From bd688e1ac79ff5298989949a4adf8f423b07c8ce Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 29 Aug 2024 03:32:11 +0000 Subject: [PATCH] Publish Advisories GHSA-3q6x-gxwh-88p9 GHSA-46q5-wp2g-gv63 GHSA-8pf7-jhff-4vgr GHSA-wp7p-m23w-r9gj GHSA-5q4q-m5m5-mr8p GHSA-5v94-m7ff-m26p GHSA-7358-gfxq-387j GHSA-846m-99qv-67mg GHSA-8rqg-fx6m-3c97 GHSA-967p-q58c-5vc2 GHSA-hm85-hr96-4gwf GHSA-j6hw-jr7w-8c5m GHSA-jfp9-mpfm-8qc7 GHSA-p9p6-vvr2-mf86 GHSA-pxx8-p2cf-4q57 GHSA-wcc4-c252-rxxr --- .../GHSA-3q6x-gxwh-88p9.json | 11 ++-- .../GHSA-46q5-wp2g-gv63.json | 11 ++-- .../GHSA-8pf7-jhff-4vgr.json | 11 ++-- .../GHSA-wp7p-m23w-r9gj.json | 11 ++-- .../GHSA-5q4q-m5m5-mr8p.json | 11 ++-- .../GHSA-5v94-m7ff-m26p.json | 11 ++-- .../GHSA-7358-gfxq-387j.json | 39 +++++++++++++++ .../GHSA-846m-99qv-67mg.json | 39 +++++++++++++++ .../GHSA-8rqg-fx6m-3c97.json | 9 ++-- .../GHSA-967p-q58c-5vc2.json | 50 +++++++++++++++++++ .../GHSA-hm85-hr96-4gwf.json | 11 ++-- .../GHSA-j6hw-jr7w-8c5m.json | 11 ++-- .../GHSA-jfp9-mpfm-8qc7.json | 43 ++++++++++++++++ .../GHSA-p9p6-vvr2-mf86.json | 11 ++-- .../GHSA-pxx8-p2cf-4q57.json | 11 ++-- .../GHSA-wcc4-c252-rxxr.json | 11 ++-- 16 files changed, 254 insertions(+), 47 deletions(-) create mode 100644 advisories/unreviewed/2024/08/GHSA-7358-gfxq-387j/GHSA-7358-gfxq-387j.json create mode 100644 advisories/unreviewed/2024/08/GHSA-846m-99qv-67mg/GHSA-846m-99qv-67mg.json create mode 100644 advisories/unreviewed/2024/08/GHSA-967p-q58c-5vc2/GHSA-967p-q58c-5vc2.json create mode 100644 advisories/unreviewed/2024/08/GHSA-jfp9-mpfm-8qc7/GHSA-jfp9-mpfm-8qc7.json diff --git a/advisories/unreviewed/2024/06/GHSA-3q6x-gxwh-88p9/GHSA-3q6x-gxwh-88p9.json b/advisories/unreviewed/2024/06/GHSA-3q6x-gxwh-88p9/GHSA-3q6x-gxwh-88p9.json index bb841aed99e..8dd2d03202b 100644 --- a/advisories/unreviewed/2024/06/GHSA-3q6x-gxwh-88p9/GHSA-3q6x-gxwh-88p9.json +++ b/advisories/unreviewed/2024/06/GHSA-3q6x-gxwh-88p9/GHSA-3q6x-gxwh-88p9.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3q6x-gxwh-88p9", - "modified": "2024-06-19T15:30:52Z", + "modified": "2024-08-29T03:30:48Z", "published": "2024-06-19T15:30:52Z", "aliases": [ "CVE-2024-38543" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/test_hmm.c: handle src_pfns and dst_pfns allocation failure\n\nThe kcalloc() in dmirror_device_evict_chunk() will return null if the\nphysical memory has run out. As a result, if src_pfns or dst_pfns is\ndereferenced, the null pointer dereference bug will happen.\n\nMoreover, the device is going away. If the kcalloc() fails, the pages\nmapping a chunk could not be evicted. So add a __GFP_NOFAIL flag in\nkcalloc().\n\nFinally, as there is no need to have physically contiguous memory, Switch\nkcalloc() to kvcalloc() in order to avoid failing allocations.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -41,9 +44,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-06-19T14:15:14Z" diff --git a/advisories/unreviewed/2024/06/GHSA-46q5-wp2g-gv63/GHSA-46q5-wp2g-gv63.json b/advisories/unreviewed/2024/06/GHSA-46q5-wp2g-gv63/GHSA-46q5-wp2g-gv63.json index 54ad4a1c563..e12db65f6d1 100644 --- a/advisories/unreviewed/2024/06/GHSA-46q5-wp2g-gv63/GHSA-46q5-wp2g-gv63.json +++ b/advisories/unreviewed/2024/06/GHSA-46q5-wp2g-gv63/GHSA-46q5-wp2g-gv63.