Action not permitted
Modal body text goes here.
wid-sec-w-2024-1905
Vulnerability from csaf_certbund
Published
2024-08-21 22:00
Modified
2024-09-05 22:00
Summary
IBM QRadar SIEM: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
IBM QRadar Security Information and Event Management (SIEM) bietet Unterstützung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.
Angriff
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, eine Man-in-the-Middle-Situation zu schaffen, Sicherheitsmaßnahmen zu umgehen oder eine Denial-of-Service-Situation zu schaffen.
Betroffene Betriebssysteme
- Linux
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM QRadar Security Information and Event Management (SIEM) bietet Unterst\u00fctzung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, eine Man-in-the-Middle-Situation zu schaffen, Sicherheitsma\u00dfnahmen zu umgehen oder eine Denial-of-Service-Situation zu schaffen.", "title": "Angriff" }, { "category": "general", "text": "- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-1905 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1905.json" }, { "category": "self", "summary": "WID-SEC-2024-1905 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1905" }, { "category": "external", "summary": "IBM Security Bulletin 7166204 vom 2024-08-21", "url": "https://www.ibm.com/support/pages/node/7166204" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12606 vom 2024-09-03", "url": "https://linux.oracle.com/errata/ELSA-2024-12606.html" }, { "category": "external", "summary": "ORACLE OVMSA-2024-0011 vom 2024-09-04", "url": "https://oss.oracle.com/pipermail/oraclevm-errata/2024-September/001099.html" }, { "category": "external", "summary": "IBM Security Bulletin 7167662 vom 2024-09-05", "url": "https://www.ibm.com/support/pages/node/7167662" } ], "source_lang": "en-US", "title": "IBM QRadar SIEM: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-09-05T22:00:00.000+00:00", "generator": { "date": "2024-09-06T08:13:42.015+00:00", "engine": { "name": "BSI-WID", "version": "1.3.6" } }, "id": "WID-SEC-W-2024-1905", "initial_release_date": "2024-08-21T22:00:00.000+00:00", "revision_history": [ { "date": "2024-08-21T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-09-02T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-09-04T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von ORACLE aufgenommen" }, { "date": "2024-09-05T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "4" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "24.0.0", "product": { "name": "IBM Business Automation Workflow 24.0.0", "product_id": "T036570", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:24.0.0" } } } ], "category": "product_name", "name": "Business Automation Workflow" }, { "branches": [ { "category": "product_version_range", "name": "\u003c7.5.0 UP9 IF02", "product": { "name": "IBM QRadar SIEM \u003c7.5.0 UP9 IF02", "product_id": "T037023" } }, { "category": "product_version", "name": "7.5.0 UP9 IF02", "product": { "name": "IBM QRadar SIEM 7.5.0 UP9 IF02", "product_id": "T037023-fixed", "product_identification_helper": { "cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up9_if02" } } } ], "category": "product_name", "name": "QRadar SIEM" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-26555", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2020-26555" }, { "cve": "CVE-2021-46909", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-46909" }, { "cve": "CVE-2021-46972", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-46972" }, { "cve": "CVE-2021-47069", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-47069" }, { "cve": "CVE-2021-47073", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-47073" }, { "cve": "CVE-2021-47236", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-47236" }, { "cve": "CVE-2021-47310", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-47310" }, { "cve": "CVE-2021-47311", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-47311" }, { "cve": "CVE-2021-47353", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-47353" }, { "cve": "CVE-2021-47356", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-47356" }, { "cve": "CVE-2021-47456", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-47456" }, { "cve": "CVE-2021-47495", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2021-47495" }, { "cve": "CVE-2023-43788", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-43788" }, { "cve": "CVE-2023-43789", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-43789" }, { "cve": "CVE-2023-4692", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-4692" }, { "cve": "CVE-2023-4693", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-4693" }, { "cve": "CVE-2023-5090", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-5090" }, { "cve": "CVE-2023-52464", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52464" }, { "cve": "CVE-2023-52560", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52560" }, { "cve": "CVE-2023-52615", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52615" }, { "cve": "CVE-2023-52626", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52626" }, { "cve": "CVE-2023-52667", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52667" }, { "cve": "CVE-2023-52669", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52669" }, { "cve": "CVE-2023-52675", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52675" }, { "cve": "CVE-2023-52686", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52686" }, { "cve": "CVE-2023-52700", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52700" }, { "cve": "CVE-2023-52703", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52703" }, { "cve": "CVE-2023-52781", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52781" }, { "cve": "CVE-2023-52813", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52813" }, { "cve": "CVE-2023-52835", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52835" }, { "cve": "CVE-2023-52877", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52877" }, { "cve": "CVE-2023-52878", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52878" }, { "cve": "CVE-2023-52881", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-52881" }, { "cve": "CVE-2023-7008", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2023-7008" }, { "cve": "CVE-2024-1048", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-1048" }, { "cve": "CVE-2024-22365", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-22365" }, { "cve": "CVE-2024-26583", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26583" }, { "cve": "CVE-2024-26584", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26584" }, { "cve": "CVE-2024-26585", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26585" }, { "cve": "CVE-2024-26656", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26656" }, { "cve": "CVE-2024-26675", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26675" }, { "cve": "CVE-2024-26735", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26735" }, { "cve": "CVE-2024-26759", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26759" }, { "cve": "CVE-2024-26801", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26801" }, { "cve": "CVE-2024-26804", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26804" }, { "cve": "CVE-2024-26826", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26826" }, { "cve": "CVE-2024-26859", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26859" }, { "cve": "CVE-2024-26906", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26906" }, { "cve": "CVE-2024-26907", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26907" }, { "cve": "CVE-2024-26974", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26974" }, { "cve": "CVE-2024-26982", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-26982" }, { "cve": "CVE-2024-27397", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-27397" }, { "cve": "CVE-2024-27410", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-27410" }, { "cve": "CVE-2024-34750", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-34750" }, { "cve": "CVE-2024-35789", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35789" }, { "cve": "CVE-2024-35835", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35835" }, { "cve": "CVE-2024-35838", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35838" }, { "cve": "CVE-2024-35845", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35845" }, { "cve": "CVE-2024-35852", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35852" }, { "cve": "CVE-2024-35853", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35853" }, { "cve": "CVE-2024-35854", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35854" }, { "cve": "CVE-2024-35855", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35855" }, { "cve": "CVE-2024-35888", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35888" }, { "cve": "CVE-2024-35890", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35890" }, { "cve": "CVE-2024-35958", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35958" }, { "cve": "CVE-2024-35959", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35959" }, { "cve": "CVE-2024-35960", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-35960" }, { "cve": "CVE-2024-36004", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-36004" }, { "cve": "CVE-2024-36007", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-36007" }, { "cve": "CVE-2024-5564", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in IBM QRadar SIEM. Diese Fehler bestehen in mehreren Komponenten wie systemd, Grub oder dem Linux-Kernel, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-Schwachstelle, einer unsachgem\u00e4\u00dfen Pr\u00fcfung der Grenzen oder eines Puffer\u00fcberlaufs und mehr. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Man-in-the-Middle-Zustand zu erzeugen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden." } ], "product_status": { "known_affected": [ "T036570", "T004914", "T037023" ] }, "release_date": "2024-08-21T22:00:00.000+00:00", "title": "CVE-2024-5564" } ] }
cve-2021-47311
Vulnerability from cvelistv5
Published
2024-05-21 14:35
Modified
2024-11-04 12:03
Severity ?
EPSS score ?
Summary
net: qcom/emac: fix UAF in emac_remove
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T05:32:08.445Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4d04a42b926e682140776e54188f4a44f1f01a81" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b1e091331920f8fbfc747dcbd16263fcd71abb2d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/11e9d163d631198bb3eb41a677a61b499516c0f7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2b70ca92847c619d6264c7372ef74fcbfd1e048c" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b560521eca03d0a2db6093a5a632cbdd0a0cf833" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8a225a6e07a57a1538d53637cb3d82bd3e477839" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ad297cd2db8953e2202970e9504cab247b6c7cb4" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2021-47311", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-08-19T18:50:38.591727Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-19T18:50:45.314Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/qualcomm/emac/emac.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "4d04a42b926e", "status": "affected", "version": "54e19bc74f33", "versionType": "git" }, { "lessThan": "b1e091331920", "status": "affected", "version": "54e19bc74f33", "versionType": "git" }, { "lessThan": "11e9d163d631", "status": "affected", "version": "54e19bc74f33", "versionType": "git" }, { "lessThan": "2b70ca92847c", "status": "affected", "version": "54e19bc74f33", "versionType": "git" }, { "lessThan": "b560521eca03", "status": "affected", "version": "54e19bc74f33", "versionType": "git" }, { "lessThan": "8a225a6e07a5", "status": "affected", "version": "54e19bc74f33", "versionType": "git" }, { "lessThan": "ad297cd2db89", "status": "affected", "version": "54e19bc74f33", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/qualcomm/emac/emac.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.9" }, { "lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.277", "versionType": "semver" }, { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.241", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.199", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.135", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.53", "versionType": "semver" }, { "lessThanOrEqual": "5.13.*", "status": "unaffected", "version": "5.13.5", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.14", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qcom/emac: fix UAF in emac_remove\n\nadpt is netdev private data and it cannot be\nused after free_netdev() call. Using adpt after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction." } ], "providerMetadata": { "dateUpdated": "2024-11-04T12:03:28.722Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/4d04a42b926e682140776e54188f4a44f1f01a81" }, { "url": "https://git.kernel.org/stable/c/b1e091331920f8fbfc747dcbd16263fcd71abb2d" }, { "url": "https://git.kernel.org/stable/c/11e9d163d631198bb3eb41a677a61b499516c0f7" }, { "url": "https://git.kernel.org/stable/c/2b70ca92847c619d6264c7372ef74fcbfd1e048c" }, { "url": "https://git.kernel.org/stable/c/b560521eca03d0a2db6093a5a632cbdd0a0cf833" }, { "url": "https://git.kernel.org/stable/c/8a225a6e07a57a1538d53637cb3d82bd3e477839" }, { "url": "https://git.kernel.org/stable/c/ad297cd2db8953e2202970e9504cab247b6c7cb4" } ], "title": "net: qcom/emac: fix UAF in emac_remove", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-47311", "datePublished": "2024-05-21T14:35:29.304Z", "dateReserved": "2024-05-21T14:28:16.973Z", "dateUpdated": "2024-11-04T12:03:28.722Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52781
Vulnerability from cvelistv5
Published
2024-05-21 15:31
Modified
2024-11-04 14:52
Severity ?
EPSS score ?
Summary
usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-52781", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-21T17:27:41.275139Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:22:33.254Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T23:11:35.495Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/9ef94ec8e52eaf7b9abc5b5f8f5b911751112223" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/64c27b7b2357ddb38b6afebaf46d5bff4d250702" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/f89fef7710b2ba0f7a1e46594e530dcf2f77be91" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7c0244cc311a4038505b73682b7c8ceaa5c7a8c8" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/974bba5c118f4c2baf00de0356e3e4f7928b4cbc" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/usb/core/config.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "9ef94ec8e52e", "status": "affected", "version": "3dd550a2d365", "versionType": "git" }, { "lessThan": "64c27b7b2357", "status": "affected", "version": "3dd550a2d365", "versionType": "git" }, { "lessThan": "f89fef7710b2", "status": "affected", "version": "3dd550a2d365", "versionType": "git" }, { "lessThan": "7c0244cc311a", "status": "affected", "version": "3dd550a2d365", "versionType": "git" }, { "lessThan": "974bba5c118f", "status": "affected", "version": "3dd550a2d365", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/usb/core/config.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.4" }, { "lessThan": "5.4", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.203", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.142", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.66", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.4", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.7", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: config: fix iteration issue in \u0027usb_get_bos_descriptor()\u0027\n\nThe BOS descriptor defines a root descriptor and is the base descriptor for\naccessing a family of related descriptors.\n\nFunction \u0027usb_get_bos_descriptor()\u0027 encounters an iteration issue when\nskipping the \u0027USB_DT_DEVICE_CAPABILITY\u0027 descriptor type. This results in\nthe same descriptor being read repeatedly.\n\nTo address this issue, a \u0027goto\u0027 statement is introduced to ensure that the\npointer and the amount read is updated correctly. This ensures that the\nfunction iterates to the next descriptor instead of reading the same\ndescriptor repeatedly." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:52:36.483Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/9ef94ec8e52eaf7b9abc5b5f8f5b911751112223" }, { "url": "https://git.kernel.org/stable/c/64c27b7b2357ddb38b6afebaf46d5bff4d250702" }, { "url": "https://git.kernel.org/stable/c/f89fef7710b2ba0f7a1e46594e530dcf2f77be91" }, { "url": "https://git.kernel.org/stable/c/7c0244cc311a4038505b73682b7c8ceaa5c7a8c8" }, { "url": "https://git.kernel.org/stable/c/974bba5c118f4c2baf00de0356e3e4f7928b4cbc" } ], "title": "usb: config: fix iteration issue in \u0027usb_get_bos_descriptor()\u0027", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52781", "datePublished": "2024-05-21T15:31:00.242Z", "dateReserved": "2024-05-21T15:19:24.240Z", "dateUpdated": "2024-11-04T14:52:36.483Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26826
Vulnerability from cvelistv5
Published
2024-04-17 09:43
Modified
2024-11-05 09:16
Severity ?
EPSS score ?
