netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-12-24 18:32:31 +00:00
parent 6d826d8eba
commit d50cec5c51
31 changed files with 309 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/06/GHSA-89fh-5c8q-jj65/GHSA-89fh-5c8q-jj65.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-404"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/05/GHSA-2qgr-37h8-x3w9/GHSA-2qgr-37h8-x3w9.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2qgr-37h8-x3w9",
"modified": "2024-05-21T15:31:41Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:41Z",
"aliases": [
"CVE-2021-47260"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a potential NULL dereference in nfs_get_client()\n\nNone of the callers are expecting NULL returns from nfs_get_client() so\nthis code will lead to an Oops. It's better to return an error\npointer. I expect that this is dead code so hopefully no one is\naffected.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -48,8 +53,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:14Z"
advisories/unreviewed/2024/05/GHSA-3qvj-8qwq-5jxj/GHSA-3qvj-8qwq-5jxj.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3qvj-8qwq-5jxj",
"modified": "2024-05-21T15:31:43Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:43Z",
"aliases": [
"CVE-2021-47330"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: 8250: serial_cs: Fix a memory leak in error handling path\n\nIn the probe function, if the final 'serial_config()' fails, 'info' is\nleaking.\n\nAdd a resource handling path to free this memory.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -52,8 +57,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-401"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:19Z"
advisories/unreviewed/2024/05/GHSA-4xq8-m4f5-h82h/GHSA-4xq8-m4f5-h82h.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4xq8-m4f5-h82h",
"modified": "2024-05-21T15:31:41Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:41Z",
"aliases": [
"CVE-2021-47270"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: fix various gadgets null ptr deref on 10gbps cabling.\n\nThis avoids a null pointer dereference in\nf_{ecm,eem,hid,loopback,printer,rndis,serial,sourcesink,subset,tcm}\nby simply reusing the 5gbps config for 10gbps.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -44,8 +49,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:15Z"
advisories/unreviewed/2024/05/GHSA-5vvx-6299-h82w/GHSA-5vvx-6299-h82w.json
+11 -4
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/05/GHSA-836m-cmjj-qv5g/GHSA-836m-cmjj-qv5g.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-836m-cmjj-qv5g",
"modified": "2024-05-21T15:31:43Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:43Z",
"aliases": [
"CVE-2021-47331"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: common: usb-conn-gpio: fix NULL pointer dereference of charger\n\nWhen power on system with OTG cable, IDDIG's interrupt arises before\nthe charger registration, it will cause a NULL pointer dereference,\nfix the issue by registering the power supply before requesting\nIDDIG/VBUS irq.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -32,8 +37,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:20Z"
advisories/unreviewed/2024/05/GHSA-9rr2-xw5v-w787/GHSA-9rr2-xw5v-w787.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9rr2-xw5v-w787",
"modified": "2024-05-21T15:31:44Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:44Z",
"aliases": [
"CVE-2021-47359"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix soft lockup during fsstress\n\nBelow traces are observed during fsstress and system got hung.\n[ 130.698396] watchdog: BUG: soft lockup - CPU#6 stuck for 26s!",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-667"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:22Z"
advisories/unreviewed/2024/05/GHSA-fj34-p4r2-ghh5/GHSA-fj34-p4r2-ghh5.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fj34-p4r2-ghh5",
"modified": "2024-05-21T15:31:41Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:41Z",
"aliases": [
"CVE-2021-47281"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix race of snd_seq_timer_open()\n\nThe timer instance per queue is exclusive, and snd_seq_timer_open()\nshould have managed the concurrent accesses. It looks as if it's\nchecking the already existing timer instance at the beginning, but\nit's not right, because there is no protection, hence any later\nconcurrent call of snd_seq_timer_open() may override the timer\ninstance easily. This may result in UAF, as the leftover timer\ninstance can keep running while the queue itself gets closed, as\nspotted by syzkaller recently.\n\nFor avoiding the race, add a proper check at the assignment of\ntmr->timeri again, and return -EBUSY if it's been already registered.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-416"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:16Z"
advisories/unreviewed/2024/05/GHSA-g2fc-vv42-p4pc/GHSA-g2fc-vv42-p4pc.json
+11 -4
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/05/GHSA-hm5p-668j-x4q6/GHSA-hm5p-668j-x4q6.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hm5p-668j-x4q6",
