-m7hg-2r4m-qcxr.json b/advisories/unreviewed/2024/10/GHSA-m7hg-2r4m-qcxr/GHSA-m7hg-2r4m-qcxr.json index aa6b56bd9f0..e89fbf1c130 100644 --- a/advisories/unreviewed/2024/10/GHSA-m7hg-2r4m-qcxr/GHSA-m7hg-2r4m-qcxr.json +++ b/advisories/unreviewed/2024/10/GHSA-m7hg-2r4m-qcxr/GHSA-m7hg-2r4m-qcxr.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-m7hg-2r4m-qcxr", - "modified": "2024-10-21T18:30:59Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:59Z", "aliases": [ "CVE-2024-49992" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/stm: Avoid use-after-free issues with crtc and plane\n\nltdc_load() calls functions drm_crtc_init_with_planes(),\ndrm_universal_plane_init() and drm_encoder_init(). These functions\nshould not be called with parameters allocated with devm_kzalloc()\nto avoid use-after-free issues [1].\n\nUse allocations managed by the DRM framework.\n\nFound by Linux Verification Center (linuxtesting.org).\n\n[1]\nhttps://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -41,9 +44,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:19Z" diff --git a/advisories/unreviewed/2024/10/GHSA-mf62-gm5r-38wj/GHSA-mf62-gm5r-38wj.json b/advisories/unreviewed/2024/10/GHSA-mf62-gm5r-38wj/GHSA-mf62-gm5r-38wj.json index ca2bf1b756f..46d691c170c 100644 --- a/advisories/unreviewed/2024/10/GHSA-mf62-gm5r-38wj/GHSA-mf62-gm5r-38wj.json +++ b/advisories/unreviewed/2024/10/GHSA-mf62-gm5r-38wj/GHSA-mf62-gm5r-38wj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mf62-gm5r-38wj", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49899" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Initialize denominators' default to 1\n\n[WHAT & HOW]\nVariables used as denominators and maybe not assigned to other values,\nshould not be 0. Change their default to 1 so they are never 0.\n\nThis fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-369" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:12Z" diff --git a/advisories/unreviewed/2024/10/GHSA-p957-6gfm-79hj/GHSA-p957-6gfm-79hj.json b/advisories/unreviewed/2024/10/GHSA-p957-6gfm-79hj/GHSA-p957-6gfm-79hj.json index 1cb1b453929..9a9a15db279 100644 --- a/advisories/unreviewed/2024/10/GHSA-p957-6gfm-79hj/GHSA-p957-6gfm-79hj.json +++ b/advisories/unreviewed/2024/10/GHSA-p957-6gfm-79hj/GHSA-p957-6gfm-79hj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p957-6gfm-79hj", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50019" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nkthread: unpark only parked kthread\n\nCalling into kthread unparking unconditionally is mostly harmless when\nthe kthread is already unparked. The wake up is then simply ignored\nbecause the target is not in TASK_PARKED state.\n\nHowever if the kthread is per CPU, the wake up is preceded by a call\nto kthread_bind() which expects the task to be inactive and in\nTASK_PARKED state, which obviously isn't the case if it is unparked.\n\nAs a result, calling kthread_stop() on an unparked per-cpu kthread\ntriggers such a warning:\n\n\tWARNING: CPU: 0 PID: 11 at kernel/kthread.c:525 __kthread_bind_mask kernel/kthread.c:525\n\t \n\t kthread_stop+0x17a/0x630 kernel/kthread.c:707\n\t destroy_workqueue+0x136/0xc40 kernel/workqueue.c:5810\n\t wg_destruct+0x1e2/0x2e0 drivers/net/wireguard/device.c:257\n\t netdev_run_todo+0xe1a/0x1000 net/core/dev.c:10693\n\t default_device_exit_batch+0xa14/0xa90 net/core/dev.c:11769\n\t ops_exit_list net/core/net_namespace.c:178 [inline]\n\t cleanup_net+0x89d/0xcc0 net/core/net_namespace.c:640\n\t process_one_work kernel/workqueue.c:3231 [inline]\n\t process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312\n\t worker_thread+0x86d/0xd70 kernel/workqueue.c:3393\n\t kthread+0x2f0/0x390 kernel/kthread.c:389\n\t ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n\t ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\t \n\nFix this with skipping unecessary unparking while stopping a kthread.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -43,7 +46,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-pfh8-68jf-8gq2/GHSA-pfh8-68jf-8gq2.json b/advisories/unreviewed/2024/10/GHSA-pfh8-68jf-8gq2/GHSA-pfh8-68jf-8gq2.json index 90a55cb8818..bbe38ed632b 100644 --- a/advisories/unreviewed/2024/10/GHSA-pfh8-68jf-8gq2/GHSA-pfh8-68jf-8gq2.json +++ b/advisories/unreviewed/2024/10/GHSA-pfh8-68jf-8gq2/GHSA-pfh8-68jf-8gq2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-pfh8-68jf-8gq2", - "modified": "2024-10-21T21:30:51Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:51Z", "aliases": [ "CVE-2022-48970" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Get user_ns from in_skb in unix_diag_get_exact().\n\nWei Chen reported a NULL deref in sk_user_ns() [0][1], and Paolo diagnosed\nthe root cause: in unix_diag_get_exact(), the newly allocated skb does not\nhave sk. [2]\n\nWe must get the user_ns from the NETLINK_CB(in_skb).sk and pass it to\nsk_diag_fill().\n\n[0]:\nBUG: kernel NULL pointer dereference, address: 0000000000000270\n#PF: supervisor read access in kernel mode\n#PF: error_code(0x0000) - not-present page\nPGD 12bbce067 P4D 12bbce067 PUD 12bc40067 PMD 0\nOops: 0000 [#1] PREEMPT SMP\nCPU: 0 PID: 27942 Comm: syz-executor.0 Not tainted 6.1.0-rc5-next-20221118 #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014\nRIP: 0010:sk_user_ns include/net/sock.h:920 [inline]\nRIP: 0010:sk_diag_dump_uid net/unix/diag.c:119 [inline]\nRIP: 0010:sk_diag_fill+0x77d/0x890 net/unix/diag.c:170\nCode: 89 ef e8 66 d4 2d fd c7 44 24 40 00 00 00 00 49 8d 7c 24 18 e8\n54 d7 2d fd 49 8b 5c 24 18 48 8d bb 70 02 00 00 e8 43 d7 2d fd <48> 8b\n9b 70 02 00 00 48 8d 7b 10 e8 33 d7 2d fd 48 8b 5b 10 48 8d\nRSP: 0018:ffffc90000d67968 EFLAGS: 00010246\nRAX: ffff88812badaa48 RBX: 0000000000000000 RCX: ffffffff840d481d\nRDX: 0000000000000465 RSI: 0000000000000000 RDI: 0000000000000270\nRBP: ffffc90000d679a8 R08: 0000000000000277 R09: 0000000000000000\nR10: 0001ffffffffffff R11: 0001c90000d679a8 R12: ffff88812ac03800\nR13: ffff88812c87c400 R14: ffff88812ae42210 R15: ffff888103026940\nFS: 00007f08b4e6f700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000270 CR3: 000000012c58b000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n unix_diag_get_exact net/unix/diag.c:285 [inline]\n unix_diag_handler_dump+0x3f9/0x500 net/unix/diag.c:317\n __sock_diag_cmd net/core/sock_diag.c:235 [inline]\n sock_diag_rcv_msg+0x237/0x250 net/core/sock_diag.c:266\n netlink_rcv_skb+0x13e/0x250 net/netlink/af_netlink.c:2564\n