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-46q5-wp2g-gv63", - "modified": "2024-06-19T15:30:52Z", + "modified": "2024-08-29T03:30:48Z", "published": "2024-06-19T15:30:52Z", "aliases": [ "CVE-2024-38538" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: xmit: make sure we have at least eth header len bytes\n\nsyzbot triggered an uninit value[1] error in bridge device's xmit path\nby sending a short (less than ETH_HLEN bytes) skb. To fix it check if\nwe can actually pull that amount instead of assuming.\n\nTested with dropwatch:\n drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3)\n origin: software\n timestamp: Mon May 13 11:31:53 2024 778214037 nsec\n protocol: 0x88a8\n length: 2\n original length: 2\n drop reason: PKT_TOO_SMALL\n\n[1]\nBUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65\n br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65\n __netdev_start_xmit include/linux/netdevice.h:4903 [inline]\n netdev_start_xmit include/linux/netdevice.h:4917 [inline]\n xmit_one net/core/dev.c:3531 [inline]\n dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547\n __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341\n dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n __bpf_tx_skb net/core/filter.c:2136 [inline]\n __bpf_redirect_common net/core/filter.c:2180 [inline]\n __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187\n ____bpf_clone_redirect net/core/filter.c:2460 [inline]\n bpf_clone_redirect+0x328/0x470 net/core/filter.c:2432\n ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997\n __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2238\n bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]\n __bpf_prog_run include/linux/filter.h:657 [inline]\n bpf_prog_run include/linux/filter.h:664 [inline]\n bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425\n bpf_prog_test_run_skb+0x14ea/0x1f20 net/bpf/test_run.c:1058\n bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269\n __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678\n __do_sys_bpf kernel/bpf/syscall.c:5767 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5765 [inline]\n __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765\n x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } ], "affected": [ @@ -41,9 +44,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-908" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-06-19T14:15:14Z" diff --git a/advisories/unreviewed/2024/06/GHSA-8pf7-jhff-4vgr/GHSA-8pf7-jhff-4vgr.json b/advisories/unreviewed/2024/06/GHSA-8pf7-jhff-4vgr/GHSA-8pf7-jhff-4vgr.json index 1333198d465..f559a04bb19 100644 --- a/advisories/unreviewed/2024/06/GHSA-8pf7-jhff-4vgr/GHSA-8pf7-jhff-4vgr.json +++ b/advisories/unreviewed/2024/06/GHSA-8pf7-jhff-4vgr/GHSA-8pf7-jhff-4vgr.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8pf7-jhff-4vgr", - "modified": "2024-06-18T21:30:36Z", + "modified": "2024-08-29T03:30:48Z", "published": "2024-06-18T21:30:36Z", "aliases": [ "CVE-2024-36976" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"media: v4l2-ctrls: show all owned controls in log_status\"\n\nThis reverts commit 9801b5b28c6929139d6fceeee8d739cc67bb2739.\n\nThis patch introduced a potential deadlock scenario:\n\n[Wed May 8 10:02:06 2024] Possible unsafe locking scenario:\n\n[Wed May 8 10:02:06 2024] CPU0 CPU1\n[Wed May 8 10:02:06 2024] ---- ----\n[Wed May 8 10:02:06 2024] lock(vivid_ctrls:1620:(hdl_vid_cap)->_lock);\n[Wed May 8 10:02:06 2024] lock(vivid_ctrls:1608:(hdl_user_vid)->_lock);\n[Wed May 8 10:02:06 2024] lock(vivid_ctrls:1620:(hdl_vid_cap)->_lock);\n[Wed May 8 10:02:06 2024] lock(vivid_ctrls:1608:(hdl_user_vid)->_lock);\n\nFor now just revert.