"modified": "2024-05-21T15:31:43Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:43Z",
"aliases": [
"CVE-2021-47344"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: zr364xx: fix memory leak in zr364xx_start_readpipe\n\nsyzbot reported memory leak in zr364xx driver.\nThe problem was in non-freed urb in case of\nusb_submit_urb() fail.\n\nbacktrace:\n [<ffffffff82baedf6>] kmalloc include/linux/slab.h:561 [inline]\n [<ffffffff82baedf6>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74\n [<ffffffff82f7cce8>] zr364xx_start_readpipe+0x78/0x130 drivers/media/usb/zr364xx/zr364xx.c:1022\n [<ffffffff84251dfc>] zr364xx_board_init drivers/media/usb/zr364xx/zr364xx.c:1383 [inline]\n [<ffffffff84251dfc>] zr364xx_probe+0x6a3/0x851 drivers/media/usb/zr364xx/zr364xx.c:1516\n [<ffffffff82bb6507>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n [<ffffffff826018a9>] really_probe+0x159/0x500 drivers/base/dd.c:576",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -52,8 +57,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-401"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:21Z"
advisories/unreviewed/2024/05/GHSA-m2r9-3c4r-qv68/GHSA-m2r9-3c4r-qv68.json
+11 -4
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/05/GHSA-pmrx-2gv3-hv52/GHSA-pmrx-2gv3-hv52.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pmrx-2gv3-hv52",
"modified": "2024-05-21T15:31:43Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:43Z",
"aliases": [
"CVE-2021-47332"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: Don't call free_pages_exact() with NULL address\n\nUnlike some other functions, we can't pass NULL pointer to\nfree_pages_exact(). Add a proper NULL check for avoiding possible\nOops.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -36,8 +41,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:20Z"
advisories/unreviewed/2024/05/GHSA-pv65-xqrg-hc85/GHSA-pv65-xqrg-hc85.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pv65-xqrg-hc85",
"modified": "2024-05-21T15:31:43Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:43Z",
"aliases": [
"CVE-2021-47345"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix rdma_resolve_route() memory leak\n\nFix a memory leak when \"mda_resolve_route() is called more than once on\nthe same \"rdma_cm_id\".\n\nThis is possible if cma_query_handler() triggers the\nRDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and\nallows rdma_resolve_route() to be called again.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -52,8 +57,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-401"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:21Z"
advisories/unreviewed/2024/05/GHSA-pwqm-5jrg-2v3g/GHSA-pwqm-5jrg-2v3g.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pwqm-5jrg-2v3g",
"modified": "2024-05-21T15:31:42Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:42Z",
"aliases": [
"CVE-2021-47320"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: fix acl memory leak of posix_acl_create()\n\nWhen looking into another nfs xfstests report, I found acl and\ndefault_acl in nfs3_proc_create() and nfs3_proc_mknod() error\npaths are possibly leaked. Fix them in advance.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -52,8 +57,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-401"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:19Z"
advisories/unreviewed/2024/05/GHSA-qp63-w47q-g9vj/GHSA-qp63-w47q-g9vj.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qp63-w47q-g9vj",
"modified": "2024-05-21T15:31:41Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:41Z",
"aliases": [
"CVE-2021-47269"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: ep0: fix NULL pointer exception\n\nThere is no validation of the index from dwc3_wIndex_to_dep() and we might\nbe referring a non-existing ep and trigger a NULL pointer exception. In\ncertain configurations we might use fewer eps and the index might wrongly\nindicate a larger ep index than existing.\n\nBy adding this validation from the patch we can actually report a wrong\nindex back to the caller.\n\nIn our usecase we are using a composite device on an older kernel, but\nupstream might use this fix also. Unfortunately, I cannot describe the\nhardware for others to reproduce the issue as it is a proprietary\nimplementation.\n\n[ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4\n[ 82.966891] Mem abort info:\n[ 82.969663] ESR = 0x96000006\n[ 82.972703] Exception class = DABT (current EL), IL = 32 bits\n[ 82.978603] SET = 0, FnV = 0\n[ 82.981642] EA = 0, S1PTW = 0\n[ 82.984765] Data abort info:\n[ 82.987631] ISV = 0, ISS = 0x00000006\n[ 82.991449] CM = 0, WnR = 0\n[ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc\n[ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000\n[ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP\n[ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)\n[ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1\n[ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)\n[ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c\n[ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94\n\n...\n\n[ 83.141788] Call trace:\n[ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c\n[ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94\n[ 83.181546] ---[ end trace aac6b5267d84c32f ]---",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -48,8 +53,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:15Z"