Summary
mptcp: fix data re-injection from stale subflow
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T00:14:13.531Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6f95120f898b40d13fd441225ef511307853c9c2" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6673d9f1c2cd984390550dbdf7d5ae07b20abbf8" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b609c783c535493aa3fca22c7e40a120370b1ca5" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/624902eab7abcb8731b333ec73f206d38d839cd8" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b6c620dc43ccb4e802894e54b651cf81495e9598" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-26826", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:49:00.883183Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-11T17:33:30.420Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/mptcp/protocol.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "6f95120f898b", "status": "affected", "version": "1e1d9d6f119c", "versionType": "git" }, { "lessThan": "6673d9f1c2cd", "status": "affected", "version": "1e1d9d6f119c", "versionType": "git" }, { "lessThan": "b609c783c535", "status": "affected", "version": "1e1d9d6f119c", "versionType": "git" }, { "lessThan": "624902eab7ab", "status": "affected", "version": "1e1d9d6f119c", "versionType": "git" }, { "lessThan": "b6c620dc43cc", "status": "affected", "version": "1e1d9d6f119c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/mptcp/protocol.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.15" }, { "lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.79", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.18", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.6", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix data re-injection from stale subflow\n\nWhen the MPTCP PM detects that a subflow is stale, all the packet\nscheduler must re-inject all the mptcp-level unacked data. To avoid\nacquiring unneeded locks, it first try to check if any unacked data\nis present at all in the RTX queue, but such check is currently\nbroken, as it uses TCP-specific helper on an MPTCP socket.\n\nFunnily enough fuzzers and static checkers are happy, as the accessed\nmemory still belongs to the mptcp_sock struct, and even from a\nfunctional perspective the recovery completed successfully, as\nthe short-cut test always failed.\n\nA recent unrelated TCP change - commit d5fed5addb2b (\"tcp: reorganize\ntcp_sock fast path variables\") - exposed the issue, as the tcp field\nreorganization makes the mptcp code always skip the re-inection.\n\nFix the issue dropping the bogus call: we are on a slow path, the early\noptimization proved once again to be evil." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:16:30.547Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/6f95120f898b40d13fd441225ef511307853c9c2" }, { "url": "https://git.kernel.org/stable/c/6673d9f1c2cd984390550dbdf7d5ae07b20abbf8" }, { "url": "https://git.kernel.org/stable/c/b609c783c535493aa3fca22c7e40a120370b1ca5" }, { "url": "https://git.kernel.org/stable/c/624902eab7abcb8731b333ec73f206d38d839cd8" }, { "url": "https://git.kernel.org/stable/c/b6c620dc43ccb4e802894e54b651cf81495e9598" } ], "title": "mptcp: fix data re-injection from stale subflow", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26826", "datePublished": "2024-04-17T09:43:51.741Z", "dateReserved": "2024-02-19T14:20:24.181Z", "dateUpdated": "2024-11-05T09:16:30.547Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26735
Vulnerability from cvelistv5
Published
2024-04-03 17:00
Modified
2024-11-05 09:14
Severity ?
EPSS score ?
Summary
ipv6: sr: fix possible use-after-free and null-ptr-deref
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-26735", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-16T14:17:44.078376Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-31T13:57:56.491Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-11-01T17:03:12.597Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/953f42934533c151f440cd32390044d2396b87aa" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/82831e3ff76ef09fb184eb93b79a3eb3fb284f1d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/65c38f23d10ff79feea1e5d50b76dc7af383c1e6" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/91b020aaa1e59bfb669d34c968e3db3d5416bcee" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8391b9b651cfdf80ab0f1dc4a489f9d67386e197" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/9e02973dbc6a91e40aa4f5d87b8c47446fbfce44" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/02b08db594e8218cfbc0e4680d4331b457968a9b" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5559cea2d5aa3018a5f00dd2aca3427ba09b386b" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" }, { "url": "https://security.netapp.com/advisory/ntap-20241101-0012/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/ipv6/seg6.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "953f42934533", "status": "affected", "version": "915d7e5e5930", "versionType": "git" }, { "lessThan": "82831e3ff76e", "status": "affected", "version": "915d7e5e5930", "versionType": "git" }, { "lessThan": "65c38f23d10f", "status": "affected", "version": "915d7e5e5930", "versionType": "git" }, { "lessThan": "91b020aaa1e5", "status": "affected", "version": "915d7e5e5930", "versionType": "git" }, { "lessThan": "8391b9b651cf", "status": "affected", "version": "915d7e5e5930", "versionType": "git" }, { "lessThan": "9e02973dbc6a", "status": "affected", "version": "915d7e5e5930", "versionType": "git" }, { "lessThan": "02b08db594e8", "status": "affected", "version": "915d7e5e5930", "versionType": "git" }, { "lessThan": "5559cea2d5aa", "status": "affected", "version": "915d7e5e5930", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/ipv6/seg6.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.10" }, { "lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.308", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.270", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.211", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.150", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.80", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.19", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix possible use-after-free and null-ptr-deref\n\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:14:46.717Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/953f42934533c151f440cd32390044d2396b87aa" }, { "url": "https://git.kernel.org/stable/c/82831e3ff76ef09fb184eb93b79a3eb3fb284f1d" }, { "url": "https://git.kernel.org/stable/c/65c38f23d10ff79feea1e5d50b76dc7af383c1e6" }, { "url": "https://git.kernel.org/stable/c/91b020aaa1e59bfb669d34c968e3db3d5416bcee" }, { "url": "https://git.kernel.org/stable/c/8391b9b651cfdf80ab0f1dc4a489f9d67386e197" }, { "url": "https://git.kernel.org/stable/c/9e02973dbc6a91e40aa4f5d87b8c47446fbfce44" }, { "url": "https://git.kernel.org/stable/c/02b08db594e8218cfbc0e4680d4331b457968a9b" }, { "url": "https://git.kernel.org/stable/c/5559cea2d5aa3018a5f00dd2aca3427ba09b386b" } ], "title": "ipv6: sr: fix possible use-after-free and null-ptr-deref", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26735", "datePublished": "2024-04-03T17:00:21.972Z", "dateReserved": "2024-02-19T14:20:24.165Z", "dateUpdated": "2024-11-05T09:14:46.717Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-27410
Vulnerability from cvelistv5
Published
2024-05-17 11:50
Modified
2024-11-05 09:21
Severity ?
EPSS score ?
Summary
wifi: nl80211: reject iftype change with mesh ID change
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-27410", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-17T17:39:36.191312Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-17T17:43:50.161Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:34:52.357Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/d38d31bbbb9dc0d4d71a45431eafba03d0bc150d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0cfbb26ee5e7b3d6483a73883f9f6157bca22ec9" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/99eb2159680af8786104dac80528acd5acd45980" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/063715c33b4c37587aeca2c83cf08ead0c542995" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/930e826962d9f01dcd2220176134427358d112f2" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/177d574be4b58f832354ab1ef5a297aa0c9aa2df" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a2add961a5ed25cfd6a74f9ffb9e7ab6d6ded838" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/f78c1375339a291cba492a70eaf12ec501d28a8e" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/wireless/nl80211.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "d38d31bbbb9d", "status": "affected", "version": "7b0a0e3c3a88", "versionType": "git" }, { "lessThan": "0cfbb26ee5e7", "status": "affected", "version": "7b0a0e3c3a88", "versionType": "git" }, { "lessThan": "99eb2159680a", "status": "affected", "version": "7b0a0e3c3a88", "versionType": "git" }, { "lessThan": "063715c33b4c", "status": "affected", "version": "7b0a0e3c3a88", "versionType": "git" }, { "lessThan": "930e826962d9", "status": "affected", "version": "7b0a0e3c3a88", "versionType": "git" }, { "lessThan": "177d574be4b5", "status": "affected", "version": "7b0a0e3c3a88", "versionType": "git" }, { "lessThan": "a2add961a5ed", "status": "affected", "version": "7b0a0e3c3a88", "versionType": "git" }, { "lessThan": "f78c1375339a", "status": "affected", "version": "7b0a0e3c3a88", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/wireless/nl80211.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.0" }, { "lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.309", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.271", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.212", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.151", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.81", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.21", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.9", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject iftype change with mesh ID change\n\nIt\u0027s currently possible to change the mesh ID when the\ninterface isn\u0027t yet in mesh mode, at the same time as\nchanging it into mesh mode. This leads to an overwrite\nof data in the wdev-\u003eu union for the interface type it\ncurrently has, causing cfg80211_change_iface() to do\nwrong things when switching.\n\nWe could probably allow setting an interface to mesh\nwhile setting the mesh ID at the same time by doing a\ndifferent order of operations here, but realistically\nthere\u0027s no userspace that\u0027s going to do this, so just\ndisallow changes in iftype when setting mesh ID." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:21:42.623Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/d38d31bbbb9dc0d4d71a45431eafba03d0bc150d" }, { "url": "https://git.kernel.org/stable/c/0cfbb26ee5e7b3d6483a73883f9f6157bca22ec9" }, { "url": "https://git.kernel.org/stable/c/99eb2159680af8786104dac80528acd5acd45980" }, { "url": "https://git.kernel.org/stable/c/063715c33b4c37587aeca2c83cf08ead0c542995" }, { "url": "https://git.kernel.org/stable/c/930e826962d9f01dcd2220176134427358d112f2" }, { "url": "https://git.kernel.org/stable/c/177d574be4b58f832354ab1ef5a297aa0c9aa2df" }, { "url": "https://git.kernel.org/stable/c/a2add961a5ed25cfd6a74f9ffb9e7ab6d6ded838" }, { "url": "https://git.kernel.org/stable/c/f78c1375339a291cba492a70eaf12ec501d28a8e" } ], "title": "wifi: nl80211: reject iftype change with mesh ID change", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-27410", "datePublished": "2024-05-17T11:50:43.212Z", "dateReserved": "2024-02-25T13:47:42.682Z", "dateUpdated": "2024-11-05T09:21:42.623Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35853
Vulnerability from cvelistv5
Published
2024-05-17 14:47
Modified
2024-11-05 09:23
Severity ?
EPSS score ?
Summary
mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
References
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "affected", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "c6f3fa7f5a74", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "617e98ba4c50", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "413a01886c39", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "b822644fd909", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "0ae8ff7b6d42", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "b3fd51f684a0", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "8ca3f7a7b613", "status": "affected", "version": "843500518509", "versionType": "git" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-35853", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-20T17:34:35.252109Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-01T13:51:48.800Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:48.394Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c6f3fa7f5a748bf6e5c4eb742686d6952f854e76" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/617e98ba4c50f4547c9eb0946b1cfc26937d70d1" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc8856c76" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b3fd51f684a0711504f82de510da109ae639722d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8ca3f7a7b61393804c46f170743c3b839df13977" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c6f3fa7f5a74", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "617e98ba4c50", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "413a01886c39", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "b822644fd909", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "0ae8ff7b6d42", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "b3fd51f684a0", "status": "affected", "version": "843500518509", "versionType": "git" }, { "lessThan": "8ca3f7a7b613", "status": "affected", "version": "843500518509", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.1" }, { "lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.275", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.216", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.158", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.90", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.30", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.9", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix memory leak during rehash\n\nThe rehash delayed work migrates filters from one region to another.\nThis is done by iterating over all chunks (all the filters with the same\npriority) in the region and in each chunk iterating over all the\nfilters.\n\nIf the migration fails, the code tries to migrate the filters back to\nthe old region. However, the rollback itself can also fail in which case\nanother migration will be erroneously performed. Besides the fact that\nthis ping pong is not a very good idea, it also creates a problem.\n\nEach virtual chunk references two chunks: The currently used one\n(\u0027vchunk-\u003echunk\u0027) and a backup (\u0027vchunk-\u003echunk2\u0027). During migration the\nfirst holds the chunk we want to migrate filters to and the second holds\nthe chunk we are migrating filters from.\n\nThe code currently assumes - but does not verify - that the backup chunk\ndoes not exist (NULL) if the currently used chunk does not reference the\ntarget region. This assumption breaks when we are trying to rollback a\nrollback, resulting in the backup chunk being overwritten and leaked\n[1].\n\nFix by not rolling back a failed rollback and add a warning to avoid\nfuture cases.\n\n[1]\nWARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20\nModules linked in:\nCPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:parman_destroy+0x17/0x20\n[...]\nCall Trace:\n \u003cTASK\u003e\n mlxsw_sp_acl_atcam_region_fini+0x19/0x60\n mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:23:45.764Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c6f3fa7f5a748bf6e5c4eb742686d6952f854e76" }, { "url": "https://git.kernel.org/stable/c/617e98ba4c50f4547c9eb0946b1cfc26937d70d1" }, { "url": "https://git.kernel.org/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e" }, { "url": "https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc8856c76" }, { "url": "https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf" }, { "url": "https://git.kernel.org/stable/c/b3fd51f684a0711504f82de510da109ae639722d" }, { "url": "https://git.kernel.org/stable/c/8ca3f7a7b61393804c46f170743c3b839df13977" } ], "title": "mlxsw: spectrum_acl_tcam: Fix memory leak during rehash", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35853", "datePublished": "2024-05-17T14:47:30.109Z", "dateReserved": "2024-05-17T13:50:33.106Z", "dateUpdated": "2024-11-05T09:23:45.764Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52877
Vulnerability from cvelistv5
Published
2024-05-21 15:32
Modified
2024-11-04 14:54
Severity ?
EPSS score ?