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-667" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-06-18T20:15:13Z" diff --git a/advisories/unreviewed/2024/06/GHSA-wp7p-m23w-r9gj/GHSA-wp7p-m23w-r9gj.json b/advisories/unreviewed/2024/06/GHSA-wp7p-m23w-r9gj/GHSA-wp7p-m23w-r9gj.json index 0108aaf09ed..8909c361a7e 100644 --- a/advisories/unreviewed/2024/06/GHSA-wp7p-m23w-r9gj/GHSA-wp7p-m23w-r9gj.json +++ b/advisories/unreviewed/2024/06/GHSA-wp7p-m23w-r9gj/GHSA-wp7p-m23w-r9gj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wp7p-m23w-r9gj", - "modified": "2024-06-19T15:30:53Z", + "modified": "2024-08-29T03:30:48Z", "published": "2024-06-19T15:30:53Z", "aliases": [ "CVE-2024-38557" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Reload only IB representors upon lag disable/enable\n\nOn lag disable, the bond IB device along with all of its\nrepresentors are destroyed, and then the slaves' representors get reloaded.\n\nIn case the slave IB representor load fails, the eswitch error flow\nunloads all representors, including ethernet representors, where the\nnetdevs get detached and removed from lag bond. Such flow is inaccurate\nas the lag driver is not responsible for loading/unloading ethernet\nrepresentors. Furthermore, the flow described above begins by holding\nlag lock to prevent bond changes during disable flow. However, when\nreaching the ethernet representors detachment from lag, the lag lock is\nrequired again, triggering the following deadlock:\n\nCall trace:\n__switch_to+0xf4/0x148\n__schedule+0x2c8/0x7d0\nschedule+0x50/0xe0\nschedule_preempt_disabled+0x18/0x28\n__mutex_lock.isra.13+0x2b8/0x570\n__mutex_lock_slowpath+0x1c/0x28\nmutex_lock+0x4c/0x68\nmlx5_lag_remove_netdev+0x3c/0x1a0 [mlx5_core]\nmlx5e_uplink_rep_disable+0x70/0xa0 [mlx5_core]\nmlx5e_detach_netdev+0x6c/0xb0 [mlx5_core]\nmlx5e_netdev_change_profile+0x44/0x138 [mlx5_core]\nmlx5e_netdev_attach_nic_profile+0x28/0x38 [mlx5_core]\nmlx5e_vport_rep_unload+0x184/0x1b8 [mlx5_core]\nmlx5_esw_offloads_rep_load+0xd8/0xe0 [mlx5_core]\nmlx5_eswitch_reload_reps+0x74/0xd0 [mlx5_core]\nmlx5_disable_lag+0x130/0x138 [mlx5_core]\nmlx5_lag_disable_change+0x6c/0x70 [mlx5_core] // hold ldev->lock\nmlx5_devlink_eswitch_mode_set+0xc0/0x410 [mlx5_core]\ndevlink_nl_cmd_eswitch_set_doit+0xdc/0x180\ngenl_family_rcv_msg_doit.isra.17+0xe8/0x138\ngenl_rcv_msg+0xe4/0x220\nnetlink_rcv_skb+0x44/0x108\ngenl_rcv+0x40/0x58\nnetlink_unicast+0x198/0x268\nnetlink_sendmsg+0x1d4/0x418\nsock_sendmsg+0x54/0x60\n__sys_sendto+0xf4/0x120\n__arm64_sys_sendto+0x30/0x40\nel0_svc_common+0x8c/0x120\ndo_el0_svc+0x30/0xa0\nel0_svc+0x20/0x30\nel0_sync_handler+0x90/0xb8\nel0_sync+0x160/0x180\n\nThus, upon lag enable/disable, load and unload only the IB representors\nof the slaves preventing the deadlock mentioned above.\n\nWhile at it, refactor the mlx5_esw_offloads_rep_load() function to have\na static helper method for its internal logic, in symmetry with the\nrepresentor unload design.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-667" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-06-19T14:15:15Z" diff --git a/advisories/unreviewed/2024/08/GHSA-5q4q-m5m5-mr8p/GHSA-5q4q-m5m5-mr8p.json b/advisories/unreviewed/2024/08/GHSA-5q4q-m5m5-mr8p/GHSA-5q4q-m5m5-mr8p.json index a30876fe598..979dea91a08 100644 --- a/advisories/unreviewed/2024/08/GHSA-5q4q-m5m5-mr8p/GHSA-5q4q-m5m5-mr8p.json +++ b/advisories/unreviewed/2024/08/GHSA-5q4q-m5m5-mr8p/GHSA-5q4q-m5m5-mr8p.