sock_diag_rcv+0x24/0x40 net/core/sock_diag.c:277\n netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]\n netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1356\n netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1932\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg net/socket.c:734 [inline]\n ____sys_sendmsg+0x38f/0x500 net/socket.c:2476\n ___sys_sendmsg net/socket.c:2530 [inline]\n __sys_sendmsg+0x197/0x230 net/socket.c:2559\n __do_sys_sendmsg net/socket.c:2568 [inline]\n __se_sys_sendmsg net/socket.c:2566 [inline]\n __x64_sys_sendmsg+0x42/0x50 net/socket.c:2566\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x4697f9\nCode: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48\n89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d\n01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f08b4e6ec48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 000000000077bf80 RCX: 00000000004697f9\nRDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003\nRBP: 00000000004d29e9 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 000000000077bf80\nR13: 0000000000000000 R14: 000000000077bf80 R15: 00007ffdb36bc6c0\n \nModules linked in:\nCR2: 0000000000000270\n\n[1]: https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/\n[2]: https://lore.kernel.org/netdev/e04315e7c90d9a75613f3993c2baf2d344eef7eb.camel@redhat.com/", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -41,9 +44,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:09Z" diff --git a/advisories/unreviewed/2024/10/GHSA-pgcr-7vhj-26w2/GHSA-pgcr-7vhj-26w2.json b/advisories/unreviewed/2024/10/GHSA-pgcr-7vhj-26w2/GHSA-pgcr-7vhj-26w2.json index 2ea06832136..694ff839201 100644 --- a/advisories/unreviewed/2024/10/GHSA-pgcr-7vhj-26w2/GHSA-pgcr-7vhj-26w2.json +++ b/advisories/unreviewed/2024/10/GHSA-pgcr-7vhj-26w2/GHSA-pgcr-7vhj-26w2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-pgcr-7vhj-26w2", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49941" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpiolib: Fix potential NULL pointer dereference in gpiod_get_label()\n\nIn `gpiod_get_label()`, it is possible that `srcu_dereference_check()` may\nreturn a NULL pointer, leading to a scenario where `label->str` is accessed\nwithout verifying if `label` itself is NULL.\n\nThis patch adds a proper NULL check for `label` before accessing\n`label->str`. The check for `label->str != NULL` is removed because\n`label->str` can never be NULL if `label` is not NULL.\n\nThis fixes the issue where the label name was being printed as `(efault)`\nwhen dumping the sysfs GPIO file when `label == NULL`.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-ppgx-9w2c-p5c8/GHSA-ppgx-9w2c-p5c8.json b/advisories/unreviewed/2024/10/GHSA-ppgx-9w2c-p5c8/GHSA-ppgx-9w2c-p5c8.json index 3cb636659f9..6358cbe2bcf 100644 --- a/advisories/unreviewed/2024/10/GHSA-ppgx-9w2c-p5c8/GHSA-ppgx-9w2c-p5c8.json +++ b/advisories/unreviewed/2024/10/GHSA-ppgx-9w2c-p5c8/GHSA-ppgx-9w2c-p5c8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-ppgx-9w2c-p5c8", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50025" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Move flush_work initialization out of if block\n\nAfter commit 379a58caa199 (\"scsi: fnic: Move fnic_fnic_flush_tx() to a\nwork queue\"), it can happen that a work item is sent to an uninitialized\nwork queue. This may has the effect that the item being queued is never\nactually queued, and any further actions depending on it will not\nproceed.\n\nThe following warning is observed while the fnic driver is loaded:\n\nkernel: WARNING: CPU: 11 PID: 0 at ../kernel/workqueue.c:1524 __queue_work+0x373/0x410\nkernel: \nkernel: queue_work_on+0x3a/0x50\nkernel: fnic_wq_copy_cmpl_handler+0x54a/0x730 [fnic 62fbff0c42e7fb825c60a55cde2fb91facb2ed24]\nkernel: fnic_isr_msix_wq_copy+0x2d/0x60 [fnic 62fbff0c42e7fb825c60a55cde2fb91facb2ed24]\nkernel: __handle_irq_event_percpu+0x36/0x1a0\nkernel: handle_irq_event_percpu+0x30/0x70\nkernel: handle_irq_event+0x34/0x60\nkernel: handle_edge_irq+0x7e/0x1a0\nkernel: __common_interrupt+0x3b/0xb0\nkernel: common_interrupt+0x58/0xa0\nkernel: \n\nIt has been observed that this may break the rediscovery of Fibre\nChannel devices after a temporary fabric failure.\n\nThis patch fixes it by moving the work queue initialization out of\nan if block in fnic_probe().", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-ppw5-g3vp-9xx2/GHSA-ppw5-g3vp-9xx2.json b/advisories/unreviewed/2024/10/GHSA-ppw5-g3vp-9xx2/GHSA-ppw5-g3vp-9xx2.json index dcb0be6b21c..93757d7ede3 100644 --- a/advisories/unreviewed/2024/10/GHSA-ppw5-g3vp-9xx2/GHSA-ppw5-g3vp-9xx2.json +++ b/advisories/unreviewed/2024/10/GHSA-ppw5-g3vp-9xx2/GHSA-ppw5-g3vp-9xx2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-ppw5-g3vp-9xx2", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49900" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uninit-value access of new_ea in ea_buffer\n\nsyzbot reports that lzo1x_1_do_compress is using uninit-value:\n\n=====================================================\nBUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178\n\n...\n\nUninit was stored to memory at:\n ea_put fs/jfs/xattr.c:639 [inline]\n\n...\n\nLocal variable ea_buf created at:\n __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662\n __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934\n\n=====================================================\n\nThe reason is ea_buf->new_ea is not initialized properly.\n\nFix this by using memset to empty its content at the beginning\nin ea_get().", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-908" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:12Z" diff --git a/advisories/unreviewed/2024/10/GHSA-pr32-hjrv-m847/GHSA-pr32-hjrv-m847.json b/advisories/unreviewed/2024/10/GHSA-pr32-hjrv-m847/GHSA-pr32-hjrv-m847.json new file mode 100644 index 00000000000..79ad857d6ab --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-pr32-hjrv-m847/GHSA-pr32-hjrv-m847.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pr32-hjrv-m847", + "modified": "2024-10-25T15:31:31Z", + "published": "2024-10-25T15:31:31Z", + "aliases": [ + "CVE-2024-10380" + ], + "details": "A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/ajax_product.php. The manipulation of the argument drop_services leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10380" + }, + { + "type": "WEB", + "url": "https://github.com/K1nako0/tmp_vuln5/blob/main/README.