Summary
usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-52877", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-10T19:16:07.522837Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-10T19:16:15.611Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T23:11:36.091Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e5f53a68a596e04df3fde3099273435a30b6fdac" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e7a802447c491903aa7cb45967aa2a934a4e63fc" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/9ee038590d808a95d16adf92818dcd4752273c08" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b37a168c0137156042a0ca9626651b5a789e822b" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4987daf86c152ff882d51572d154ad12e4ff3a4b" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/usb/typec/tcpm/tcpm.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "e5f53a68a596", "status": "affected", "version": "5e1d4c49fbc8", "versionType": "git" }, { "lessThan": "e7a802447c49", "status": "affected", "version": "5e1d4c49fbc8", "versionType": "git" }, { "lessThan": "9ee038590d80", "status": "affected", "version": "5e1d4c49fbc8", "versionType": "git" }, { "lessThan": "b37a168c0137", "status": "affected", "version": "5e1d4c49fbc8", "versionType": "git" }, { "lessThan": "4987daf86c15", "status": "affected", "version": "5e1d4c49fbc8", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/usb/typec/tcpm/tcpm.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.12" }, { "lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.138", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.62", "versionType": "semver" }, { "lessThanOrEqual": "6.5.*", "status": "unaffected", "version": "6.5.11", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.1", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.7", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()\n\nIt is possible that typec_register_partner() returns ERR_PTR on failure.\nWhen port-\u003epartner is an error, a NULL pointer dereference may occur as\nshown below.\n\n[91222.095236][ T319] typec port0: failed to register partner (-17)\n...\n[91225.061491][ T319] Unable to handle kernel NULL pointer dereference\nat virtual address 000000000000039f\n[91225.274642][ T319] pc : tcpm_pd_data_request+0x310/0x13fc\n[91225.274646][ T319] lr : tcpm_pd_data_request+0x298/0x13fc\n[91225.308067][ T319] Call trace:\n[91225.308070][ T319] tcpm_pd_data_request+0x310/0x13fc\n[91225.308073][ T319] tcpm_pd_rx_handler+0x100/0x9e8\n[91225.355900][ T319] kthread_worker_fn+0x178/0x58c\n[91225.355902][ T319] kthread+0x150/0x200\n[91225.355905][ T319] ret_from_fork+0x10/0x30\n\nAdd a check for port-\u003epartner to avoid dereferencing a NULL pointer." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:54:24.817Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/e5f53a68a596e04df3fde3099273435a30b6fdac" }, { "url": "https://git.kernel.org/stable/c/e7a802447c491903aa7cb45967aa2a934a4e63fc" }, { "url": "https://git.kernel.org/stable/c/9ee038590d808a95d16adf92818dcd4752273c08" }, { "url": "https://git.kernel.org/stable/c/b37a168c0137156042a0ca9626651b5a789e822b" }, { "url": "https://git.kernel.org/stable/c/4987daf86c152ff882d51572d154ad12e4ff3a4b" } ], "title": "usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52877", "datePublished": "2024-05-21T15:32:09.946Z", "dateReserved": "2024-05-21T15:19:24.264Z", "dateUpdated": "2024-11-04T14:54:24.817Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26656
Vulnerability from cvelistv5
Published
2024-04-02 06:08
Modified
2024-11-05 09:13
Severity ?
EPSS score ?
Summary
drm/amdgpu: fix use-after-free bug
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-26656", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-04-02T14:54:50.822759Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-05T17:21:23.249Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:07:19.867Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "e87e08c94c95", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "af054a5fb24a", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "22f665ecfd12", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "22207fd5c801", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.24", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.12", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix use-after-free bug\n\nThe bug can be triggered by sending a single amdgpu_gem_userptr_ioctl\nto the AMDGPU DRM driver on any ASICs with an invalid address and size.\nThe bug was reported by Joonkyo Jung \u003cjoonkyoj@yonsei.ac.kr\u003e.\nFor example the following code:\n\nstatic void Syzkaller1(int fd)\n{\n\tstruct drm_amdgpu_gem_userptr arg;\n\tint ret;\n\n\targ.addr = 0xffffffffffff0000;\n\targ.size = 0x80000000; /*2 Gb*/\n\targ.flags = 0x7;\n\tret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, \u0026arg);\n}\n\nDue to the address and size are not valid there is a failure in\namdgpu_hmm_register-\u003emmu_interval_notifier_insert-\u003e__mmu_interval_notifier_insert-\u003e\ncheck_shl_overflow, but we even the amdgpu_hmm_register failure we still call\namdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address.\nThe following stack is below when the issue is reproduced when Kazan is enabled:\n\n[ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\n[ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340\n[ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff \u003c0f\u003e 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80\n[ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246\n[ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b\n[ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260\n[ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25\n[ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00\n[ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260\n[ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000\n[ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0\n[ +0.000010] Call Trace:\n[ +0.000006] \u003cTASK\u003e\n[ +0.000007] ? show_regs+0x6a/0x80\n[ +0.000018] ? __warn+0xa5/0x1b0\n[ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340\n[ +0.000018] ? report_bug+0x24a/0x290\n[ +0.000022] ? handle_bug+0x46/0x90\n[ +0.000015] ? exc_invalid_op+0x19/0x50\n[ +0.000016] ? asm_exc_invalid_op+0x1b/0x20\n[ +0.000017] ? kasan_save_stack+0x26/0x50\n[ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340\n[ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340\n[ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340\n[ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10\n[ +0.000017] ? kasan_save_alloc_info+0x1e/0x30\n[ +0.000018] ? srso_return_thunk+0x5/0x5f\n[ +0.000014] ? __kasan_kmalloc+0xb1/0xc0\n[ +0.000018] ? srso_return_thunk+0x5/0x5f\n[ +0.000013] ? __kasan_check_read+0x11/0x20\n[ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu]\n[ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu]\n[ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu]\n[ +0.004291] ? do_syscall_64+0x5f/0xe0\n[ +0.000023] ? srso_return_thunk+0x5/0x5f\n[ +0.000017] drm_gem_object_free+0x3b/0x50 [drm]\n[ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu]\n[ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[ +0.004270] ? srso_return_thunk+0x5/0x5f\n[ +0.000014] ? __this_cpu_preempt_check+0x13/0x20\n[ +0.000015] ? srso_return_thunk+0x5/0x5f\n[ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0\n[ +0.000020] ? srso_return_thunk+0x5/0x5f\n[ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20\n[ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm]\n[ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm]\n[ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm]\n[ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d\n---truncated---" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:13:19.284Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605" }, { "url": "https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c" }, { "url": "https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c" }, { "url": "https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e" } ], "title": "drm/amdgpu: fix use-after-free bug", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26656", "datePublished": "2024-04-02T06:08:43.558Z", "dateReserved": "2024-02-19T14:20:24.145Z", "dateUpdated": "2024-11-05T09:13:19.284Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-47236
Vulnerability from cvelistv5
Published
2024-05-21 14:19
Modified
2024-11-04 12:02
Severity ?
EPSS score ?
Summary
net: cdc_eem: fix tx fixup skb leak
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2021-47236", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-17T17:38:01.951930Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-17T17:39:57.883Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T05:32:07.941Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/f12554b0ff639e74612cc01b3b4a049e098d2d65" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/14184ec5c958b589ba934da7363a2877879204df" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1bcacd6088d61c0ac6a990d87975600a81f3247e" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/f4e6a7f19c82f39b1803e91c54718f0d7143767d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/81de2ed06df8b5451e050fe6a318af3263dbff3f" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/05b2b9f7d24b5663d9b47427fe1555bdafd3ea02" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b4f7a9fc9d094c0c4a66f2ad7c37b1dbe9e78f88" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c3b26fdf1b32f91c7a3bc743384b4a298ab53ad7" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/usb/cdc_eem.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "f12554b0ff63", "status": "affected", "version": "9f722c0978b0", "versionType": "git" }, { "lessThan": "14184ec5c958", "status": "affected", "version": "9f722c0978b0", "versionType": "git" }, { "lessThan": "1bcacd6088d6", "status": "affected", "version": "9f722c0978b0", "versionType": "git" }, { "lessThan": "f4e6a7f19c82", "status": "affected", "version": "9f722c0978b0", "versionType": "git" }, { "lessThan": "81de2ed06df8", "status": "affected", "version": "9f722c0978b0", "versionType": "git" }, { "lessThan": "05b2b9f7d24b", "status": "affected", "version": "9f722c0978b0", "versionType": "git" }, { "lessThan": "b4f7a9fc9d09", "status": "affected", "version": "9f722c0978b0", "versionType": "git" }, { "lessThan": "c3b26fdf1b32", "status": "affected", "version": "9f722c0978b0", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/usb/cdc_eem.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.30" }, { "lessThan": "2.6.30", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.4.*", "status": "unaffected", "version": "4.4.274", "versionType": "semver" }, { "lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.274", "versionType": "semver" }, { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.238", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.196", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.128", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.46", "versionType": "semver" }, { "lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.13", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cdc_eem: fix tx fixup skb leak\n\nwhen usbnet transmit a skb, eem fixup it in eem_tx_fixup(),\nif skb_copy_expand() failed, it return NULL,\nusbnet_start_xmit() will have no chance to free original skb.\n\nfix it by free orginal skb in eem_tx_fixup() first,\nthen check skb clone status, if failed, return NULL to usbnet." } ], "providerMetadata": { "dateUpdated": "2024-11-04T12:02:03.125Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/f12554b0ff639e74612cc01b3b4a049e098d2d65" }, { "url": "https://git.kernel.org/stable/c/14184ec5c958b589ba934da7363a2877879204df" }, { "url": "https://git.kernel.org/stable/c/1bcacd6088d61c0ac6a990d87975600a81f3247e" }, { "url": "https://git.kernel.org/stable/c/f4e6a7f19c82f39b1803e91c54718f0d7143767d" }, { "url": "https://git.kernel.org/stable/c/81de2ed06df8b5451e050fe6a318af3263dbff3f" }, { "url": "https://git.kernel.org/stable/c/05b2b9f7d24b5663d9b47427fe1555bdafd3ea02" }, { "url": "https://git.kernel.org/stable/c/b4f7a9fc9d094c0c4a66f2ad7c37b1dbe9e78f88" }, { "url": "https://git.kernel.org/stable/c/c3b26fdf1b32f91c7a3bc743384b4a298ab53ad7" } ], "title": "net: cdc_eem: fix tx fixup skb leak", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-47236", "datePublished": "2024-05-21T14:19:37.724Z", "dateReserved": "2024-04-10T18:59:19.531Z", "dateUpdated": "2024-11-04T12:02:03.125Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52813
Vulnerability from cvelistv5
Published
2024-05-21 15:31
Modified
2024-11-04 14:53
Severity ?
EPSS score ?
Summary
crypto: pcrypt - Fix hungtask for PADATA_RESET
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-52813", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-23T17:18:51.048604Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:24:13.216Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T23:11:36.058Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/fb2d3a50a8f29a3c66682bb426144f40e32ab818" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/039fec48e062504f14845124a1a25eb199b2ddc0" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c9c1334697301c10e6918d747ed38abfbc0c96e7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e97bf4ada7dddacd184c3e196bd063b0dc71b41d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/546c1796ad1ed0d87dab3c4b5156d75819be2316" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c55fc098fd9d2dca475b82d00ffbcaf97879d77e" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e134f3aba98e6c801a693f540912c2d493718ddf" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/372636debe852913529b1716f44addd94fff2d28" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8f4f68e788c3a7a696546291258bfa5fdb215523" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "crypto/pcrypt.c", "kernel/padata.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "fb2d3a50a8f2", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "039fec48e062", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "c9c133469730", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "e97bf4ada7dd", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "546c1796ad1e", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "c55fc098fd9d", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "e134f3aba98e", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "372636debe85", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "8f4f68e788c3", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "crypto/pcrypt.c", "kernel/padata.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.331", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.300", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.262", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.202", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.140", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.64", "versionType": "semver" }, { "lessThanOrEqual": "6.5.*", "status": "unaffected", "version": "6.5.13", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.7", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Fix hungtask for PADATA_RESET\n\nWe found a hungtask bug in test_aead_vec_cfg as follows:\n\nINFO: task cryptomgr_test:391009 blocked for more than 120 seconds.\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\nCall trace:\n __switch_to+0x98/0xe0\n __schedule+0x6c4/0xf40\n schedule+0xd8/0x1b4\n schedule_timeout+0x474/0x560\n wait_for_common+0x368/0x4e0\n wait_for_completion+0x20/0x30\n wait_for_completion+0x20/0x30\n test_aead_vec_cfg+0xab4/0xd50\n test_aead+0x144/0x1f0\n alg_test_aead+0xd8/0x1e0\n alg_test+0x634/0x890\n cryptomgr_test+0x40/0x70\n kthread+0x1e0/0x220\n ret_from_fork+0x10/0x18\n Kernel panic - not syncing: hung_task: blocked tasks\n\nFor padata_do_parallel, when the return err is 0 or -EBUSY, it will call\nwait_for_completion(\u0026wait-\u003ecompletion) in test_aead_vec_cfg. In normal\ncase, aead_request_complete() will be called in pcrypt_aead_serial and the\nreturn err is 0 for padata_do_parallel. But, when pinst-\u003eflags is\nPADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it\nwon\u0027t call aead_request_complete(). Therefore, test_aead_vec_cfg will\nhung at wait_for_completion(\u0026wait-\u003ecompletion), which will cause\nhungtask.\n\nThe problem comes as following:\n(padata_do_parallel) |\n rcu_read_lock_bh(); |\n err = -EINVAL; | (padata_replace)\n | pinst-\u003eflags |= PADATA_RESET;\n err = -EBUSY |\n if (pinst-\u003eflags \u0026 PADATA_RESET) |\n rcu_read_unlock_bh() |\n return err\n\nIn order to resolve the problem, we replace the return err -EBUSY with\n-EAGAIN, which means parallel_data is changing, and the caller should call\nit again.\n\nv3:\nremove retry and just change the return err.\nv2:\nintroduce padata_try_do_parallel() in pcrypt_aead_encrypt and\npcrypt_aead_decrypt to solve the hungtask." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:53:12.866Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/fb2d3a50a8f29a3c66682bb426144f40e32ab818" }, { "url": "https://git.kernel.org/stable/c/039fec48e062504f14845124a1a25eb199b2ddc0" }, { "url": "https://git.kernel.org/stable/c/c9c1334697301c10e6918d747ed38abfbc0c96e7" }, { "url": "https://git.kernel.org/stable/c/e97bf4ada7dddacd184c3e196bd063b0dc71b41d" }, { "url": "https://git.kernel.org/stable/c/546c1796ad1ed0d87dab3c4b5156d75819be2316" }, { "url": "https://git.kernel.org/stable/c/c55fc098fd9d2dca475b82d00ffbcaf97879d77e" }, { "url": "https://git.kernel.org/stable/c/e134f3aba98e6c801a693f540912c2d493718ddf" }, { "url": "https://git.kernel.org/stable/c/372636debe852913529b1716f44addd94fff2d28" }, { "url": "https://git.kernel.org/stable/c/8f4f68e788c3a7a696546291258bfa5fdb215523" } ], "title": "crypto: pcrypt - Fix hungtask for PADATA_RESET", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52813", "datePublished": "2024-05-21T15:31:21.604Z", "dateReserved": "2024-05-21T15:19:24.248Z", "dateUpdated": "2024-11-04T14:53:12.866Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35890
Vulnerability from cvelistv5
Published
2024-05-19 08:34
Modified
2024-11-05 09:24
Severity ?