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5q4q-m5m5-mr8p", - "modified": "2024-08-21T09:31:31Z", + "modified": "2024-08-29T03:30:49Z", "published": "2024-08-21T09:31:31Z", "aliases": [ "CVE-2022-48888" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Fix memory leak in msm_mdss_parse_data_bus_icc_path\n\nof_icc_get() alloc resources for path1, we should release it when not\nneed anymore. Early return when IS_ERR_OR_NULL(path0) may leak path1.\nDefer getting path1 to fix this.\n\nPatchwork: https://patchwork.freedesktop.org/patch/514264/", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-401" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T07:15:05Z" diff --git a/advisories/unreviewed/2024/08/GHSA-5v94-m7ff-m26p/GHSA-5v94-m7ff-m26p.json b/advisories/unreviewed/2024/08/GHSA-5v94-m7ff-m26p/GHSA-5v94-m7ff-m26p.json index 0a0c5af5c65..b512bb238b5 100644 --- a/advisories/unreviewed/2024/08/GHSA-5v94-m7ff-m26p/GHSA-5v94-m7ff-m26p.json +++ b/advisories/unreviewed/2024/08/GHSA-5v94-m7ff-m26p/GHSA-5v94-m7ff-m26p.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5v94-m7ff-m26p", - "modified": "2024-08-21T09:31:31Z", + "modified": "2024-08-29T03:30:48Z", "published": "2024-08-21T09:31:31Z", "aliases": [ "CVE-2022-48874" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Fix use-after-free and race in fastrpc_map_find\n\nCurrently, there is a race window between the point when the mutex is\nunlocked in fastrpc_map_lookup and the reference count increasing\n(fastrpc_map_get) in fastrpc_map_find, which can also lead to\nuse-after-free.\n\nSo lets merge fastrpc_map_find into fastrpc_map_lookup which allows us\nto both protect the maps list by also taking the &fl->lock spinlock and\nthe reference count, since the spinlock will be released only after.\nAdd take_ref argument to make this suitable for all callers.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T07:15:04Z" diff --git a/advisories/unreviewed/2024/08/GHSA-7358-gfxq-387j/GHSA-7358-gfxq-387j.json b/advisories/unreviewed/2024/08/GHSA-7358-gfxq-387j/GHSA-7358-gfxq-387j.json new file mode 100644 index 00000000000..046a3777325 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-7358-gfxq-387j/GHSA-7358-gfxq-387j.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7358-gfxq-387j", + "modified": "2024-08-29T03:30:49Z", + "published": "2024-08-29T03:30:49Z", + "aliases": [ + "CVE-2024-45435" + ], + "details": "Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45435" + }, + { + "type": "WEB", + "url": "https://github.com/chartist-js/chartist/issues/1427" + }, + { + "type": "WEB", + "url": "https://gist.github.com/tariqhawis/c67177164d3b7975210caddb25b60d62" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-29T03:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-846m-99qv-67mg/GHSA-846m-99qv-67mg.json b/advisories/unreviewed/2024/08/GHSA-846m-99qv-67mg/GHSA-846m-99qv-67mg.json new file mode 100644 index 00000000000..8d112df448e --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-846m-99qv-67mg/GHSA-846m-99qv-67mg.