advisories/unreviewed/2024/05/GHSA-qxvg-qh99-hg66/GHSA-qxvg-qh99-hg66.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qxvg-qh99-hg66",
"modified": "2024-05-21T15:31:41Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:41Z",
"aliases": [
"CVE-2021-47264"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: core: Fix Null-point-dereference in fmt_single_name()\n\nCheck the return value of devm_kstrdup() in case of\nNull-point-dereference.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:15Z"
advisories/unreviewed/2024/05/GHSA-rcjv-j3v6-r6cv/GHSA-rcjv-j3v6-r6cv.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rcjv-j3v6-r6cv",
"modified": "2024-05-21T15:31:41Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:41Z",
"aliases": [
"CVE-2021-47280"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix use-after-free read in drm_getunique()\n\nThere is a time-of-check-to-time-of-use error in drm_getunique() due\nto retrieving file_priv->master prior to locking the device's master\nmutex.\n\nAn example can be seen in the crash report of the use-after-free error\nfound by Syzbot:\nhttps://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803\n\nIn the report, the master pointer was used after being freed. This is\nbecause another process had acquired the device's master mutex in\ndrm_setmaster_ioctl(), then overwrote fpriv->master in\ndrm_new_set_master(). The old value of fpriv->master was subsequently\nfreed before the mutex was unlocked.\n\nTo fix this, we lock the device's master mutex before retrieving the\npointer from from fpriv->master. This patch passes the Syzbot\nreproducer test.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -40,8 +45,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-367"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:16Z"
advisories/unreviewed/2024/05/GHSA-v5r4-g8jp-rvxf/GHSA-v5r4-g8jp-rvxf.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v5r4-g8jp-rvxf",
"modified": "2024-05-21T15:31:43Z",
"modified": "2024-12-24T18:30:49Z",
"published": "2024-05-21T15:31:43Z",
"aliases": [
"CVE-2021-47353"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix NULL pointer dereference in udf_symlink function\n\nIn function udf_symlink, epos.bh is assigned with the value returned\nby udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c\nand returns the value of sb_getblk function that could be NULL.\nThen, epos.bh is used without any check, causing a possible\nNULL pointer dereference when sb_getblk fails.\n\nThis fix adds a check to validate the value of epos.bh.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -52,8 +57,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:21Z"
advisories/unreviewed/2024/05/GHSA-v8p3-mfrc-9v8j/GHSA-v8p3-mfrc-9v8j.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v8p3-mfrc-9v8j",
"modified": "2024-05-21T15:31:45Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:44Z",
"aliases": [
"CVE-2021-47397"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb\n\nWe should always check if skb_header_pointer's return is NULL before\nusing it, otherwise it may cause null-ptr-deref, as syzbot reported:\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline]\n RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196\n Call Trace:\n <IRQ>\n sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109\n ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422\n ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463\n NF_HOOK include/linux/netfilter.h:307 [inline]\n NF_HOOK include/linux/netfilter.h:301 [inline]\n ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472\n dst_input include/net/dst.h:460 [inline]\n ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]\n NF_HOOK include/linux/netfilter.h:307 [inline]\n NF_HOOK include/linux/netfilter.h:301 [inline]\n ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -40,8 +45,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:25Z"
advisories/unreviewed/2024/05/GHSA-w883-jj58-rv96/GHSA-w883-jj58-rv96.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w883-jj58-rv96",
"modified": "2024-05-21T15:31:45Z",
"modified": "2024-12-24T18:30:48Z",
"published": "2024-05-21T15:31:44Z",
"aliases": [
"CVE-2021-47404"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: betop: fix slab-out-of-bounds Write in betop_probe\n\nSyzbot reported slab-out-of-bounds Write bug in hid-betopff driver.\nThe problem is the driver assumes the device must have an input report but\nsome malicious devices violate this assumption.\n\nSo this patch checks hid_device's input is non empty before it's been used.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -48,8 +53,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-787"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:25Z"

Some files were not shown because too many files have changed in this diff Show More