EPSS score ?
Summary
gro: fix ownership transfer
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-35890", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-23T17:20:18.616682Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:33:50.532Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:48.729Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/d225b0ac96dc40d7e8ae2bc227eb2c56e130975f" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2eeab8c47c3c0276e0746bc382f405c9a236a5ad" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5b3b67f731296027cceb3efad881ae281213f86f" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ed4cccef64c1d0d5b91e69f7a8a6697c3a865486" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/core/gro.c", "net/ipv4/udp_offload.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "d225b0ac96dc", "status": "affected", "version": "5e10da5385d2", "versionType": "git" }, { "lessThan": "2eeab8c47c3c", "status": "affected", "version": "5e10da5385d2", "versionType": "git" }, { "lessThan": "fc126c1d51e9", "status": "affected", "version": "5e10da5385d2", "versionType": "git" }, { "lessThan": "5b3b67f73129", "status": "affected", "version": "5e10da5385d2", "versionType": "git" }, { "lessThan": "ed4cccef64c1", "status": "affected", "version": "5e10da5385d2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/core/gro.c", "net/ipv4/udp_offload.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.15" }, { "lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.154", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.85", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.26", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.5", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngro: fix ownership transfer\n\nIf packets are GROed with fraglist they might be segmented later on and\ncontinue their journey in the stack. In skb_segment_list those skbs can\nbe reused as-is. This is an issue as their destructor was removed in\nskb_gro_receive_list but not the reference to their socket, and then\nthey can\u0027t be orphaned. Fix this by also removing the reference to the\nsocket.\n\nFor example this could be observed,\n\n kernel BUG at include/linux/skbuff.h:3131! (skb_orphan)\n RIP: 0010:ip6_rcv_core+0x11bc/0x19a0\n Call Trace:\n ipv6_list_rcv+0x250/0x3f0\n __netif_receive_skb_list_core+0x49d/0x8f0\n netif_receive_skb_list_internal+0x634/0xd40\n napi_complete_done+0x1d2/0x7d0\n gro_cell_poll+0x118/0x1f0\n\nA similar construction is found in skb_gro_receive, apply the same\nchange there." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:24:31.984Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/d225b0ac96dc40d7e8ae2bc227eb2c56e130975f" }, { "url": "https://git.kernel.org/stable/c/2eeab8c47c3c0276e0746bc382f405c9a236a5ad" }, { "url": "https://git.kernel.org/stable/c/fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6" }, { "url": "https://git.kernel.org/stable/c/5b3b67f731296027cceb3efad881ae281213f86f" }, { "url": "https://git.kernel.org/stable/c/ed4cccef64c1d0d5b91e69f7a8a6697c3a865486" } ], "title": "gro: fix ownership transfer", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35890", "datePublished": "2024-05-19T08:34:46.085Z", "dateReserved": "2024-05-17T13:50:33.113Z", "dateUpdated": "2024-11-05T09:24:31.984Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52560
Vulnerability from cvelistv5
Published
2024-03-02 21:59
Modified
2024-11-04 14:48
Severity ?
EPSS score ?
Summary
mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-52560", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-03-04T15:35:56.845645Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:24:06.685Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T23:03:20.913Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/9a4fe81a8644b717d57d81ce5849e16583b13fe8" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6b522001693aa113d97a985abc5f6932972e8e86" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/45120b15743fa7c0aa53d5db6dfb4c8f87be4abd" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "mm/damon/vaddr-test.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "9a4fe81a8644", "status": "affected", "version": "9f86d624292c", "versionType": "git" }, { "lessThan": "6b522001693a", "status": "affected", "version": "9f86d624292c", "versionType": "git" }, { "lessThan": "45120b15743f", "status": "affected", "version": "9f86d624292c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "mm/damon/vaddr-test.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.16" }, { "lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.56", "versionType": "semver" }, { "lessThanOrEqual": "6.5.*", "status": "unaffected", "version": "6.5.6", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()\n\nWhen CONFIG_DAMON_VADDR_KUNIT_TEST=y and making CONFIG_DEBUG_KMEMLEAK=y\nand CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak is detected.\n\nSince commit 9f86d624292c (\"mm/damon/vaddr-test: remove unnecessary\nvariables\"), the damon_destroy_ctx() is removed, but still call\ndamon_new_target() and damon_new_region(), the damon_region which is\nallocated by kmem_cache_alloc() in damon_new_region() and the damon_target\nwhich is allocated by kmalloc in damon_new_target() are not freed. And\nthe damon_region which is allocated in damon_new_region() in\ndamon_set_regions() is also not freed.\n\nSo use damon_destroy_target to free all the damon_regions and damon_target.\n\n unreferenced object 0xffff888107c9a940 (size 64):\n comm \"kunit_try_catch\", pid 1069, jiffies 4294670592 (age 732.761s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk\n 60 c7 9c 07 81 88 ff ff f8 cb 9c 07 81 88 ff ff `...............\n backtrace:\n [\u003cffffffff817e0167\u003e] kmalloc_trace+0x27/0xa0\n [\u003cffffffff819c11cf\u003e] damon_new_target+0x3f/0x1b0\n [\u003cffffffff819c7d55\u003e] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0\n [\u003cffffffff819c82be\u003e] damon_test_apply_three_regions1+0x21e/0x260\n [\u003cffffffff829fce6a\u003e] kunit_generic_run_threadfn_adapter+0x4a/0x90\n [\u003cffffffff81237cf6\u003e] kthread+0x2b6/0x380\n [\u003cffffffff81097add\u003e] ret_from_fork+0x2d/0x70\n [\u003cffffffff81003791\u003e] ret_from_fork_asm+0x11/0x20\n unreferenced object 0xffff8881079cc740 (size 56):\n comm \"kunit_try_catch\", pid 1069, jiffies 4294670592 (age 732.761s)\n hex dump (first 32 bytes):\n 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................\n 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk\n backtrace:\n [\u003cffffffff819bc492\u003e] damon_new_region+0x22/0x1c0\n [\u003cffffffff819c7d91\u003e] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0\n [\u003cffffffff819c82be\u003e] damon_test_apply_three_regions1+0x21e/0x260\n [\u003cffffffff829fce6a\u003e] kunit_generic_run_threadfn_adapter+0x4a/0x90\n [\u003cffffffff81237cf6\u003e] kthread+0x2b6/0x380\n [\u003cffffffff81097add\u003e] ret_from_fork+0x2d/0x70\n [\u003cffffffff81003791\u003e] ret_from_fork_asm+0x11/0x20\n unreferenced object 0xffff888107c9ac40 (size 64):\n comm \"kunit_try_catch\", pid 1071, jiffies 4294670595 (age 732.843s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk\n a0 cc 9c 07 81 88 ff ff 78 a1 76 07 81 88 ff ff ........x.v.....\n backtrace:\n [\u003cffffffff817e0167\u003e] kmalloc_trace+0x27/0xa0\n [\u003cffffffff819c11cf\u003e] damon_new_target+0x3f/0x1b0\n [\u003cffffffff819c7d55\u003e] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0\n [\u003cffffffff819c851e\u003e] damon_test_apply_three_regions2+0x21e/0x260\n [\u003cffffffff829fce6a\u003e] kunit_generic_run_threadfn_adapter+0x4a/0x90\n [\u003cffffffff81237cf6\u003e] kthread+0x2b6/0x380\n [\u003cffffffff81097add\u003e] ret_from_fork+0x2d/0x70\n [\u003cffffffff81003791\u003e] ret_from_fork_asm+0x11/0x20\n unreferenced object 0xffff8881079ccc80 (size 56):\n comm \"kunit_try_catch\", pid 1071, jiffies 4294670595 (age 732.843s)\n hex dump (first 32 bytes):\n 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................\n 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk\n backtrace:\n [\u003cffffffff819bc492\u003e] damon_new_region+0x22/0x1c0\n [\u003cffffffff819c7d91\u003e] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0\n [\u003cffffffff819c851e\u003e] damon_test_apply_three_regions2+0x21e/0x260\n [\u003cffffffff829fce6a\u003e] kunit_generic_run_threadfn_adapter+0x4a/0x90\n [\u003cffffffff81237cf6\u003e] kthread+0x2b6/0x380\n [\u003cffffffff81097add\u003e] ret_from_fork+0x2d/0x70\n [\u003cffff\n---truncated---" } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:48:44.322Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/9a4fe81a8644b717d57d81ce5849e16583b13fe8" }, { "url": "https://git.kernel.org/stable/c/6b522001693aa113d97a985abc5f6932972e8e86" }, { "url": "https://git.kernel.org/stable/c/45120b15743fa7c0aa53d5db6dfb4c8f87be4abd" } ], "title": "mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52560", "datePublished": "2024-03-02T21:59:34.084Z", "dateReserved": "2024-03-02T21:55:42.566Z", "dateUpdated": "2024-11-04T14:48:44.322Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52615
Vulnerability from cvelistv5
Published
2024-03-18 10:14
Modified
2024-11-04 14:49
Severity ?
EPSS score ?
Summary
hwrng: core - Fix page fault dead lock on mmap-ed hwrng
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T23:03:21.329Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/eafd83b92f6c044007a3591cbd476bcf90455990" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5030d4c798863ccb266563201b341a099e8cdd48" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c6a8111aacbfe7a8a70f46cc0de8eed00561693c" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/26cc6d7006f922df6cc4389248032d955750b2a0" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/aa8aa16ed9adf1df05bb339d588cf485a011839e" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ecabe8cd456d3bf81e92c53b074732f3140f170d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6822a14271786150e178869f1495cc03e74c5029" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/78aafb3884f6bc6636efcc1760c891c8500b9922" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-52615", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:55:19.515526Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-11T17:33:21.562Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/char/hw_random/core.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "eafd83b92f6c", "status": "affected", "version": "9996508b3353", "versionType": "git" }, { "lessThan": "5030d4c79886", "status": "affected", "version": "9996508b3353", "versionType": "git" }, { "lessThan": "c6a8111aacbf", "status": "affected", "version": "9996508b3353", "versionType": "git" }, { "lessThan": "26cc6d7006f9", "status": "affected", "version": "9996508b3353", "versionType": "git" }, { "lessThan": "aa8aa16ed9ad", "status": "affected", "version": "9996508b3353", "versionType": "git" }, { "lessThan": "ecabe8cd456d", "status": "affected", "version": "9996508b3353", "versionType": "git" }, { "lessThan": "6822a1427178", "status": "affected", "version": "9996508b3353", "versionType": "git" }, { "lessThan": "78aafb3884f6", "status": "affected", "version": "9996508b3353", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/char/hw_random/core.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.33" }, { "lessThan": "2.6.33", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.307", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.269", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.210", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.76", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.15", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: core - Fix page fault dead lock on mmap-ed hwrng\n\nThere is a dead-lock in the hwrng device read path. This triggers\nwhen the user reads from /dev/hwrng into memory also mmap-ed from\n/dev/hwrng. The resulting page fault triggers a recursive read\nwhich then dead-locks.\n\nFix this by using a stack buffer when calling copy_to_user." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:49:45.898Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/eafd83b92f6c044007a3591cbd476bcf90455990" }, { "url": "https://git.kernel.org/stable/c/5030d4c798863ccb266563201b341a099e8cdd48" }, { "url": "https://git.kernel.org/stable/c/c6a8111aacbfe7a8a70f46cc0de8eed00561693c" }, { "url": "https://git.kernel.org/stable/c/26cc6d7006f922df6cc4389248032d955750b2a0" }, { "url": "https://git.kernel.org/stable/c/aa8aa16ed9adf1df05bb339d588cf485a011839e" }, { "url": "https://git.kernel.org/stable/c/ecabe8cd456d3bf81e92c53b074732f3140f170d" }, { "url": "https://git.kernel.org/stable/c/6822a14271786150e178869f1495cc03e74c5029" }, { "url": "https://git.kernel.org/stable/c/78aafb3884f6bc6636efcc1760c891c8500b9922" } ], "title": "hwrng: core - Fix page fault dead lock on mmap-ed hwrng", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52615", "datePublished": "2024-03-18T10:14:45.503Z", "dateReserved": "2024-03-06T09:52:12.089Z", "dateUpdated": "2024-11-04T14:49:45.898Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26804
Vulnerability from cvelistv5
Published
2024-04-04 08:20
Modified
2024-11-12 16:40
Severity ?
EPSS score ?