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.281810" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.281810" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.431174" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-25T13:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-pvgc-vpgw-88mq/GHSA-pvgc-vpgw-88mq.json b/advisories/unreviewed/2024/10/GHSA-pvgc-vpgw-88mq/GHSA-pvgc-vpgw-88mq.json index 38b798118f9..6d7c4e08f56 100644 --- a/advisories/unreviewed/2024/10/GHSA-pvgc-vpgw-88mq/GHSA-pvgc-vpgw-88mq.json +++ b/advisories/unreviewed/2024/10/GHSA-pvgc-vpgw-88mq/GHSA-pvgc-vpgw-88mq.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-pvgc-vpgw-88mq", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:56Z", "aliases": [ "CVE-2024-49881" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: update orig_path in ext4_find_extent()\n\nIn ext4_find_extent(), if the path is not big enough, we free it and set\n*orig_path to NULL. But after reallocating and successfully initializing\nthe path, we don't update *orig_path, in which case the caller gets a\nvalid path but a NULL ppath, and this may cause a NULL pointer dereference\nor a path memory leak. For example:\n\next4_split_extent\n path = *ppath = 2000\n ext4_find_extent\n if (depth > path[0].p_maxdepth)\n kfree(path = 2000);\n *orig_path = path = NULL;\n path = kcalloc() = 3000\n ext4_split_extent_at(*ppath = NULL)\n path = *ppath;\n ex = path[depth].p_ext;\n // NULL pointer dereference!\n\n==================================================================\nBUG: kernel NULL pointer dereference, address: 0000000000000010\nCPU: 6 UID: 0 PID: 576 Comm: fsstress Not tainted 6.11.0-rc2-dirty #847\nRIP: 0010:ext4_split_extent_at+0x6d/0x560\nCall Trace:\n \n ext4_split_extent.isra.0+0xcb/0x1b0\n ext4_ext_convert_to_initialized+0x168/0x6c0\n ext4_ext_handle_unwritten_extents+0x325/0x4d0\n ext4_ext_map_blocks+0x520/0xdb0\n ext4_map_blocks+0x2b0/0x690\n ext4_iomap_begin+0x20e/0x2c0\n[...]\n==================================================================\n\nTherefore, *orig_path is updated when the extent lookup succeeds, so that\nthe caller can safely use path or *ppath.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:10Z" diff --git a/advisories/unreviewed/2024/10/GHSA-q823-fhxh-997g/GHSA-q823-fhxh-997g.json b/advisories/unreviewed/2024/10/GHSA-q823-fhxh-997g/GHSA-q823-fhxh-997g.json index 961f1aba919..1ac833f7328 100644 --- a/advisories/unreviewed/2024/10/GHSA-q823-fhxh-997g/GHSA-q823-fhxh-997g.json +++ b/advisories/unreviewed/2024/10/GHSA-q823-fhxh-997g/GHSA-q823-fhxh-997g.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-q823-fhxh-997g", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49894" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in degamma hardware format translation\n\nFixes index out of bounds issue in\n`cm_helper_translate_curve_to_degamma_hw_format` function. The issue\ncould occur when the index 'i' exceeds the number of transfer function\npoints (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds the function returns\nfalse to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-129" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-q8m3-vwhc-qqmc/GHSA-q8m3-vwhc-qqmc.json b/advisories/unreviewed/2024/10/GHSA-q8m3-vwhc-qqmc/GHSA-q8m3-vwhc-qqmc.json index 30dff1028c4..5ddc09fb9ee 100644 --- a/advisories/unreviewed/2024/10/GHSA-q8m3-vwhc-qqmc/GHSA-q8m3-vwhc-qqmc.json +++ b/advisories/unreviewed/2024/10/GHSA-q8m3-vwhc-qqmc/GHSA-q8m3-vwhc-qqmc.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-q8m3-vwhc-qqmc", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49891" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths\n\nWhen the HBA is undergoing a reset or is handling an errata event, NULL ptr\ndereference crashes may occur in routines such as\nlpfc_sli_flush_io_rings(), lpfc_dev_loss_tmo_callbk(), or\nlpfc_abort_handler().\n\nAdd NULL ptr checks before dereferencing hdwq pointers that may have been\nfreed due to operations colliding with a reset or errata event handler.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-qqcr-57gp-2jmq/GHSA-qqcr-57gp-2jmq.json b/advisories/unreviewed/2024/10/GHSA-qqcr-57gp-2jmq/GHSA-qqcr-57gp-2jmq.json index 1be39f3aa46..68fcbfb5801 100644 --- a/advisories/unreviewed/2024/10/GHSA-qqcr-57gp-2jmq/GHSA-qqcr-57gp-2jmq.json +++ b/advisories/unreviewed/2024/10/GHSA-qqcr-57gp-2jmq/GHSA-qqcr-57gp-2jmq.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-qqcr-57gp-2jmq", - "modified": "2024-10-21T18:30:59Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T18:30:59Z", "aliases": [ "CVE-2024-49994" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix integer overflow in BLKSECDISCARD\n\nI independently rediscovered\n\n\tcommit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155\n\tblock: fix overflow in blk_ioctl_discard()\n\nbut for secure erase.\n\nSame problem:\n\n\tuint64_t r[2] = {512, 18446744073709551104ULL};\n\tioctl(fd, BLKSECDISCARD, r);\n\nwill enter near infinite loop inside blkdev_issue_secure_erase():\n\n\ta.out: attempt to access beyond end of device\n\tloop0: rw=5, sector=3399043073, nr_sectors = 1024 limit=2048\n\tbio_check_eod: 3286214 callbacks suppressed", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-190" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:19Z" diff --git a/advisories/unreviewed/2024/10/GHSA-qwr8-frg5-xvvr/GHSA-qwr8-frg5-xvvr.json b/advisories/unreviewed/2024/10/GHSA-qwr8-frg5-xvvr/GHSA-qwr8-frg5-xvvr.json index 2968bae40fd..41d7b610e9b 100644 --- a/advisories/unreviewed/2024/10/GHSA-qwr8-frg5-xvvr/GHSA-qwr8-frg5-xvvr.json +++ b/advisories/unreviewed/2024/10/GHSA-qwr8-frg5-xvvr/GHSA-qwr8-frg5-xvvr.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-qwr8-frg5-xvvr", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49895" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation\n\nThis commit addresses a potential index out of bounds issue in the\n`cm3_helper_translate_curve_to_degamma_hw_format` function in the DCN30\ncolor management module. The issue could occur when the index 'i'\nexceeds the number of transfer function points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds, the function returns\nfalse to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:338 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:339 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:340 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-129" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-r7rc-x5fw-x42q/GHSA-r7rc-x5fw-x42q.json b/advisories/unreviewed/2024/10/GHSA-r7rc-x5fw-x42q/GHSA-r7rc-x5fw-x42q.json index c2b41c8580c..54ef0429524 100644 --- a/advisories/unreviewed/2024/10/GHSA-r7rc-x5fw-x42q/GHSA-r7rc-x5fw-x42q.json +++ b/advisories/unreviewed/2024/10/GHSA-r7rc-x5fw-x42q/GHSA-r7rc-x5fw-x42q.