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-846m-99qv-67mg", + "modified": "2024-08-29T03:30:49Z", + "published": "2024-08-29T03:30:49Z", + "aliases": [ + "CVE-2024-45436" + ], + "details": "extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45436" + }, + { + "type": "WEB", + "url": "https://github.com/ollama/ollama/pull/5314" + }, + { + "type": "WEB", + "url": "https://github.com/ollama/ollama/compare/v0.1.46...v0.1.47" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-29T03:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-8rqg-fx6m-3c97/GHSA-8rqg-fx6m-3c97.json b/advisories/unreviewed/2024/08/GHSA-8rqg-fx6m-3c97/GHSA-8rqg-fx6m-3c97.json index cce51b8adb6..eeaacc2803c 100644 --- a/advisories/unreviewed/2024/08/GHSA-8rqg-fx6m-3c97/GHSA-8rqg-fx6m-3c97.json +++ b/advisories/unreviewed/2024/08/GHSA-8rqg-fx6m-3c97/GHSA-8rqg-fx6m-3c97.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8rqg-fx6m-3c97", - "modified": "2024-08-21T09:31:31Z", + "modified": "2024-08-29T03:30:49Z", "published": "2024-08-21T09:31:31Z", "aliases": [ "CVE-2022-48881" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd: Fix refcount leak in amd_pmc_probe\n\npci_get_domain_bus_and_slot() takes reference, the caller should release\nthe reference by calling pci_dev_put() after use. Call pci_dev_put() in\nthe error path to fix this.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T07:15:04Z" diff --git a/advisories/unreviewed/2024/08/GHSA-967p-q58c-5vc2/GHSA-967p-q58c-5vc2.json b/advisories/unreviewed/2024/08/GHSA-967p-q58c-5vc2/GHSA-967p-q58c-5vc2.json new file mode 100644 index 00000000000..ed89e874037 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-967p-q58c-5vc2/GHSA-967p-q58c-5vc2.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-967p-q58c-5vc2", + "modified": "2024-08-29T03:30:49Z", + "published": "2024-08-29T03:30:49Z", + "aliases": [ + "CVE-2024-7857" + ], + "details": "The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_sort_type' AJAX action in all versions up to, and including, 8.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7857" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/media-library-plus/tags/8.2.2/media-library-plus.php#L1766" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/media-library-plus/tags/8.2.2/media-library-plus.php#L3339" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3139954/media-library-plus/trunk/media-library-plus.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2266254-9281-4859-8630-f7bb5c0ead19?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-29T03:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-hm85-hr96-4gwf/GHSA-hm85-hr96-4gwf.json b/advisories/unreviewed/2024/08/GHSA-hm85-hr96-4gwf/GHSA-hm85-hr96-4gwf.json index c8d73305441..94ab2336db5 100644 --- a/advisories/unreviewed/2024/08/GHSA-hm85-hr96-4gwf/GHSA-hm85-hr96-4gwf.json +++ b/advisories/unreviewed/2024/08/GHSA-hm85-hr96-4gwf/GHSA-hm85-hr96-4gwf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hm85-hr96-4gwf", - "modified": "2024-08-21T09:31:32Z", + "modified": "2024-08-29T03:30:49Z", "published": "2024-08-21T09:31:32Z", "aliases": [ "CVE-2022-48892" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Fix use-after-free bug in dup_user_cpus_ptr()\n\nSince commit 07ec77a1d4e8 (\"sched: Allow task CPU affinity to be\nrestricted on asymmetric systems\"), the setting and clearing of\nuser_cpus_ptr are done under pi_lock for arm64 architecture. However,\ndup_user_cpus_ptr() accesses user_cpus_ptr without any lock\nprotection. Since sched_setaffinity() can be invoked from another\nprocess, the process being modified may be undergoing fork() at\nthe same time. When racing with the clearing of user_cpus_ptr in\n__set_cpus_allowed_ptr_locked(), it can lead to user-after-free and\npossibly double-free in arm64 kernel.