Summary
net: ip_tunnel: prevent perpetual headroom growth
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-26804", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-11-12T16:26:17.359512Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-12T16:40:15.613Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:14:13.557Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/f81e94d2dcd2397137edcb8b85f4c5bed5d22383" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2e95350fe9db9d53c701075060ac8ac883b68aee" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/afec0c5cd2ed71ca95a8b36a5e6d03333bf34282" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ab63de24ebea36fe73ac7121738595d704b66d96" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a0a1db40b23e8ff86dea2786c5ea1470bb23ecb9" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/049d7989c67e8dd50f07a2096dbafdb41331fb9b" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/ipv4/ip_tunnel.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "f81e94d2dcd2", "status": "affected", "version": "243aad830e8a", "versionType": "git" }, { "lessThan": "2e95350fe9db", "status": "affected", "version": "243aad830e8a", "versionType": "git" }, { "lessThan": "afec0c5cd2ed", "status": "affected", "version": "243aad830e8a", "versionType": "git" }, { "lessThan": "ab63de24ebea", "status": "affected", "version": "243aad830e8a", "versionType": "git" }, { "lessThan": "a0a1db40b23e", "status": "affected", "version": "243aad830e8a", "versionType": "git" }, { "lessThan": "049d7989c67e", "status": "affected", "version": "243aad830e8a", "versionType": "git" }, { "lessThan": "5ae1e9922bbd", "status": "affected", "version": "243aad830e8a", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/ipv4/ip_tunnel.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.34" }, { "lessThan": "2.6.34", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.271", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.212", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.151", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.81", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.21", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.9", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_tunnel: prevent perpetual headroom growth\n\nsyzkaller triggered following kasan splat:\nBUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\nRead of size 1 at addr ffff88812fb4000e by task syz-executor183/5191\n[..]\n kasan_report+0xda/0x110 mm/kasan/report.c:588\n __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\n skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline]\n ___skb_get_hash net/core/flow_dissector.c:1791 [inline]\n __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856\n skb_get_hash include/linux/skbuff.h:1556 [inline]\n ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748\n ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592\n ...\n ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235\n ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323\n ..\n iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82\n ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831\n ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n ...\n\nThe splat occurs because skb-\u003edata points past skb-\u003ehead allocated area.\nThis is because neigh layer does:\n __skb_pull(skb, skb_network_offset(skb));\n\n... but skb_network_offset() returns a negative offset and __skb_pull()\narg is unsigned. IOW, we skb-\u003edata gets \"adjusted\" by a huge value.\n\nThe negative value is returned because skb-\u003ehead and skb-\u003edata distance is\nmore than 64k and skb-\u003enetwork_header (u16) has wrapped around.\n\nThe bug is in the ip_tunnel infrastructure, which can cause\ndev-\u003eneeded_headroom to increment ad infinitum.\n\nThe syzkaller reproducer consists of packets getting routed via a gre\ntunnel, and route of gre encapsulated packets pointing at another (ipip)\ntunnel. The ipip encapsulation finds gre0 as next output device.\n\nThis results in the following pattern:\n\n1). First packet is to be sent out via gre0.\nRoute lookup found an output device, ipip0.\n\n2).\nip_tunnel_xmit for gre0 bumps gre0-\u003eneeded_headroom based on the future\noutput device, rt.dev-\u003eneeded_headroom (ipip0).\n\n3).\nip output / start_xmit moves skb on to ipip0. which runs the same\ncode path again (xmit recursion).\n\n4).\nRouting step for the post-gre0-encap packet finds gre0 as output device\nto use for ipip0 encapsulated packet.\n\ntunl0-\u003eneeded_headroom is then incremented based on the (already bumped)\ngre0 device headroom.\n\nThis repeats for every future packet:\n\ngre0-\u003eneeded_headroom gets inflated because previous packets\u0027 ipip0 step\nincremented rt-\u003edev (gre0) headroom, and ipip0 incremented because gre0\nneeded_headroom was increased.\n\nFor each subsequent packet, gre/ipip0-\u003eneeded_headroom grows until\npost-expand-head reallocations result in a skb-\u003ehead/data distance of\nmore than 64k.\n\nOnce that happens, skb-\u003enetwork_header (u16) wraps around when\npskb_expand_head tries to make sure that skb_network_offset() is unchanged\nafter the headroom expansion/reallocation.\n\nAfter this skb_network_offset(skb) returns a different (and negative)\nresult post headroom expansion.\n\nThe next trip to neigh layer (or anything else that would __skb_pull the\nnetwork header) makes skb-\u003edata point to a memory location outside\nskb-\u003ehead area.\n\nv2: Cap the needed_headroom update to an arbitarily chosen upperlimit to\nprevent perpetual increase instead of dropping the headroom increment\ncompletely." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:16:08.237Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/f81e94d2dcd2397137edcb8b85f4c5bed5d22383" }, { "url": "https://git.kernel.org/stable/c/2e95350fe9db9d53c701075060ac8ac883b68aee" }, { "url": "https://git.kernel.org/stable/c/afec0c5cd2ed71ca95a8b36a5e6d03333bf34282" }, { "url": "https://git.kernel.org/stable/c/ab63de24ebea36fe73ac7121738595d704b66d96" }, { "url": "https://git.kernel.org/stable/c/a0a1db40b23e8ff86dea2786c5ea1470bb23ecb9" }, { "url": "https://git.kernel.org/stable/c/049d7989c67e8dd50f07a2096dbafdb41331fb9b" }, { "url": "https://git.kernel.org/stable/c/5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f" } ], "title": "net: ip_tunnel: prevent perpetual headroom growth", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26804", "datePublished": "2024-04-04T08:20:31.305Z", "dateReserved": "2024-02-19T14:20:24.179Z", "dateUpdated": "2024-11-12T16:40:15.613Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35958
Vulnerability from cvelistv5
Published
2024-05-20 09:41
Modified
2024-11-05 09:25
Severity ?
EPSS score ?
Summary
net: ena: Fix incorrect descriptor free behavior
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-35958", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-29T18:17:10.294133Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-31T20:13:03.442Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:49.187Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b26aa765f7437e1bbe8db4c1641b12bd5dd378f0" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/fdfbf54d128ab6ab255db138488f9650485795a2" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/19ff8fed3338898b70b2aad831386c78564912e1" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5c7f2240d9835a7823d87f7460d8eae9f4e504c7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/bf02d9fe00632d22fa91d34749c7aacf397b6cde" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/amazon/ena/ena_netdev.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "b26aa765f743", "status": "affected", "version": "548c4940b9f1", "versionType": "git" }, { "lessThan": "fdfbf54d128a", "status": "affected", "version": "548c4940b9f1", "versionType": "git" }, { "lessThan": "19ff8fed3338", "status": "affected", "version": "548c4940b9f1", "versionType": "git" }, { "lessThan": "5c7f2240d983", "status": "affected", "version": "548c4940b9f1", "versionType": "git" }, { "lessThan": "c31baa07f013", "status": "affected", "version": "548c4940b9f1", "versionType": "git" }, { "lessThan": "bf02d9fe0063", "status": "affected", "version": "548c4940b9f1", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/amazon/ena/ena_netdev.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.6" }, { "lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.216", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.156", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.87", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.28", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: Fix incorrect descriptor free behavior\n\nENA has two types of TX queues:\n- queues which only process TX packets arriving from the network stack\n- queues which only process TX packets forwarded to it by XDP_REDIRECT\n or XDP_TX instructions\n\nThe ena_free_tx_bufs() cycles through all descriptors in a TX queue\nand unmaps + frees every descriptor that hasn\u0027t been acknowledged yet\nby the device (uncompleted TX transactions).\nThe function assumes that the processed TX queue is necessarily from\nthe first category listed above and ends up using napi_consume_skb()\nfor descriptors belonging to an XDP specific queue.\n\nThis patch solves a bug in which, in case of a VF reset, the\ndescriptors aren\u0027t freed correctly, leading to crashes." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:25:44.784Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/b26aa765f7437e1bbe8db4c1641b12bd5dd378f0" }, { "url": "https://git.kernel.org/stable/c/fdfbf54d128ab6ab255db138488f9650485795a2" }, { "url": "https://git.kernel.org/stable/c/19ff8fed3338898b70b2aad831386c78564912e1" }, { "url": "https://git.kernel.org/stable/c/5c7f2240d9835a7823d87f7460d8eae9f4e504c7" }, { "url": "https://git.kernel.org/stable/c/c31baa07f01307b7ae05f3ce32b89d8e2ba0cc1d" }, { "url": "https://git.kernel.org/stable/c/bf02d9fe00632d22fa91d34749c7aacf397b6cde" } ], "title": "net: ena: Fix incorrect descriptor free behavior", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35958", "datePublished": "2024-05-20T09:41:50.585Z", "dateReserved": "2024-05-17T13:50:33.136Z", "dateUpdated": "2024-11-05T09:25:44.784Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35838
Vulnerability from cvelistv5
Published
2024-05-17 14:02
Modified
2024-11-05 09:23
Severity ?
EPSS score ?
Summary
wifi: mac80211: fix potential sta-link leak
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-35838", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-17T17:39:07.857159Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-17T17:42:37.524Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:49.012Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/49aaeb8c539b1633b3bd7c2df131ec578aa1eae1" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/587c5892976108674bbe61a8ff659de279318034" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e04bf59bdba0fa45d52160be676114e16be855a9" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b01a74b3ca6fd51b62c67733ba7c3280fa6c5d26" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/mac80211/sta_info.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "49aaeb8c539b", "status": "affected", "version": "cb71f1d136a6", "versionType": "git" }, { "lessThan": "587c58929761", "status": "affected", "version": "cb71f1d136a6", "versionType": "git" }, { "lessThan": "e04bf59bdba0", "status": "affected", "version": "cb71f1d136a6", "versionType": "git" }, { "lessThan": "b01a74b3ca6f", "status": "affected", "version": "cb71f1d136a6", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/mac80211/sta_info.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.0" }, { "lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.76", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.15", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix potential sta-link leak\n\nWhen a station is allocated, links are added but not\nset to valid yet (e.g. during connection to an AP MLD),\nwe might remove the station without ever marking links\nvalid, and leak them. Fix that." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:23:23.103Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/49aaeb8c539b1633b3bd7c2df131ec578aa1eae1" }, { "url": "https://git.kernel.org/stable/c/587c5892976108674bbe61a8ff659de279318034" }, { "url": "https://git.kernel.org/stable/c/e04bf59bdba0fa45d52160be676114e16be855a9" }, { "url": "https://git.kernel.org/stable/c/b01a74b3ca6fd51b62c67733ba7c3280fa6c5d26" } ], "title": "wifi: mac80211: fix potential sta-link leak", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35838", "datePublished": "2024-05-17T14:02:36.410Z", "dateReserved": "2024-05-17T13:50:33.104Z", "dateUpdated": "2024-11-05T09:23:23.103Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35959
Vulnerability from cvelistv5
Published
2024-05-20 09:41
Modified
2024-11-05 09:25
Severity ?
EPSS score ?
Summary
net/mlx5e: Fix mlx5e_priv_init() cleanup flow
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:49.131Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ad26f26abd353113dea4e8d5ebadccdab9b61e76" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6bd77865fda662913dcb5722a66a773840370aa7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ecb829459a841198e142f72fadab56424ae96519" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-35959", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:40:38.972541Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-11T17:33:14.315Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/en/selq.c", "drivers/net/ethernet/mellanox/mlx5/core/en_main.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "ad26f26abd35", "status": "affected", "version": "8bf30be75069", "versionType": "git" }, { "lessThan": "f9ac93b6f3de", "status": "affected", "version": "8bf30be75069", "versionType": "git" }, { "lessThan": "6bd77865fda6", "status": "affected", "version": "8bf30be75069", "versionType": "git" }, { "lessThan": "ecb829459a84", "status": "affected", "version": "8bf30be75069", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/en/selq.c", "drivers/net/ethernet/mellanox/mlx5/core/en_main.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.18" }, { "lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.87", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.28", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix mlx5e_priv_init() cleanup flow\n\nWhen mlx5e_priv_init() fails, the cleanup flow calls mlx5e_selq_cleanup which\ncalls mlx5e_selq_apply() that assures that the `priv-\u003estate_lock` is held using\nlockdep_is_held().\n\nAcquire the state_lock in mlx5e_selq_cleanup().\n\nKernel log:\n=============================\nWARNING: suspicious RCU usage\n6.8.0-rc3_net_next_841a9b5 #1 Not tainted\n-----------------------------\ndrivers/net/ethernet/mellanox/mlx5/core/en/selq.c:124 suspicious rcu_dereference_protected() usage!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n2 locks held by systemd-modules/293:\n #0: ffffffffa05067b0 (devices_rwsem){++++}-{3:3}, at: ib_register_client+0x109/0x1b0 [ib_core]\n #1: ffff8881096c65c0 (\u0026device-\u003eclient_data_rwsem){++++}-{3:3}, at: add_client_context+0x104/0x1c0 [ib_core]\n\nstack backtrace:\nCPU: 4 PID: 293 Comm: systemd-modules Not tainted 6.8.0-rc3_net_next_841a9b5 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x8a/0xa0\n lockdep_rcu_suspicious+0x154/0x1a0\n mlx5e_selq_apply+0x94/0xa0 [mlx5_core]\n mlx5e_selq_cleanup+0x3a/0x60 [mlx5_core]\n mlx5e_priv_init+0x2be/0x2f0 [mlx5_core]\n mlx5_rdma_setup_rn+0x7c/0x1a0 [mlx5_core]\n rdma_init_netdev+0x4e/0x80 [ib_core]\n ? mlx5_rdma_netdev_free+0x70/0x70 [mlx5_core]\n ipoib_intf_init+0x64/0x550 [ib_ipoib]\n ipoib_intf_alloc+0x4e/0xc0 [ib_ipoib]\n ipoib_add_one+0xb0/0x360 [ib_ipoib]\n add_client_context+0x112/0x1c0 [ib_core]\n ib_register_client+0x166/0x1b0 [ib_core]\n ? 0xffffffffa0573000\n ipoib_init_module+0xeb/0x1a0 [ib_ipoib]\n do_one_initcall+0x61/0x250\n do_init_module+0x8a/0x270\n init_module_from_file+0x8b/0xd0\n idempotent_init_module+0x17d/0x230\n __x64_sys_finit_module+0x61/0xb0\n do_syscall_64+0x71/0x140\n entry_SYSCALL_64_after_hwframe+0x46/0x4e\n \u003c/TASK\u003e" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:25:45.923Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/ad26f26abd353113dea4e8d5ebadccdab9b61e76" }, { "url": "https://git.kernel.org/stable/c/f9ac93b6f3de34aa0bb983b9be4f69ca50fc70f3" }, { "url": "https://git.kernel.org/stable/c/6bd77865fda662913dcb5722a66a773840370aa7" }, { "url": "https://git.kernel.org/stable/c/ecb829459a841198e142f72fadab56424ae96519" } ], "title": "net/mlx5e: Fix mlx5e_priv_init() cleanup flow", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35959", "datePublished": "2024-05-20T09:41:51.244Z", "dateReserved": "2024-05-17T13:50:33.137Z", "dateUpdated": "2024-11-05T09:25:45.923Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52703
Vulnerability from cvelistv5
Published
2024-05-21 15:22
Modified
2024-11-07 16:41
Severity ?