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-r7rc-x5fw-x42q", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50021" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix improper handling of refcount in ice_dpll_init_rclk_pins()\n\nThis patch addresses a reference count handling issue in the\nice_dpll_init_rclk_pins() function. The function calls ice_dpll_get_pins(),\nwhich increments the reference count of the relevant resources. However,\nif the condition WARN_ON((!vsi || !vsi->netdev)) is met, the function\ncurrently returns an error without properly releasing the resources\nacquired by ice_dpll_get_pins(), leading to a reference count leak.\n\nTo resolve this, the check has been moved to the top of the function. This\nensures that the function verifies the state before any resources are\nacquired, avoiding the need for additional resource management in the\nerror path.\n\nThis bug was identified by an experimental static analysis tool developed\nby our team. The tool specializes in analyzing reference count operations\nand detecting potential issues where resources are not properly managed.\nIn this case, the tool flagged the missing release operation as a\npotential problem, which led to the development of this patch.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-rcg3-vwp6-7grp/GHSA-rcg3-vwp6-7grp.json b/advisories/unreviewed/2024/10/GHSA-rcg3-vwp6-7grp/GHSA-rcg3-vwp6-7grp.json index 9b5f76e7164..9ac18c41b2b 100644 --- a/advisories/unreviewed/2024/10/GHSA-rcg3-vwp6-7grp/GHSA-rcg3-vwp6-7grp.json +++ b/advisories/unreviewed/2024/10/GHSA-rcg3-vwp6-7grp/GHSA-rcg3-vwp6-7grp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rcg3-vwp6-7grp", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49889" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid use-after-free in ext4_ext_show_leaf()\n\nIn ext4_find_extent(), path may be freed by error or be reallocated, so\nusing a previously saved *ppath may have been freed and thus may trigger\nuse-after-free, as follows:\n\next4_split_extent\n path = *ppath;\n ext4_split_extent_at(ppath)\n path = ext4_find_extent(ppath)\n ext4_split_extent_at(ppath)\n // ext4_find_extent fails to free path\n // but zeroout succeeds\n ext4_ext_show_leaf(inode, path)\n eh = path[depth].p_hdr\n // path use-after-free !!!\n\nSimilar to ext4_split_extent_at(), we use *ppath directly as an input to\next4_ext_show_leaf(). Fix a spelling error by the way.\n\nSame problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only\nused in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.\n\nThis issue is triggered only when EXT_DEBUG is defined and therefore does\nnot affect functionality.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-rgx3-g7m3-gj3j/GHSA-rgx3-g7m3-gj3j.json b/advisories/unreviewed/2024/10/GHSA-rgx3-g7m3-gj3j/GHSA-rgx3-g7m3-gj3j.json index b49641376f4..9455574c3d5 100644 --- a/advisories/unreviewed/2024/10/GHSA-rgx3-g7m3-gj3j/GHSA-rgx3-g7m3-gj3j.json +++ b/advisories/unreviewed/2024/10/GHSA-rgx3-g7m3-gj3j/GHSA-rgx3-g7m3-gj3j.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rgx3-g7m3-gj3j", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49903" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uaf in dbFreeBits\n\n[syzbot reported]\n==================================================================\nBUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline]\nBUG: KASAN: slab-use-after-free in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752\nRead of size 8 at addr ffff8880229254b0 by task syz-executor357/5216\n\nCPU: 0 UID: 0 PID: 5216 Comm: syz-executor357 Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024\nCall Trace:\n \n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n __mutex_lock_common kernel/locking/mutex.c:587 [inline]\n __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752\n dbFreeBits+0x7ea/0xd90 fs/jfs/jfs_dmap.c:2390\n dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline]\n dbFree+0x35b/0x680 fs/jfs/jfs_dmap.c:409\n dbDiscardAG+0x8a9/0xa20 fs/jfs/jfs_dmap.c:1650\n jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100\n jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n\nFreed by task 5218:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n poison_slab_object+0xe0/0x150 mm/kasan/common.c:240\n __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256\n kasan_slab_free include/linux/kasan.h:184 [inline]\n slab_free_hook mm/slub.c:2252 [inline]\n slab_free mm/slub.c:4473 [inline]\n kfree+0x149/0x360 mm/slub.c:4594\n dbUnmount+0x11d/0x190 fs/jfs/jfs_dmap.c:278\n jfs_mount_rw+0x4ac/0x6a0 fs/jfs/jfs_mount.c:247\n jfs_remount+0x3d1/0x6b0 fs/jfs/super.c:454\n reconfigure_super+0x445/0x880 fs/super.c:1083\n vfs_cmd_reconfigure fs/fsopen.c:263 [inline]\n vfs_fsconfig_locked fs/fsopen.c:292 [inline]\n __do_sys_fsconfig fs/fsopen.c:473 [inline]\n __se_sys_fsconfig+0xb6e/0xf80 fs/fsopen.c:345\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[Analysis]\nThere are two paths (dbUnmount and jfs_ioc_trim) that generate race\ncondition when accessing bmap, which leads to the occurrence of uaf.\n\nUse the lock s_umount to synchronize them, in order to avoid uaf caused\nby race condition.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:12Z" diff --git a/advisories/unreviewed/2024/10/GHSA-rr7w-hxcc-p96m/GHSA-rr7w-hxcc-p96m.json b/advisories/unreviewed/2024/10/GHSA-rr7w-hxcc-p96m/GHSA-rr7w-hxcc-p96m.json index d7701e350db..1c563003e01 100644 --- a/advisories/unreviewed/2024/10/GHSA-rr7w-hxcc-p96m/GHSA-rr7w-hxcc-p96m.json +++ b/advisories/unreviewed/2024/10/GHSA-rr7w-hxcc-p96m/GHSA-rr7w-hxcc-p96m.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rr7w-hxcc-p96m", - "modified": "2024-10-21T21:30:51Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:51Z", "aliases": [ "CVE-2022-48971" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix not cleanup led when bt_init fails\n\nbt_init() calls bt_leds_init() to register led, but if it fails later,\nbt_leds_cleanup() is not called to unregister it.