\n\nCommit 8f9ea86fdf99 (\"sched: Always preserve the user requested\ncpumask\") fixes this problem as user_cpus_ptr, once set, will never\nbe cleared in a task's lifetime. However, this bug was re-introduced\nin commit 851a723e45d1 (\"sched: Always clear user_cpus_ptr in\ndo_set_cpus_allowed()\") which allows the clearing of user_cpus_ptr in\ndo_set_cpus_allowed(). This time, it will affect all arches.\n\nFix this bug by always clearing the user_cpus_ptr of the newly\ncloned/forked task before the copying process starts and check the\nuser_cpus_ptr state of the source task under pi_lock.\n\nNote to stable, this patch won't be applicable to stable releases.\nJust copy the new dup_user_cpus_ptr() function over.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-415" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T07:15:05Z" diff --git a/advisories/unreviewed/2024/08/GHSA-j6hw-jr7w-8c5m/GHSA-j6hw-jr7w-8c5m.json b/advisories/unreviewed/2024/08/GHSA-j6hw-jr7w-8c5m/GHSA-j6hw-jr7w-8c5m.json index 963955769f7..4b77387395e 100644 --- a/advisories/unreviewed/2024/08/GHSA-j6hw-jr7w-8c5m/GHSA-j6hw-jr7w-8c5m.json +++ b/advisories/unreviewed/2024/08/GHSA-j6hw-jr7w-8c5m/GHSA-j6hw-jr7w-8c5m.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-j6hw-jr7w-8c5m", - "modified": "2024-08-21T09:31:31Z", + "modified": "2024-08-29T03:30:48Z", "published": "2024-08-21T09:31:31Z", "aliases": [ "CVE-2022-48876" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix initialization of rx->link and rx->link_sta\n\nThere are some codepaths that do not initialize rx->link_sta properly. This\ncauses a crash in places which assume that rx->link_sta is valid if rx->sta\nis valid.\nOne known instance is triggered by __ieee80211_rx_h_amsdu being called from\nfast-rx. It results in a crash like this one:\n\n BUG: kernel NULL pointer dereference, address: 00000000000000a8\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page PGD 0 P4D 0\n Oops: 0002 [#1] PREEMPT SMP PTI\n CPU: 1 PID: 506 Comm: mt76-usb-rx phy Tainted: G E 6.1.0-debian64x+1.7 #3\n Hardware name: ZOTAC ZBOX-ID92/ZBOX-IQ01/ZBOX-ID92/ZBOX-IQ01, BIOS B220P007 05/21/2014\n RIP: 0010:ieee80211_deliver_skb+0x62/0x1f0 [mac80211]\n Code: 00 48 89 04 24 e8 9e a7 c3 df 89 c0 48 03 1c c5 a0 ea 39 a1 4c 01 6b 08 48 ff 03 48\n 83 7d 28 00 74 11 48 8b 45 30 48 63 55 44 <48> 83 84 d0 a8 00 00 00 01 41 8b 86 c0\n 11 00 00 8d 50 fd 83 fa 01\n RSP: 0018:ffff999040803b10 EFLAGS: 00010286\n RAX: 0000000000000000 RBX: ffffb9903f496480 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffff999040803ce0 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d21828ac900\n R13: 000000000000004a R14: ffff8d2198ed89c0 R15: ffff8d2198ed8000\n FS: 0000000000000000(0000) GS:ffff8d24afe80000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000000000a8 CR3: 0000000429810002 CR4: 00000000001706e0\n Call Trace:\n \n __ieee80211_rx_h_amsdu+0x1b5/0x240 [mac80211]\n ? ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211]\n ? __local_bh_enable_ip+0x3b/0xa0\n ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211]\n ? prepare_transfer+0x109/0x1a0 [xhci_hcd]\n ieee80211_rx_list+0xa80/0xda0 [mac80211]\n mt76_rx_complete+0x207/0x2e0 [mt76]\n mt76_rx_poll_complete+0x357/0x5a0 [mt76]\n mt76u_rx_worker+0x4f5/0x600 [mt76_usb]\n ? mt76_get_min_avg_rssi+0x140/0x140 [mt76]\n __mt76_worker_fn+0x50/0x80 [mt76]\n kthread+0xed/0x120\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30\n\nSince the initialization of rx->link and rx->link_sta is rather convoluted\nand duplicated in many places, clean it up by using a helper function to\nset it.\n\n[remove unnecessary rx->sta->sta.mlo check]", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T07:15:04Z" diff --git a/advisories/unreviewed/2024/08/GHSA-jfp9-mpfm-8qc7/GHSA-jfp9-mpfm-8qc7.json b/advisories/unreviewed/2024/08/GHSA-jfp9-mpfm-8qc7/GHSA-jfp9-mpfm-8qc7.json new file mode 100644 index 00000000000..15bcd7c7630 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-jfp9-mpfm-8qc7/GHSA-jfp9-mpfm-8qc7.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jfp9-mpfm-8qc7", + "modified": "2024-08-29T03:30:49Z", + "published": "2024-08-29T03:30:49Z", + "aliases": [ + "CVE-2024-41918" + ], + "details": "'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS 11.7.0 and earlier are vulnerable to improper authorization in handler for custom URL scheme. An arbitrary site may be displayed on the WebView of the product via Intent from another application installed on the user's device. As a result, the user may be redirected to an unauthorized site, and the user may become a victim of a phishing attack.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41918" + }, + { + "type": "WEB", + "url": "https://apps.apple.com/jp/app/%E6%A5%BD%E5%A4%A9%E5%B8%82%E5%A0%B4-%E3%81%8A%E8%B2%B7%E3%81%84%E7%89%A9%E3%81%A7%E6%A5%BD%E5%A4%A9%E3%83%9D%E3%82%A4%E3%83%B3%E3%83%88%E3%81%8C%E8%B2%AF%E3%81%BE%E3%82%8B%E4%BE%BF%E5%88%A9%E3%81%AA%E9%80%9A%E8%B2%A9%E3%82%A2%E3%83%97%E3%83%AA/id419267350" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN56648919" + }, + { + "type": "WEB", + "url": "https://play.google.com/store/apps/details?id=jp.co.rakuten.android&hl=en" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-29T03:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-p9p6-vvr2-mf86/GHSA-p9p6-vvr2-mf86.json b/advisories/unreviewed/2024/08/GHSA-p9p6-vvr2-mf86/GHSA-p9p6-vvr2-mf86.json index 830f8ed6884..79c6e896825 100644 --- a/advisories/unreviewed/2024/08/GHSA-p9p6-vvr2-mf86/GHSA-p9p6-vvr2-mf86.json +++ b/advisories/unreviewed/2024/08/GHSA-p9p6-vvr2-mf86/GHSA-p9p6-vvr2-mf86.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p9p6-vvr2-mf86", - "modified": "2024-08-21T09:31:31Z", + "modified": "2024-08-29T03:30:49Z", "published": "2024-08-21T09:31:31Z", "aliases": [ "CVE-2022-48879" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: fix NULL-deref in init error path\n\nIn cases where runtime services are not supported or have been disabled,\nthe runtime services workqueue will never have been allocated.\n\nDo not try to destroy the workqueue unconditionally in the unlikely\nevent that EFI initialisation fails to avoid dereferencing a NULL\npointer.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -45,9 +48,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T07:15:04Z" diff --git a/advisories/unreviewed/2024/08/GHSA-pxx8-p2cf-4q57/GHSA-pxx8-p2cf-4q57.json b/advisories/unreviewed/2024/08/GHSA-pxx8-p2cf-4q57/GHSA-pxx8-p2cf-4q57.json index e3a75649d9c..fb101b38161 100644 --- a/advisories/unreviewed/2024/08/GHSA-pxx8-p2cf-4q57/GHSA-pxx8-p2cf-4q57.json +++ b/advisories/unreviewed/2024/08/GHSA-pxx8-p2cf-4q57/GHSA-pxx8-p2cf-4q57.