EPSS score ?
Summary
net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2023-52703", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-29T17:57:22.463182Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-07T16:41:20.808Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T23:11:35.557Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1b5de7d44890b78519acbcc80d8d1f23ff2872e5" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/723ef7b66f37c0841f5a451ccbce47ee1641e081" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a753352622b4f3c0219e0e9c73114b2848ae6042" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/525bdcb0838d19d918c7786151ee14661967a030" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/338f826d3afead6e4df521f7972a4bef04a72efb" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/02df3170c04a8356cd571ab9155a42f030190abc" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c68f345b7c425b38656e1791a0486769a8797016" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/usb/kalmia.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "1b5de7d44890", "status": "affected", "version": "d40261236e8e", "versionType": "git" }, { "lessThan": "723ef7b66f37", "status": "affected", "version": "d40261236e8e", "versionType": "git" }, { "lessThan": "a753352622b4", "status": "affected", "version": "d40261236e8e", "versionType": "git" }, { "lessThan": "525bdcb0838d", "status": "affected", "version": "d40261236e8e", "versionType": "git" }, { "lessThan": "338f826d3afe", "status": "affected", "version": "d40261236e8e", "versionType": "git" }, { "lessThan": "02df3170c04a", "status": "affected", "version": "d40261236e8e", "versionType": "git" }, { "lessThan": "c68f345b7c42", "status": "affected", "version": "d40261236e8e", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/usb/kalmia.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.0" }, { "lessThan": "3.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.306", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.273", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.232", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.169", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.95", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.13", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.2", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/usb: kalmia: Don\u0027t pass act_len in usb_bulk_msg error path\n\nsyzbot reported that act_len in kalmia_send_init_packet() is\nuninitialized when passing it to the first usb_bulk_msg error path. Jiri\nPirko noted that it\u0027s pointless to pass it in the error path, and that\nthe value that would be printed in the second error path would be the\nvalue of act_len from the first call to usb_bulk_msg.[1]\n\nWith this in mind, let\u0027s just not pass act_len to the usb_bulk_msg error\npaths.\n\n1: https://lore.kernel.org/lkml/Y9pY61y1nwTuzMOa@nanopsycho/" } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:51:29.319Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/1b5de7d44890b78519acbcc80d8d1f23ff2872e5" }, { "url": "https://git.kernel.org/stable/c/723ef7b66f37c0841f5a451ccbce47ee1641e081" }, { "url": "https://git.kernel.org/stable/c/a753352622b4f3c0219e0e9c73114b2848ae6042" }, { "url": "https://git.kernel.org/stable/c/525bdcb0838d19d918c7786151ee14661967a030" }, { "url": "https://git.kernel.org/stable/c/338f826d3afead6e4df521f7972a4bef04a72efb" }, { "url": "https://git.kernel.org/stable/c/02df3170c04a8356cd571ab9155a42f030190abc" }, { "url": "https://git.kernel.org/stable/c/c68f345b7c425b38656e1791a0486769a8797016" } ], "title": "net/usb: kalmia: Don\u0027t pass act_len in usb_bulk_msg error path", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52703", "datePublished": "2024-05-21T15:22:52.687Z", "dateReserved": "2024-03-07T14:49:46.891Z", "dateUpdated": "2024-11-07T16:41:20.808Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35789
Vulnerability from cvelistv5
Published
2024-05-17 12:24
Modified
2024-11-05 09:22
Severity ?
EPSS score ?
Summary
wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-35789", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-24T14:19:23.131138Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:33:29.281Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:47.402Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/mac80211/cfg.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "ea9a0cfc07a7", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "be1dd9254fc1", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "e8b067c4058c", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "c8bddbd91bc8", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "7eeabcea79b6", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "6b948b54c8bd", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "2884a50f5231", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "e8678551c024", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "4f2bdb3c5e31", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/mac80211/cfg.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.312", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.274", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.215", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.154", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.84", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.24", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.12", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes\n\nWhen moving a station out of a VLAN and deleting the VLAN afterwards, the\nfast_rx entry still holds a pointer to the VLAN\u0027s netdev, which can cause\nuse-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx\nafter the VLAN change." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:22:23.605Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921" }, { "url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931" }, { "url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e" }, { "url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f" }, { "url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b" }, { "url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7" }, { "url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc" }, { "url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb" }, { "url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685" } ], "title": "wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35789", "datePublished": "2024-05-17T12:24:42.323Z", "dateReserved": "2024-05-17T12:19:12.338Z", "dateUpdated": "2024-11-05T09:22:23.605Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26583
Vulnerability from cvelistv5
Published
2024-02-21 14:59
Modified
2024-11-05 09:11
Severity ?
EPSS score ?
Summary
tls: fix race between async notify and socket close
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-26583", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-02-22T16:41:40.480459Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-05T17:21:01.043Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:07:19.779Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "include/net/tls.h", "net/tls/tls_sw.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "f17d21ea7391", "status": "affected", "version": "0cada33241d9", "versionType": "git" }, { "lessThan": "7a3ca06d04d5", "status": "affected", "version": "0cada33241d9", "versionType": "git" }, { "lessThan": "86dc27ee36f5", "status": "affected", "version": "0cada33241d9", "versionType": "git" }, { "lessThan": "6209319b2efd", "status": "affected", "version": "0cada33241d9", "versionType": "git" }, { "lessThan": "aec7961916f3", "status": "affected", "version": "0cada33241d9", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "include/net/tls.h", "net/tls/tls_sw.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.7" }, { "lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.160", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.79", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.18", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.6", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between async notify and socket close\n\nThe submitting thread (one which called recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete()\nso any code past that point risks touching already freed data.\n\nTry to avoid the locking and extra flags altogether.\nHave the main thread hold an extra reference, this way\nwe can depend solely on the atomic ref counter for\nsynchronization.\n\nDon\u0027t futz with reiniting the completion, either, we are now\ntightly controlling when completion fires." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:11:58.582Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7" }, { "url": "https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01" }, { "url": "https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a" }, { "url": "https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33" }, { "url": "https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d" } ], "title": "tls: fix race between async notify and socket close", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26583", "datePublished": "2024-02-21T14:59:11.845Z", "dateReserved": "2024-02-19T14:20:24.125Z", "dateUpdated": "2024-11-05T09:11:58.582Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26906
Vulnerability from cvelistv5
Published
2024-04-17 10:27
Modified
2024-11-05 09:17
Severity ?
EPSS score ?
Summary
x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T00:21:05.490Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6e4694e65b6db4c3de125115dd4f55848cc48381" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e8a67fe34b76a49320b33032228a794f40b0316b" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/f175de546a3eb77614d94d4c02550181c0a8493e" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/57f78c46f08198e1be08ffe99c4c1ccc12855bf5" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/29bd6f86904682adafe9affbc7f79b14defcaff8" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-26906", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:47:59.842385Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-11T17:33:22.186Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/x86/mm/maccess.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "6e4694e65b6d", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "e8a67fe34b76", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "f175de546a3e", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "57f78c46f081", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "29bd6f869046", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "32019c659ecf", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/x86/mm/maccess.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.214", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.153", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.83", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.23", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.11", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()\n\nWhen trying to use copy_from_kernel_nofault() to read vsyscall page\nthrough a bpf program, the following oops was reported:\n\n BUG: unable to handle page fault for address: ffffffffff600000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0\n Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......\n RIP: 0010:copy_from_kernel_nofault+0x6f/0x110\n ......\n Call Trace:\n \u003cTASK\u003e\n ? copy_from_kernel_nofault+0x6f/0x110\n bpf_probe_read_kernel+0x1d/0x50\n bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d\n trace_call_bpf+0xc5/0x1c0\n perf_call_bpf_enter.isra.0+0x69/0xb0\n perf_syscall_enter+0x13e/0x200\n syscall_trace_enter+0x188/0x1c0\n do_syscall_64+0xb5/0xe0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n \u003c/TASK\u003e\n ......\n ---[ end trace 0000000000000000 ]---\n\nThe oops is triggered when:\n\n1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall\npage and invokes copy_from_kernel_nofault() which in turn calls\n__get_user_asm().\n\n2) Because the vsyscall page address is not readable from kernel space,\na page fault exception is triggered accordingly.\n\n3) handle_page_fault() considers the vsyscall page address as a user\nspace address instead of a kernel space address. This results in the\nfix-up setup by bpf not being applied and a page_fault_oops() is invoked\ndue to SMAP.\n\nConsidering handle_page_fault() has already considered the vsyscall page\naddress as a userspace address, fix the problem by disallowing vsyscall\npage read for copy_from_kernel_nofault()." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:17:57.653Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/6e4694e65b6db4c3de125115dd4f55848cc48381" }, { "url": "https://git.kernel.org/stable/c/e8a67fe34b76a49320b33032228a794f40b0316b" }, { "url": "https://git.kernel.org/stable/c/f175de546a3eb77614d94d4c02550181c0a8493e" }, { "url": "https://git.kernel.org/stable/c/57f78c46f08198e1be08ffe99c4c1ccc12855bf5" }, { "url": "https://git.kernel.org/stable/c/29bd6f86904682adafe9affbc7f79b14defcaff8" }, { "url": "https://git.kernel.org/stable/c/32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58" } ], "title": "x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26906", "datePublished": "2024-04-17T10:27:53.573Z", "dateReserved": "2024-02-19T14:20:24.187Z", "dateUpdated": "2024-11-05T09:17:57.653Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-34750
Vulnerability from cvelistv5
Published
2024-07-03 19:32
Modified
2024-08-16 17:02
Severity ?
EPSS score ?
Summary
Apache Tomcat: HTTP/2 excess header handling DoS
References
▼ | URL | Tags |
---|---|---|
https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l | vendor-advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Apache Software Foundation | Apache Tomcat |
Version: 11.0.0-M1 ≤ 11.0.0-M20 Version: 10.1.0-M1 ≤ 10.1.24 Version: 9.0.0-M1 ≤ 9.0.89 |
|
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "tomcat", "vendor": "apache", "versions": [ { "lessThanOrEqual": "9.0.89", "status": "affected", "version": "9.0.0-m1", "versionType": "semver" }, { "lessThanOrEqual": "10.1.24", "status": "affected", "version": "10.1.0-m1", "versionType": "semver" }, { "lessThanOrEqual": "11.0.0-m20", "status": "affected", "version": "11.0.0-m1", "versionType": "semver" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-34750", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-08T16:51:20.954347Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-13T16:05:56.107Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-16T17:02:39.887Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l" }, { "url": "https://security.netapp.com/advisory/ntap-20240816-0004/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [ { "lessThanOrEqual": "11.0.0-M20", "status": "affected", "version": "11.0.0-M1", "versionType": "semver" }, { "lessThanOrEqual": "10.1.24", "status": "affected", "version": "10.1.0-M1", "versionType": "semver" }, { "lessThanOrEqual": "9.0.89", "status": "affected", "version": "9.0.0-M1", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "devme4f from VNPT-VCI" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\u003c/p\u003e" } ], "value": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\n\n" } ], "metrics": [ { "other": { "content": { "text": "important" }, "type": "Textual description of severity" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-07-03T19:32:34.695Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l" } ], "source": { "discovery": "EXTERNAL" }, "title": "Apache Tomcat: HTTP/2 excess header handling DoS", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2024-34750", "datePublished": "2024-07-03T19:32:34.695Z", "dateReserved": "2024-05-08T07:23:16.760Z", "dateUpdated": "2024-08-16T17:02:39.887Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2020-26555
Vulnerability from cvelistv5
Published
2021-05-24 17:41
Modified
2024-08-04 15:56
Severity ?
EPSS score ?
Summary
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.
References
▼ | URL | Tags |
---|---|---|
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/ | x_refsource_MISC | |
https://kb.cert.org/vuls/id/799380 | x_refsource_MISC | |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/ | vendor-advisory, x_refsource_FEDORA | |
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html | x_refsource_CONFIRM |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T15:56:04.577Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://kb.cert.org/vuls/id/799380" }, { "name": "FEDORA-2021-a35b44fd9f", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2021-06-08T17:06:22", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/" }, { "tags": [ "x_refsource_MISC" ], "url": "https://kb.cert.org/vuls/id/799380" }, { "name": "FEDORA-2021-a35b44fd9f", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-26555", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/", "refsource": "MISC", "url": "https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/" }, { "name": "https://kb.cert.org/vuls/id/799380", "refsource": "MISC", "url": "https://kb.cert.org/vuls/id/799380" }, { "name": "FEDORA-2021-a35b44fd9f", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/" }, { "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html", "refsource": "CONFIRM", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-26555", "datePublished": "2021-05-24T17:41:15", "dateReserved": "2020-10-04T00:00:00", "dateUpdated": "2024-08-04T15:56:04.577Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35888
Vulnerability from cvelistv5
Published
2024-05-19 08:34
Modified
2024-11-06 15:16
Severity ?