\n\nThis can cause panic if the argument \"bluetooth-power\" in text is freed\nand then another led_trigger_register() tries to access it:\n\nBUG: unable to handle page fault for address: ffffffffc06d3bc0\nRIP: 0010:strcmp+0xc/0x30\n Call Trace:\n \n led_trigger_register+0x10d/0x4f0\n led_trigger_register_simple+0x7d/0x100\n bt_init+0x39/0xf7 [bluetooth]\n do_one_initcall+0xd0/0x4e0", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -47,7 +50,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:09Z" diff --git a/advisories/unreviewed/2024/10/GHSA-rrr5-xgg4-xqq7/GHSA-rrr5-xgg4-xqq7.json b/advisories/unreviewed/2024/10/GHSA-rrr5-xgg4-xqq7/GHSA-rrr5-xgg4-xqq7.json index 8eda94700e9..c270c9a606e 100644 --- a/advisories/unreviewed/2024/10/GHSA-rrr5-xgg4-xqq7/GHSA-rrr5-xgg4-xqq7.json +++ b/advisories/unreviewed/2024/10/GHSA-rrr5-xgg4-xqq7/GHSA-rrr5-xgg4-xqq7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rrr5-xgg4-xqq7", - "modified": "2024-10-25T09:32:01Z", + "modified": "2024-10-25T15:31:30Z", "published": "2024-10-25T09:32:01Z", "aliases": [ "CVE-2024-9628" diff --git a/advisories/unreviewed/2024/10/GHSA-rvgw-688x-x595/GHSA-rvgw-688x-x595.json b/advisories/unreviewed/2024/10/GHSA-rvgw-688x-x595/GHSA-rvgw-688x-x595.json index ab98d5429de..632003cb7ef 100644 --- a/advisories/unreviewed/2024/10/GHSA-rvgw-688x-x595/GHSA-rvgw-688x-x595.json +++ b/advisories/unreviewed/2024/10/GHSA-rvgw-688x-x595/GHSA-rvgw-688x-x595.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rvgw-688x-x595", - "modified": "2024-10-21T18:30:56Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:56Z", "aliases": [ "CVE-2024-49870" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix dentry leak in cachefiles_open_file()\n\nA dentry leak may be caused when a lookup cookie and a cull are concurrent:\n\n P1 | P2\n-----------------------------------------------------------\ncachefiles_lookup_cookie\n cachefiles_look_up_object\n lookup_one_positive_unlocked\n // get dentry\n cachefiles_cull\n inode->i_flags |= S_KERNEL_FILE;\n cachefiles_open_file\n cachefiles_mark_inode_in_use\n __cachefiles_mark_inode_in_use\n can_use = false\n if (!(inode->i_flags & S_KERNEL_FILE))\n can_use = true\n\t return false\n return false\n // Returns an error but doesn't put dentry\n\nAfter that the following WARNING will be triggered when the backend folder\nis umounted:\n\n==================================================================\nBUG: Dentry 000000008ad87947{i=7a,n=Dx_1_1.img} still in use (1) [unmount of ext4 sda]\nWARNING: CPU: 4 PID: 359261 at fs/dcache.c:1767 umount_check+0x5d/0x70\nCPU: 4 PID: 359261 Comm: umount Not tainted 6.6.0-dirty #25\nRIP: 0010:umount_check+0x5d/0x70\nCall Trace:\n \n d_walk+0xda/0x2b0\n do_one_tree+0x20/0x40\n shrink_dcache_for_umount+0x2c/0x90\n generic_shutdown_super+0x20/0x160\n kill_block_super+0x1a/0x40\n ext4_kill_sb+0x22/0x40\n deactivate_locked_super+0x35/0x80\n cleanup_mnt+0x104/0x160\n==================================================================\n\nWhether cachefiles_open_file() returns true or false, the reference count\nobtained by lookup_positive_unlocked() in cachefiles_look_up_object()\nshould be released.\n\nTherefore release that reference count in cachefiles_look_up_object() to\nfix the above issue and simplify the code.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -41,9 +44,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-401" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:08Z" diff --git a/advisories/unreviewed/2024/10/GHSA-vp2p-wqj6-25wf/GHSA-vp2p-wqj6-25wf.json b/advisories/unreviewed/2024/10/GHSA-vp2p-wqj6-25wf/GHSA-vp2p-wqj6-25wf.json index f629a59b4d8..de9318a89e8 100644 --- a/advisories/unreviewed/2024/10/GHSA-vp2p-wqj6-25wf/GHSA-vp2p-wqj6-25wf.json +++ b/advisories/unreviewed/2024/10/GHSA-vp2p-wqj6-25wf/GHSA-vp2p-wqj6-25wf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-vp2p-wqj6-25wf", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49936" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/xen-netback: prevent UAF in xenvif_flush_hash()\n\nDuring the list_for_each_entry_rcu iteration call of xenvif_flush_hash,\nkfree_rcu does not exist inside the rcu read critical section, so if\nkfree_rcu is called when the rcu grace period ends during the iteration,\nUAF occurs when accessing head->next after the entry becomes free.\n\nTherefore, to solve this, you need to change it to list_for_each_entry_safe.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-vw3v-9427-r3gf/GHSA-vw3v-9427-r3gf.json b/advisories/unreviewed/2024/10/GHSA-vw3v-9427-r3gf/GHSA-vw3v-9427-r3gf.json index a166441af7e..439c92847c2 100644 --- a/advisories/unreviewed/2024/10/GHSA-vw3v-9427-r3gf/GHSA-vw3v-9427-r3gf.json +++ b/advisories/unreviewed/2024/10/GHSA-vw3v-9427-r3gf/GHSA-vw3v-9427-r3gf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-vw3v-9427-r3gf", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49921" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before used\n\n[WHAT & HOW]\nPoniters, such as dc->clk_mgr, are null checked previously in the same\nfunction, so Coverity warns \"implies that \"dc->clk_mgr\" might be null\".\nAs a result, these pointers need to be checked when used again.\n\nThis fixes 10 FORWARD_NULL issues reported by Coverity.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/10/GHSA-vxq8-9rpj-hgjg/GHSA-vxq8-9rpj-hgjg.json b/advisories/unreviewed/2024/10/GHSA-vxq8-9rpj-hgjg/GHSA-vxq8-9rpj-hgjg.json index 67f7da05a56..f777a5e257d 100644 --- a/advisories/unreviewed/2024/10/GHSA-vxq8-9rpj-hgjg/GHSA-vxq8-9rpj-hgjg.json +++ b/advisories/unreviewed/2024/10/GHSA-vxq8-9rpj-hgjg/GHSA-vxq8-9rpj-hgjg.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-vxq8-9rpj-hgjg", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50023" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: Remove LED entry from LEDs list on unregister\n\nCommit c938ab4da0eb (\"net: phy: Manual remove LEDs to ensure correct\nordering\") correctly fixed a problem with using devm_ but missed\nremoving the LED entry from the LEDs list.\n\nThis cause kernel panic on specific scenario where the port for the PHY\nis torn down and up and the kmod for the PHY is removed.\n\nOn setting the port down the first time, the assosiacted LEDs are\ncorrectly unregistered. The associated kmod for the PHY is now removed.\nThe kmod is now added again and the port is now put up, the associated LED\nare registered again.