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-pxx8-p2cf-4q57", - "modified": "2024-08-21T09:31:31Z", + "modified": "2024-08-29T03:30:49Z", "published": "2024-08-21T09:31:31Z", "aliases": [ "CVE-2022-48882" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix macsec possible null dereference when updating MAC security entity (SecY)\n\nUpon updating MAC security entity (SecY) in hw offload path, the macsec\nsecurity association (SA) initialization routine is called. In case of\nextended packet number (epn) is enabled the salt and ssci attributes are\nretrieved using the MACsec driver rx_sa context which is unavailable when\nupdating a SecY property such as encoding-sa hence the null dereference.\nFix by using the provided SA to set those attributes.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T07:15:04Z" diff --git a/advisories/unreviewed/2024/08/GHSA-wcc4-c252-rxxr/GHSA-wcc4-c252-rxxr.json b/advisories/unreviewed/2024/08/GHSA-wcc4-c252-rxxr/GHSA-wcc4-c252-rxxr.json index 57d57426461..9b83e7758a9 100644 --- a/advisories/unreviewed/2024/08/GHSA-wcc4-c252-rxxr/GHSA-wcc4-c252-rxxr.json +++ b/advisories/unreviewed/2024/08/GHSA-wcc4-c252-rxxr/GHSA-wcc4-c252-rxxr.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wcc4-c252-rxxr", - "modified": "2024-08-21T09:31:31Z", + "modified": "2024-08-29T03:30:49Z", "published": "2024-08-21T09:31:31Z", "aliases": [ "CVE-2022-48878" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_qca: Fix driver shutdown on closed serdev\n\nThe driver shutdown callback (which sends EDL_SOC_RESET to the device\nover serdev) should not be invoked when HCI device is not open (e.g. if\nhci_dev_open_sync() failed), because the serdev and its TTY are not open\neither. Also skip this step if device is powered off\n(qca_power_shutdown()).\n\nThe shutdown callback causes use-after-free during system reboot with\nQualcomm Atheros Bluetooth:\n\n Unable to handle kernel paging request at virtual address\n 0072662f67726fd7\n ...\n CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G W\n 6.1.0-rt5-00325-g8a5f56bcfcca #8\n Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)\n Call trace:\n tty_driver_flush_buffer+0x4/0x30\n serdev_device_write_flush+0x24/0x34\n qca_serdev_shutdown+0x80/0x130 [hci_uart]\n device_shutdown+0x15c/0x260\n kernel_restart+0x48/0xac\n\nKASAN report:\n\n BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50\n Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1\n\n CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted\n 6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28\n Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)\n Call trace:\n dump_backtrace.part.0+0xdc/0xf0\n show_stack+0x18/0x30\n dump_stack_lvl+0x68/0x84\n print_report+0x188/0x488\n kasan_report+0xa4/0xf0\n __asan_load8+0x80/0xac\n tty_driver_flush_buffer+0x1c/0x50\n ttyport_write_flush+0x34/0x44\n serdev_device_write_flush+0x48/0x60\n qca_serdev_shutdown+0x124/0x274\n device_shutdown+0x1e8/0x350\n kernel_restart+0x48/0xb0\n __do_sys_reboot+0x244/0x2d0\n __arm64_sys_reboot+0x54/0x70\n invoke_syscall+0x60/0x190\n el0_svc_common.constprop.0+0x7c/0x160\n do_el0_svc+0x44/0xf0\n el0_svc+0x2c/0x6c\n el0t_64_sync_handler+0xbc/0x140\n el0t_64_sync+0x190/0x194", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T07:15:04Z"