EPSS score ?
Summary
erspan: make sure erspan_base_hdr is present in skb->head
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-35888", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-18T16:55:13.123300Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-06T15:16:34.913Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:48.504Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/06a939f72a24a7d8251f84cf4c042df86c6666ac" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e54a0c79cdc2548729dd7e2e468b08c5af4d0df5" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b14b9f9503ec823ca75be766dcaeff4f0bfeca85" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ee0088101beee10fa809716d6245d915b09c37c7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1db7fcb2b290c47c202b79528824f119fa28937d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4e3fdeecec5707678b0d1f18c259dadb97262e9d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0ac328a5a4138a6c03dfc3f46017bd5c19167446" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/17af420545a750f763025149fa7b833a4fc8b8f0" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/ipv4/ip_gre.c", "net/ipv6/ip6_gre.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "06a939f72a24", "status": "affected", "version": "0a198e0bb8be", "versionType": "git" }, { "lessThan": "e54a0c79cdc2", "status": "affected", "version": "cb73ee40b1b3", "versionType": "git" }, { "lessThan": "b14b9f9503ec", "status": "affected", "version": "cb73ee40b1b3", "versionType": "git" }, { "lessThan": "ee0088101bee", "status": "affected", "version": "cb73ee40b1b3", "versionType": "git" }, { "lessThan": "1db7fcb2b290", "status": "affected", "version": "cb73ee40b1b3", "versionType": "git" }, { "lessThan": "4e3fdeecec57", "status": "affected", "version": "cb73ee40b1b3", "versionType": "git" }, { "lessThan": "0ac328a5a413", "status": "affected", "version": "cb73ee40b1b3", "versionType": "git" }, { "lessThan": "17af420545a7", "status": "affected", "version": "cb73ee40b1b3", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/ipv4/ip_gre.c", "net/ipv6/ip6_gre.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.0" }, { "lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.312", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.274", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.215", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.154", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.85", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.26", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.5", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerspan: make sure erspan_base_hdr is present in skb-\u003ehead\n\nsyzbot reported a problem in ip6erspan_rcv() [1]\n\nIssue is that ip6erspan_rcv() (and erspan_rcv()) no longer make\nsure erspan_base_hdr is present in skb linear part (skb-\u003ehead)\nbefore getting @ver field from it.\n\nAdd the missing pskb_may_pull() calls.\n\nv2: Reload iph pointer in erspan_rcv() after pskb_may_pull()\n because skb-\u003ehead might have changed.\n\n[1]\n\n BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2756 [inline]\n BUG: KMSAN: uninit-value in ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n BUG: KMSAN: uninit-value in gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n pskb_may_pull include/linux/skbuff.h:2756 [inline]\n ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n ip6_protocol_deliver_rcu+0x1d4c/0x2ca0 net/ipv6/ip6_input.c:438\n ip6_input_finish net/ipv6/ip6_input.c:483 [inline]\n NF_HOOK include/linux/netfilter.h:314 [inline]\n ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492\n ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586\n dst_input include/net/dst.h:460 [inline]\n ip6_rcv_finish+0x955/0x970 net/ipv6/ip6_input.c:79\n NF_HOOK include/linux/netfilter.h:314 [inline]\n ipv6_rcv+0xde/0x390 net/ipv6/ip6_input.c:310\n __netif_receive_skb_one_core net/core/dev.c:5538 [inline]\n __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5652\n netif_receive_skb_internal net/core/dev.c:5738 [inline]\n netif_receive_skb+0x58/0x660 net/core/dev.c:5798\n tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1549\n tun_get_user+0x5566/0x69e0 drivers/net/tun.c:2002\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n call_write_iter include/linux/fs.h:2108 [inline]\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0xb63/0x1520 fs/read_write.c:590\n ksys_write+0x20f/0x4c0 fs/read_write.c:643\n __do_sys_write fs/read_write.c:655 [inline]\n __se_sys_write fs/read_write.c:652 [inline]\n __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:3804 [inline]\n slab_alloc_node mm/slub.c:3845 [inline]\n kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n alloc_skb include/linux/skbuff.h:1318 [inline]\n alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n tun_alloc_skb drivers/net/tun.c:1525 [inline]\n tun_get_user+0x209a/0x69e0 drivers/net/tun.c:1846\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n call_write_iter include/linux/fs.h:2108 [inline]\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0xb63/0x1520 fs/read_write.c:590\n ksys_write+0x20f/0x4c0 fs/read_write.c:643\n __do_sys_write fs/read_write.c:655 [inline]\n __se_sys_write fs/read_write.c:652 [inline]\n __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nCPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:24:29.695Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/06a939f72a24a7d8251f84cf4c042df86c6666ac" }, { "url": "https://git.kernel.org/stable/c/e54a0c79cdc2548729dd7e2e468b08c5af4d0df5" }, { "url": "https://git.kernel.org/stable/c/b14b9f9503ec823ca75be766dcaeff4f0bfeca85" }, { "url": "https://git.kernel.org/stable/c/ee0088101beee10fa809716d6245d915b09c37c7" }, { "url": "https://git.kernel.org/stable/c/1db7fcb2b290c47c202b79528824f119fa28937d" }, { "url": "https://git.kernel.org/stable/c/4e3fdeecec5707678b0d1f18c259dadb97262e9d" }, { "url": "https://git.kernel.org/stable/c/0ac328a5a4138a6c03dfc3f46017bd5c19167446" }, { "url": "https://git.kernel.org/stable/c/17af420545a750f763025149fa7b833a4fc8b8f0" } ], "title": "erspan: make sure erspan_base_hdr is present in skb-\u003ehead", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35888", "datePublished": "2024-05-19T08:34:44.428Z", "dateReserved": "2024-05-17T13:50:33.113Z", "dateUpdated": "2024-11-06T15:16:34.913Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35852
Vulnerability from cvelistv5
Published
2024-05-17 14:47
Modified
2024-11-05 09:23
Severity ?
EPSS score ?
Summary
mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-35852", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-20T18:41:32.237249Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:34:10.715Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:48.279Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/51cefc9da400b953fee749c9e5d26cd4a2b5d758" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/857ed800133ffcfcee28582090b63b0cbb8ba59d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/63d814d93c5cce4c18284adc810028f28dca493f" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5bfe7bf9656ed2633718388f12b7c38b86414a04" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/de1aaefa75be9d0ec19c9a3e0e2f9696de20c6ab" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/d72dd6fcd7886d0523afbab8b4a4b22d17addd7d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/fb4e2b70a7194b209fc7320bbf33b375f7114bd5" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "51cefc9da400", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "857ed800133f", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "63d814d93c5c", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "5bfe7bf9656e", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "de1aaefa75be", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "d72dd6fcd788", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "fb4e2b70a719", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.1" }, { "lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.275", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.216", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.158", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.90", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.30", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.9", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work\n\nThe rehash delayed work is rescheduled with a delay if the number of\ncredits at end of the work is not negative as supposedly it means that\nthe migration ended. Otherwise, it is rescheduled immediately.\n\nAfter \"mlxsw: spectrum_acl_tcam: Fix possible use-after-free during\nrehash\" the above is no longer accurate as a non-negative number of\ncredits is no longer indicative of the migration being done. It can also\nhappen if the work encountered an error in which case the migration will\nresume the next time the work is scheduled.\n\nThe significance of the above is that it is possible for the work to be\npending and associated with hints that were allocated when the migration\nstarted. This leads to the hints being leaked [1] when the work is\ncanceled while pending as part of ACL region dismantle.\n\nFix by freeing the hints if hints are associated with a work that was\ncanceled while pending.\n\nBlame the original commit since the reliance on not having a pending\nwork associated with hints is fragile.\n\n[1]\nunreferenced object 0xffff88810e7c3000 (size 256):\n comm \"kworker/0:16\", pid 176, jiffies 4295460353\n hex dump (first 32 bytes):\n 00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a.......\n 00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@...........\n backtrace (crc 2544ddb9):\n [\u003c00000000cf8cfab3\u003e] kmalloc_trace+0x23f/0x2a0\n [\u003c000000004d9a1ad9\u003e] objagg_hints_get+0x42/0x390\n [\u003c000000000b143cf3\u003e] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400\n [\u003c0000000059bdb60a\u003e] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160\n [\u003c00000000e81fd734\u003e] process_one_work+0x59c/0xf20\n [\u003c00000000ceee9e81\u003e] worker_thread+0x799/0x12c0\n [\u003c00000000bda6fe39\u003e] kthread+0x246/0x300\n [\u003c0000000070056d23\u003e] ret_from_fork+0x34/0x70\n [\u003c00000000dea2b93e\u003e] ret_from_fork_asm+0x1a/0x30" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:23:44.480Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/51cefc9da400b953fee749c9e5d26cd4a2b5d758" }, { "url": "https://git.kernel.org/stable/c/857ed800133ffcfcee28582090b63b0cbb8ba59d" }, { "url": "https://git.kernel.org/stable/c/63d814d93c5cce4c18284adc810028f28dca493f" }, { "url": "https://git.kernel.org/stable/c/5bfe7bf9656ed2633718388f12b7c38b86414a04" }, { "url": "https://git.kernel.org/stable/c/de1aaefa75be9d0ec19c9a3e0e2f9696de20c6ab" }, { "url": "https://git.kernel.org/stable/c/d72dd6fcd7886d0523afbab8b4a4b22d17addd7d" }, { "url": "https://git.kernel.org/stable/c/fb4e2b70a7194b209fc7320bbf33b375f7114bd5" } ], "title": "mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35852", "datePublished": "2024-05-17T14:47:29.441Z", "dateReserved": "2024-05-17T13:50:33.106Z", "dateUpdated": "2024-11-05T09:23:44.480Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-5090
Vulnerability from cvelistv5
Published
2023-11-06 10:56
Modified
2024-11-13 14:42
Severity ?
EPSS score ?
Summary
Kernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs
References
▼ | URL | Tags |
---|---|---|
https://access.redhat.com/errata/RHSA-2024:2758 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:3854 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:3855 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:4211 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:4352 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/security/cve/CVE-2023-5090 | vdb-entry, x_refsource_REDHAT | |
https://bugzilla.redhat.com/show_bug.cgi?id=2248122 | issue-tracking, x_refsource_REDHAT |
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Red Hat | Red Hat Enterprise Linux 8 |
Unaffected: 0:4.18.0-553.8.1.rt7.349.el8_10 < * cpe:/a:redhat:enterprise_linux:8::nfv cpe:/a:redhat:enterprise_linux:8::realtime |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:44:53.833Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2024:3854", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:3854" }, { "name": "RHSA-2024:3855", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:3855" }, { "name": "RHSA-2024:4211", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4211" }, { "name": "RHSA-2024:4352", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4352" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2023-5090" }, { "name": "RHBZ#2248122", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248122" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::nfv", "cpe:/a:redhat:enterprise_linux:8::realtime" ], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:4.18.0-553.8.1.rt7.349.el8_10", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::baseos", "cpe:/a:redhat:enterprise_linux:8::crb" ], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:4.18.0-553.8.1.el8_10", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::nfv", "cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::realtime" ], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:5.14.0-427.16.1.el9_4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::nfv", "cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::realtime" ], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:5.14.0-427.16.1.el9_4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:9.2::appstream", "cpe:/o:redhat:rhel_eus:9.2::baseos", "cpe:/a:redhat:rhel_eus:9.2::crb" ], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9.2 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:5.14.0-284.69.1.el9_2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:9.2::realtime", "cpe:/a:redhat:rhel_eus:9.2::nfv" ], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 9.2 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:5.14.0-284.69.1.rt14.354.el9_2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat" } ], "credits": [ { "lang": "en", "value": "This issue was discovered by Maxim Levitsky (Red Hat)." } ], "datePublic": "2023-09-28T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-755", "description": "Improper Handling of Exceptional Conditions", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-13T14:42:27.464Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2024:2758", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2758" }, { "name": "RHSA-2024:3854", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:3854" }, { "name": "RHSA-2024:3855", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:3855" }, { "name": "RHSA-2024:4211", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4211" }, { "name": "RHSA-2024:4352", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4352" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2023-5090" }, { "name": "RHBZ#2248122", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248122" } ], "timeline": [ { "lang": "en", "time": "2023-09-20T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2023-09-28T00:00:00+00:00", "value": "Made public." } ], "title": "Kernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs", "workarounds": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability." } ], "x_redhatCweChain": "CWE-755: Improper Handling of Exceptional Conditions" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-5090", "datePublished": "2023-11-06T10:56:57.062Z", "dateReserved": "2023-09-20T15:29:32.106Z", "dateUpdated": "2024-11-13T14:42:27.464Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52835
Vulnerability from cvelistv5
Published
2024-05-21 15:31
Modified
2024-11-04 14:53
Severity ?
EPSS score ?