\nOn putting the port down again for the second time after these step, the\nLED list now have 4 elements. With the first 2 already unregistered\npreviously and the 2 new one registered again.\n\nThis cause a kernel panic as the first 2 element should have been\nremoved.\n\nFix this by correctly removing the element when LED is unregistered.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-w33q-x299-hh5v/GHSA-w33q-x299-hh5v.json b/advisories/unreviewed/2024/10/GHSA-w33q-x299-hh5v/GHSA-w33q-x299-hh5v.json index 490b151a0a0..7cbb4e3b94d 100644 --- a/advisories/unreviewed/2024/10/GHSA-w33q-x299-hh5v/GHSA-w33q-x299-hh5v.json +++ b/advisories/unreviewed/2024/10/GHSA-w33q-x299-hh5v/GHSA-w33q-x299-hh5v.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-w33q-x299-hh5v", - "modified": "2024-10-21T21:30:52Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:52Z", "aliases": [ "CVE-2022-49003" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix SRCU protection of nvme_ns_head list\n\nWalking the nvme_ns_head siblings list is protected by the head's srcu\nin nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths().\nRemoving namespaces from the list also fails to synchronize the srcu.\nConcurrent scan work can therefore cause use-after-frees.\n\nHold the head's srcu lock in nvme_mpath_revalidate_paths() and\nsynchronize with the srcu, not the global RCU, in nvme_ns_remove().\n\nObserved the following panic when making NVMe/RDMA connections\nwith native multipath on the Rocky Linux 8.6 kernel\n(it seems the upstream kernel has the same race condition).\nDisassembly shows the faulting instruction is cmp 0x50(%rdx),%rcx;\ncomputing capacity != get_capacity(ns->disk).\nAddress 0x50 is dereferenced because ns->disk is NULL.\nThe NULL disk appears to be the result of concurrent scan work\nfreeing the namespace (note the log line in the middle of the panic).\n\n[37314.206036] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050\n[37314.206036] nvme0n3: detected capacity change from 0 to 11811160064\n[37314.299753] PGD 0 P4D 0\n[37314.299756] Oops: 0000 [#1] SMP PTI\n[37314.299759] CPU: 29 PID: 322046 Comm: kworker/u98:3 Kdump: loaded Tainted: G W X --------- - - 4.18.0-372.32.1.el8test86.x86_64 #1\n[37314.299762] Hardware name: Dell Inc. PowerEdge R720/0JP31P, BIOS 2.7.0 05/23/2018\n[37314.299763] Workqueue: nvme-wq nvme_scan_work [nvme_core]\n[37314.299783] RIP: 0010:nvme_mpath_revalidate_paths+0x26/0xb0 [nvme_core]\n[37314.299790] Code: 1f 44 00 00 66 66 66 66 90 55 53 48 8b 5f 50 48 8b 83 c8 c9 00 00 48 8b 13 48 8b 48 50 48 39 d3 74 20 48 8d 42 d0 48 8b 50 20 <48> 3b 4a 50 74 05 f0 80 60 70 ef 48 8b 50 30 48 8d 42 d0 48 39 d3\n[37315.058803] RSP: 0018:ffffabe28f913d10 EFLAGS: 00010202\n[37315.121316] RAX: ffff927a077da800 RBX: ffff92991dd70000 RCX: 0000000001600000\n[37315.206704] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff92991b719800\n[37315.292106] RBP: ffff929a6b70c000 R08: 000000010234cd4a R09: c0000000ffff7fff\n[37315.377501] R10: 0000000000000001 R11: ffffabe28f913a30 R12: 0000000000000000\n[37315.462889] R13: ffff92992716600c R14: ffff929964e6e030 R15: ffff92991dd70000\n[37315.548286] FS: 0000000000000000(0000) GS:ffff92b87fb80000(0000) knlGS:0000000000000000\n[37315.645111] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[37315.713871] CR2: 0000000000000050 CR3: 0000002208810006 CR4: 00000000000606e0\n[37315.799267] Call Trace:\n[37315.828515] nvme_update_ns_info+0x1ac/0x250 [nvme_core]\n[37315.892075] nvme_validate_or_alloc_ns+0x2ff/0xa00 [nvme_core]\n[37315.961871] ? __blk_mq_free_request+0x6b/0x90\n[37316.015021] nvme_scan_work+0x151/0x240 [nvme_core]\n[37316.073371] process_one_work+0x1a7/0x360\n[37316.121318] ? create_worker+0x1a0/0x1a0\n[37316.168227] worker_thread+0x30/0x390\n[37316.212024] ? create_worker+0x1a0/0x1a0\n[37316.258939] kthread+0x10a/0x120\n[37316.297557] ? set_kthread_struct+0x50/0x50\n[37316.347590] ret_from_fork+0x35/0x40\n[37316.390360] Modules linked in: nvme_rdma nvme_tcp(X) nvme_fabrics nvme_core netconsole iscsi_tcp libiscsi_tcp dm_queue_length dm_service_time nf_conntrack_netlink br_netfilter bridge stp llc overlay nft_chain_nat ipt_MASQUERADE nf_nat xt_addrtype xt_CT nft_counter xt_state xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_comment xt_multiport nft_compat nf_tables libcrc32c nfnetlink dm_multipath tg3 rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm intel_rapl_msr iTCO_wdt iTCO_vendor_support dcdbas intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel ipmi_ssif kvm irqbypass crct10dif_pclmul crc32_pclmul mlx5_ib ghash_clmulni_intel ib_uverbs rapl intel_cstate intel_uncore ib_core ipmi_si joydev mei_me pcspkr ipmi_devintf mei lpc_ich wmi ipmi_msghandler acpi_power_meter ex\n---truncated---", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-w38v-phv7-fjq8/GHSA-w38v-phv7-fjq8.json b/advisories/unreviewed/2024/10/GHSA-w38v-phv7-fjq8/GHSA-w38v-phv7-fjq8.json index 6a6ee83941e..ddf77a336da 100644 --- a/advisories/unreviewed/2024/10/GHSA-w38v-phv7-fjq8/GHSA-w38v-phv7-fjq8.json +++ b/advisories/unreviewed/2024/10/GHSA-w38v-phv7-fjq8/GHSA-w38v-phv7-fjq8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-w38v-phv7-fjq8", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49883" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: aovid use-after-free in ext4_ext_insert_extent()\n\nAs Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is\nreallocated in ext4_ext_create_new_leaf(), we'll use the stale path and\ncause UAF. Below is a sample trace with dummy values:\n\next4_ext_insert_extent\n path = *ppath = 2000\n ext4_ext_create_new_leaf(ppath)\n ext4_find_extent(ppath)\n path = *ppath = 2000\n if (depth > path[0].p_maxdepth)\n kfree(path = 2000);\n *ppath = path = NULL;\n path = kcalloc() = 3000\n *ppath = 3000;\n return path;\n /* here path is still 2000, UAF! */\n eh = path[depth].p_hdr\n\n==================================================================\nBUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330\nRead of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179\nCPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866\nCall Trace:\n \n ext4_ext_insert_extent+0x26d4/0x3330\n ext4_ext_map_blocks+0xe22/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n[...]\n\nAllocated by task 179:\n ext4_find_extent+0x81c/0x1f70\n ext4_ext_map_blocks+0x146/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n ext4_writepages+0x26d/0x4e0\n do_writepages+0x175/0x700\n[...]\n\nFreed by task 179:\n kfree+0xcb/0x240\n ext4_find_extent+0x7c0/0x1f70\n ext4_ext_insert_extent+0xa26/0x3330\n ext4_ext_map_blocks+0xe22/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n ext4_writepages+0x26d/0x4e0\n do_writepages+0x175/0x700\n[...]\n==================================================================\n\nSo use *ppath to update the path to avoid the above problem.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-w9mh-rcjr-98rv/GHSA-w9mh-rcjr-98rv.json b/advisories/unreviewed/2024/10/GHSA-w9mh-rcjr-98rv/GHSA-w9mh-rcjr-98rv.json index 8547d8e1ece..47486ae2482 100644 --- a/advisories/unreviewed/2024/10/GHSA-w9mh-rcjr-98rv/GHSA-w9mh-rcjr-98rv.json +++ b/advisories/unreviewed/2024/10/GHSA-w9mh-rcjr-98rv/GHSA-w9mh-rcjr-98rv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-w9mh-rcjr-98rv", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50027" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Free tzp copy along with the thermal zone\n\nThe object pointed to by tz->tzp may still be accessed after being\nfreed in thermal_zone_device_unregister(), so move the freeing of it\nto the point after the removal completion has been completed at which\nit cannot be accessed any more.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:16Z" diff --git a/advisories/unreviewed/2024/10/GHSA-wh99-hh68-w2m5/GHSA-wh99-hh68-w2m5.json b/advisories/unreviewed/2024/10/GHSA-wh99-hh68-w2m5/GHSA-wh99-hh68-w2m5.json index fb89c89547d..5fdf5267f42 100644 --- a/advisories/unreviewed/2024/10/GHSA-wh99-hh68-w2m5/GHSA-wh99-hh68-w2m5.json +++ b/advisories/unreviewed/2024/10/GHSA-wh99-hh68-w2m5/GHSA-wh99-hh68-w2m5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wh99-hh68-w2m5", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49919" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn201_acquire_free_pipe_for_layer` function. The issue could occur\nwhen `head_pipe` is null.\n\nThe fix adds a check to ensure `head_pipe` is not null before asserting\nit. If `head_pipe` is null, the function returns NULL to prevent a\npotential null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn201/dcn201_resource.c:1016 dcn201_acquire_free_pipe_for_layer() error: we previously assumed 'head_pipe' could be null (see line 1010)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/10/GHSA-wmvc-26px-x5xp/GHSA-wmvc-26px-x5xp.json b/advisories/unreviewed/2024/10/GHSA-wmvc-26px-x5xp/GHSA-wmvc-26px-x5xp.json new file mode 100644 index 00000000000..da89de58f81 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-wmvc-26px-x5xp/GHSA-wmvc-26px-x5xp.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wmvc-26px-x5xp", + "modified": "2024-10-25T15:31:24Z", + "published": "2024-10-25T15:31:24Z", + "aliases": [ + "CVE-2023-33870" + ], + "details": "Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33870" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00993.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-277", + "CWE-732" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-14T14:15:55Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-wp5m-wvhw-w3c5/GHSA-wp5m-wvhw-w3c5.json b/advisories/unreviewed/2024/10/GHSA-wp5m-wvhw-w3c5/GHSA-wp5m-wvhw-w3c5.json index f1c9246e111..cc3706b2bb1 100644 --- a/advisories/unreviewed/2024/10/GHSA-wp5m-wvhw-w3c5/GHSA-wp5m-wvhw-w3c5.json +++ b/advisories/unreviewed/2024/10/GHSA-wp5m-wvhw-w3c5/GHSA-wp5m-wvhw-w3c5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wp5m-wvhw-w3c5", - "modified": "2024-10-21T21:30:52Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:52Z", "aliases": [ "CVE-2022-49002" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() for the error path to avoid reference count leak.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -55,7 +58,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-wqrm-fg5q-j57m/GHSA-wqrm-fg5q-j57m.json b/advisories/unreviewed/2024/10/GHSA-wqrm-fg5q-j57m/GHSA-wqrm-fg5q-j57m.json index f7ecfcd127d..9d6be287955 100644 --- a/advisories/unreviewed/2024/10/GHSA-wqrm-fg5q-j57m/GHSA-wqrm-fg5q-j57m.json +++ b/advisories/unreviewed/2024/10/GHSA-wqrm-fg5q-j57m/GHSA-wqrm-fg5q-j57m.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wqrm-fg5q-j57m", - "modified": "2024-10-21T21:30:52Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:52Z", "aliases": [ "CVE-2022-49008" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: can327: can327_feed_frame_to_netdev(): fix potential skb leak when netdev is down\n\nIn can327_feed_frame_to_netdev(), it did not free the skb when netdev\nis down, and all callers of can327_feed_frame_to_netdev() did not free\nallocated skb too. That would trigger skb leak.\n\nFix it by adding kfree_skb() in can327_feed_frame_to_netdev() when netdev\nis down. Not tested, just compiled.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-401" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:12Z" diff --git a/advisories/unreviewed/2024/10/GHSA-wwxf-59f4-wv9m/GHSA-wwxf-59f4-wv9m.json b/advisories/unreviewed/2024/10/GHSA-wwxf-59f4-wv9m/GHSA-wwxf-59f4-wv9m.json index 1ed0743428a..013d1c55fd4 100644 --- a/advisories/unreviewed/2024/10/GHSA-wwxf-59f4-wv9m/GHSA-wwxf-59f4-wv9m.json +++ b/advisories/unreviewed/2024/10/GHSA-wwxf-59f4-wv9m/GHSA-wwxf-59f4-wv9m.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wwxf-59f4-wv9m", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50024" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix an unsafe loop on the list\n\nThe kernel may crash when deleting a genetlink family if there are still\nlisteners for that family:\n\nOops: Kernel access of bad area, sig: 11 [#1]\n ...\n NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0\n LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0\n Call Trace:\n__netlink_clear_multicast_users+0x74/0xc0\ngenl_unregister_family+0xd4/0x2d0\n\nChange the unsafe loop on the list to a safe one, because inside the\nloop there is an element removal from this list.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -47,7 +50,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-wwxr-xf9x-xpj6/GHSA-wwxr-xf9x-xpj6.json b/advisories/unreviewed/2024/10/GHSA-wwxr-xf9x-xpj6/GHSA-wwxr-xf9x-xpj6.json new file mode 100644 index 00000000000..de15d3a2d93 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-wwxr-xf9x-xpj6/GHSA-wwxr-xf9x-xpj6.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wwxr-xf9x-xpj6", + "modified": "2024-10-25T15:31:31Z", + "published": "2024-10-25T15:31:31Z", + "aliases": [ + "CVE-2024-10381" + ], + "details": "This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the vulnerable device.\n\nSuccessful exploitation of this vulnerability could allow remote attacker to gain unauthorized access and take complete control of the targeted device.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10381" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0328" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-288" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-25T13:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-x5vx-qmf9-2r9v/GHSA-x5vx-qmf9-2r9v.json b/advisories/unreviewed/2024/10/GHSA-x5vx-qmf9-2r9v/GHSA-x5vx-qmf9-2r9v.json index 50ce060cec1..3cebc56d596 100644 --- a/advisories/unreviewed/2024/10/GHSA-x5vx-qmf9-2r9v/GHSA-x5vx-qmf9-2r9v.json +++ b/advisories/unreviewed/2024/10/GHSA-x5vx-qmf9-2r9v/GHSA-x5vx-qmf9-2r9v.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-x5vx-qmf9-2r9v", - "modified": "2024-10-21T18:30:57Z", + "modified": "2024-10-25T15:31:25Z", "published": "2024-10-21T18:30:57Z", "aliases": [ "CVE-2024-49892" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Initialize get_bytes_per_element's default to 1\n\nVariables, used as denominators and maybe not assigned to other values,\nshould not be 0. bytes_per_element_y & bytes_per_element_c are\ninitialized by get_bytes_per_element() which should never return 0.\n\nThis fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-369" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-xcmw-c2xm-xxjw/GHSA-xcmw-c2xm-xxjw.json b/advisories/unreviewed/2024/10/GHSA-xcmw-c2xm-xxjw/GHSA-xcmw-c2xm-xxjw.json index 2c466f936b8..112ccad9a29 100644 --- a/advisories/unreviewed/2024/10/GHSA-xcmw-c2xm-xxjw/GHSA-xcmw-c2xm-xxjw.json +++ b/advisories/unreviewed/2024/10/GHSA-xcmw-c2xm-xxjw/GHSA-xcmw-c2xm-xxjw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xcmw-c2xm-xxjw", - "modified": "2024-10-21T21:30:53Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:53Z", "aliases": [ "CVE-2024-50028" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Reference count the zone in thermal_zone_get_by_id()\n\nThere are places in the thermal netlink code where nothing prevents\nthe thermal zone object from going away while being accessed after it\nhas been returned by thermal_zone_get_by_id().\n\nTo address this, make thermal_zone_get_by_id() get a reference on the\nthermal zone device object to be returned with the help of get_device(),\nunder thermal_list_lock, and adjust all of its callers to this change\nwith the help of the cleanup.h infrastructure.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:16Z" diff --git a/advisories/unreviewed/2024/10/GHSA-xjr6-8999-vr65/GHSA-xjr6-8999-vr65.json b/advisories/unreviewed/2024/10/GHSA-xjr6-8999-vr65/GHSA-xjr6-8999-vr65.json index 6815d63ea30..67ea67ea5e5 100644 --- a/advisories/unreviewed/2024/10/GHSA-xjr6-8999-vr65/GHSA-xjr6-8999-vr65.json +++ b/advisories/unreviewed/2024/10/GHSA-xjr6-8999-vr65/GHSA-xjr6-8999-vr65.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xjr6-8999-vr65", - "modified": "2024-10-23T15:31:07Z", + "modified": "2024-10-25T15:31:26Z", "published": "2024-10-21T21:30:52Z", "aliases": [ "CVE-2022-49006" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Free buffers when a used dynamic event is removed\n\nAfter 65536 dynamic events have been added and removed, the \"type\" field\nof the event then uses the first type number that is available (not\ncurrently used by other events). A type number is the identifier of the\nbinary blobs in the tracing ring buffer (known as events) to map them to\nlogic that can parse the binary blob.\n\nThe issue is that if a dynamic event (like a kprobe event) is traced and\nis in the ring buffer, and then that event is removed (because it is\ndynamic, which means it can be created and destroyed), if another dynamic\nevent is created that has the same number that new event's logic on\nparsing the binary blob will be used.\n\nTo show how this can be an issue, the following can crash the kernel:\n\n # cd /sys/kernel/tracing\n # for i in `seq 65536`; do\n echo 'p:kprobes/foo do_sys_openat2 $arg1:u32' > kprobe_events\n # done\n\nFor every iteration of the above, the writing to the kprobe_events will\nremove the old event and create a new one (with the same format) and\nincrease the type number to the next available on until the type number\nreaches over 65535 which is the max number for the 16 bit type. After it\nreaches that number, the logic to allocate a new number simply looks for\nthe next available number. When an dynamic event is removed, that number\nis then available to be reused by the next dynamic event created. That is,\nonce the above reaches the max number, the number assigned to the event in\nthat loop will remain the same.\n\nNow that means deleting one dynamic event and created another will reuse\nthe previous events type number. This is where bad things can happen.\nAfter the above loop finishes, the kprobes/foo event which reads the\ndo_sys_openat2 function call's first parameter as an integer.\n\n # echo 1 > kprobes/foo/enable\n # cat /etc/passwd > /dev/null\n # cat trace\n cat-2211 [005] .... 2007.849603: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n cat-2211 [005] .... 2007.849620: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n cat-2211 [005] .... 2007.849838: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n cat-2211 [005] .... 2007.849880: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n # echo 0 > kprobes/foo/enable\n\nNow if we delete the kprobe and create a new one that reads a string:\n\n # echo 'p:kprobes/foo do_sys_openat2 +0($arg2):string' > kprobe_events\n\nAnd now we can the trace:\n\n # cat trace\n sendmail-1942 [002] ..... 530.136320: foo: (do_sys_openat2+0x0/0x240) arg1= cat-2046 [004] ..... 530.930817: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n cat-2046 [004] ..... 530.930961: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n cat-2046 [004] ..... 530.934278: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n cat-2046 [004] ..... 530.934563: foo: (do_sys_openat2+0x0/0x240) arg1=\"���������������������������������������\n---truncated---", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -41,9 +44,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T20:15:12Z"