Summary
perf/core: Bail out early if the request AUX area is out of bound
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T23:11:36.062Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8c504f615d7ed60ae035c51d0c789137ced6797f" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/788c0b3442ead737008934947730a6d1ff703734" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1a2a4202c60fcdffbf04f259002ce9bff39edece" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/fd0df3f8719201dbe61a4d39083d5aecd705399a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/9ce4e87a8efd37c85766ec08b15e885cab08553a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2424410f94a94d91230ced094062d859714c984a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2e905e608e38cf7f8dcddcf8a6036e91a78444cb" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/54aee5f15b83437f23b2b2469bcf21bdd9823916" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-52835", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:36:37.546418Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-11T17:32:54.507Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "kernel/events/ring_buffer.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "8c504f615d7e", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "788c0b3442ea", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "1a2a4202c60f", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "fd0df3f87192", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "9ce4e87a8efd", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "2424410f94a9", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "2e905e608e38", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "54aee5f15b83", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "kernel/events/ring_buffer.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.300", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.262", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.202", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.140", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.64", "versionType": "semver" }, { "lessThanOrEqual": "6.5.*", "status": "unaffected", "version": "6.5.13", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.7", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Bail out early if the request AUX area is out of bound\n\nWhen perf-record with a large AUX area, e.g 4GB, it fails with:\n\n #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1\n failed to mmap with 12 (Cannot allocate memory)\n\nand it reveals a WARNING with __alloc_pages():\n\n\t------------[ cut here ]------------\n\tWARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248\n\tCall trace:\n\t __alloc_pages+0x1ec/0x248\n\t __kmalloc_large_node+0xc0/0x1f8\n\t __kmalloc_node+0x134/0x1e8\n\t rb_alloc_aux+0xe0/0x298\n\t perf_mmap+0x440/0x660\n\t mmap_region+0x308/0x8a8\n\t do_mmap+0x3c0/0x528\n\t vm_mmap_pgoff+0xf4/0x1b8\n\t ksys_mmap_pgoff+0x18c/0x218\n\t __arm64_sys_mmap+0x38/0x58\n\t invoke_syscall+0x50/0x128\n\t el0_svc_common.constprop.0+0x58/0x188\n\t do_el0_svc+0x34/0x50\n\t el0_svc+0x34/0x108\n\t el0t_64_sync_handler+0xb8/0xc0\n\t el0t_64_sync+0x1a4/0x1a8\n\n\u0027rb-\u003eaux_pages\u0027 allocated by kcalloc() is a pointer array which is used to\nmaintains AUX trace pages. The allocated page for this array is physically\ncontiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the\nsize of pointer array crosses the limitation set by MAX_ORDER, it reveals a\nWARNING.\n\nSo bail out early with -ENOMEM if the request AUX area is out of bound,\ne.g.:\n\n #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1\n failed to mmap with 12 (Cannot allocate memory)" } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:53:32.668Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/8c504f615d7ed60ae035c51d0c789137ced6797f" }, { "url": "https://git.kernel.org/stable/c/788c0b3442ead737008934947730a6d1ff703734" }, { "url": "https://git.kernel.org/stable/c/1a2a4202c60fcdffbf04f259002ce9bff39edece" }, { "url": "https://git.kernel.org/stable/c/fd0df3f8719201dbe61a4d39083d5aecd705399a" }, { "url": "https://git.kernel.org/stable/c/9ce4e87a8efd37c85766ec08b15e885cab08553a" }, { "url": "https://git.kernel.org/stable/c/2424410f94a94d91230ced094062d859714c984a" }, { "url": "https://git.kernel.org/stable/c/2e905e608e38cf7f8dcddcf8a6036e91a78444cb" }, { "url": "https://git.kernel.org/stable/c/54aee5f15b83437f23b2b2469bcf21bdd9823916" } ], "title": "perf/core: Bail out early if the request AUX area is out of bound", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52835", "datePublished": "2024-05-21T15:31:36.239Z", "dateReserved": "2024-05-21T15:19:24.252Z", "dateUpdated": "2024-11-04T14:53:32.668Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-36007
Vulnerability from cvelistv5
Published
2024-05-20 09:48
Modified
2024-11-06 15:10
Severity ?
EPSS score ?
Summary
mlxsw: spectrum_acl_tcam: Fix warning during rehash
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-36007", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-31T18:47:44.179419Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-06T15:10:37.319Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:30:11.636Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0b88631855026b55cad901ac28d081e0f358e596" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1d76bd2a0034d0d08045c1c6adf2235d88982952" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/039992b6d2df097c65f480dcf269de3d2656f573" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/751d352858108314efd33dddd5a9a2b6bf7d6916" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e890456051fe8c57944b911defb3e6de91315861" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/17e9e0bbae652b9b2049e51699e93dfa60b2988d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/743edc8547a92b6192aa1f1b6bb78233fa21dc9b" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "0b8863185502", "status": "affected", "version": "6f9579d4e302", "versionType": "git" }, { "lessThan": "1d76bd2a0034", "status": "affected", "version": "6f9579d4e302", "versionType": "git" }, { "lessThan": "039992b6d2df", "status": "affected", "version": "6f9579d4e302", "versionType": "git" }, { "lessThan": "751d35285810", "status": "affected", "version": "6f9579d4e302", "versionType": "git" }, { "lessThan": "e890456051fe", "status": "affected", "version": "6f9579d4e302", "versionType": "git" }, { "lessThan": "17e9e0bbae65", "status": "affected", "version": "6f9579d4e302", "versionType": "git" }, { "lessThan": "743edc8547a9", "status": "affected", "version": "6f9579d4e302", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.1" }, { "lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.275", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.216", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.158", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.90", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.30", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.9", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix warning during rehash\n\nAs previously explained, the rehash delayed work migrates filters from\none region to another. This is done by iterating over all chunks (all\nthe filters with the same priority) in the region and in each chunk\niterating over all the filters.\n\nWhen the work runs out of credits it stores the current chunk and entry\nas markers in the per-work context so that it would know where to resume\nthe migration from the next time the work is scheduled.\n\nUpon error, the chunk marker is reset to NULL, but without resetting the\nentry markers despite being relative to it. This can result in migration\nbeing resumed from an entry that does not belong to the chunk being\nmigrated. In turn, this will eventually lead to a chunk being iterated\nover as if it is an entry. Because of how the two structures happen to\nbe defined, this does not lead to KASAN splats, but to warnings such as\n[1].\n\nFix by creating a helper that resets all the markers and call it from\nall the places the currently only reset the chunk marker. For good\nmeasures also call it when starting a completely new rehash. Add a\nwarning to avoid future cases.\n\n[1]\nWARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0\nModules linked in:\nCPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G W 6.9.0-rc3-custom-00880-g29e61d91b77b #29\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:mlxsw_afk_encode+0x242/0x2f0\n[...]\nCall Trace:\n \u003cTASK\u003e\n mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0\n mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n \u003c/TASK\u003e" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:26:40.282Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/0b88631855026b55cad901ac28d081e0f358e596" }, { "url": "https://git.kernel.org/stable/c/1d76bd2a0034d0d08045c1c6adf2235d88982952" }, { "url": "https://git.kernel.org/stable/c/039992b6d2df097c65f480dcf269de3d2656f573" }, { "url": "https://git.kernel.org/stable/c/751d352858108314efd33dddd5a9a2b6bf7d6916" }, { "url": "https://git.kernel.org/stable/c/e890456051fe8c57944b911defb3e6de91315861" }, { "url": "https://git.kernel.org/stable/c/17e9e0bbae652b9b2049e51699e93dfa60b2988d" }, { "url": "https://git.kernel.org/stable/c/743edc8547a92b6192aa1f1b6bb78233fa21dc9b" } ], "title": "mlxsw: spectrum_acl_tcam: Fix warning during rehash", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-36007", "datePublished": "2024-05-20T09:48:06.947Z", "dateReserved": "2024-05-17T13:50:33.151Z", "dateUpdated": "2024-11-06T15:10:37.319Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26585
Vulnerability from cvelistv5
Published
2024-02-21 14:59
Modified
2024-11-05 09:12
Severity ?
EPSS score ?
Summary
tls: fix race between tx work scheduling and socket close
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-26585", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-28T17:07:29.305466Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-28T17:07:36.266Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:07:19.712Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/196f198ca6fce04ba6ce262f5a0e4d567d7d219d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6db22d6c7a6dc914b12c0469b94eb639b6a8a146" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/tls/tls_sw.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "dd32621f1924", "status": "affected", "version": "a42055e8d2c3", "versionType": "git" }, { "lessThan": "196f198ca6fc", "status": "affected", "version": "a42055e8d2c3", "versionType": "git" }, { "lessThan": "6db22d6c7a6d", "status": "affected", "version": "a42055e8d2c3", "versionType": "git" }, { "lessThan": "e327ed60bff4", "status": "affected", "version": "a42055e8d2c3", "versionType": "git" }, { "lessThan": "e01e3934a1b2", "status": "affected", "version": "a42055e8d2c3", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/tls/tls_sw.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.20" }, { "lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.84", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.18", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.6", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between tx work scheduling and socket close\n\nSimilarly to previous commit, the submitting thread (recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete().\nReorder scheduling the work before calling complete().\nThis seems more logical in the first place, as it\u0027s\nthe inverse order of what the submitting thread will do." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:12:00.824Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/dd32621f19243f89ce830919496a5dcc2158aa33" }, { "url": "https://git.kernel.org/stable/c/196f198ca6fce04ba6ce262f5a0e4d567d7d219d" }, { "url": "https://git.kernel.org/stable/c/6db22d6c7a6dc914b12c0469b94eb639b6a8a146" }, { "url": "https://git.kernel.org/stable/c/e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57" }, { "url": "https://git.kernel.org/stable/c/e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb" } ], "title": "tls: fix race between tx work scheduling and socket close", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26585", "datePublished": "2024-02-21T14:59:13.088Z", "dateReserved": "2024-02-19T14:20:24.125Z", "dateUpdated": "2024-11-05T09:12:00.824Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-1048
Vulnerability from cvelistv5
Published
2024-02-06 17:30
Modified
2024-11-23 03:30
Severity ?
EPSS score ?
Summary
Grub2: grub2-set-bootflag can be abused by local (pseudo-)users
References
▼ | URL | Tags |
---|---|---|
https://access.redhat.com/errata/RHSA-2024:2456 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:3184 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/security/cve/CVE-2024-1048 | vdb-entry, x_refsource_REDHAT | |
https://bugzilla.redhat.com/show_bug.cgi?id=2256827 | issue-tracking, x_refsource_REDHAT | |
https://www.openwall.com/lists/oss-security/2024/02/06/3 |
Impacted products
Vendor | Product | Version | |||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | |||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-1048", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-02-26T20:13:20.423927Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T18:00:34.193Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T18:26:30.341Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/02/06/3" }, { "name": "RHSA-2024:2456", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2456" }, { "name": "RHSA-2024:3184", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:3184" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2024-1048" }, { "name": "RHBZ#2256827", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2256827" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XRZQCVZ3XOASVFT6XLO7F2ZXOLOHIJZQ/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSJAEGRR3XHMBBBKYOVMII4P34IXEYPE/" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20240223-0007/" }, { "tags": [ "x_transferred" ], "url": "https://www.openwall.com/lists/oss-security/2024/02/06/3" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://github.com/rhboot/grub2/", "defaultStatus": "unaffected", "packageName": "grub2", "versions": [ { "changes": [ { "at": "5425919", "status": "unaffected" } ], "lessThan": "*", "status": "unaffected", "version": "0", "versionType": "git" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::baseos" ], "defaultStatus": "affected", "packageName": "grub2", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1:2.02-156.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::baseos" ], "defaultStatus": "affected", "packageName": "grub2", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1:2.06-77.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "unaffected", "packageName": "grub", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unaffected", "packageName": "grub2", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" } ], "credits": [ { "lang": "en", "value": "Red Hat would like to thank Solar Designer (CIQ/Rocky Linux) for reporting this issue." } ], "datePublic": "2024-02-06T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-459", "description": "Incomplete Cleanup", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-23T03:30:38.529Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2024:2456", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2456" }, { "name": "RHSA-2024:3184", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:3184" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2024-1048" }, { "name": "RHBZ#2256827", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2256827" }, { "url": "https://www.openwall.com/lists/oss-security/2024/02/06/3" } ], "timeline": [ { "lang": "en", "time": "2024-01-03T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2024-02-06T00:00:00+00:00", "value": "Made public." } ], "title": "Grub2: grub2-set-bootflag can be abused by local (pseudo-)users", "x_redhatCweChain": "CWE-459: Incomplete Cleanup" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2024-1048", "datePublished": "2024-02-06T17:30:35.360Z", "dateReserved": "2024-01-29T18:42:11.310Z", "dateUpdated": "2024-11-23T03:30:38.529Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52464
Vulnerability from cvelistv5
Published
2024-02-23 14:46
Modified
2024-11-04 14:47
Severity ?
EPSS score ?
Summary
EDAC/thunderx: Fix possible out-of-bounds string access
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-52464", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-02-23T18:16:12.525994Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:24:08.394Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T23:03:19.771Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/71c17ee02538802ceafc830f0736aa35b564e601" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5da3b6e7196f0b4f3728e4e25eb20233a9ddfaf6" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6aa7865ba7ff7f0ede0035180fb3b9400ceb405a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/700cf4bead80fac994dcc43ae1ca5d86d8959b21" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/9dbac9fdae6e3b411fc4c3fca3bf48f70609c398" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e1c86511241588efffaa49556196f09a498d5057" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/426fae93c01dffa379225eb2bd4d3cdc42c6eec5" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/475c58e1a471e9b873e3e39958c64a2d278275c8" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/edac/thunderx_edac.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "71c17ee02538", "status": "affected", "version": "41003396f932", "versionType": "git" }, { "lessThan": "5da3b6e7196f", "status": "affected", "version": "41003396f932", "versionType": "git" }, { "lessThan": "6aa7865ba7ff", "status": "affected", "version": "41003396f932", "versionType": "git" }, { "lessThan": "700cf4bead80", "status": "affected", "version": "41003396f932", "versionType": "git" }, { "lessThan": "9dbac9fdae6e", "status": "affected", "version": "41003396f932", "versionType": "git" }, { "lessThan": "e1c865112415", "status": "affected", "version": "41003396f932", "versionType": "git" }, { "lessThan": "426fae93c01d", "status": "affected", "version": "41003396f932", "versionType": "git" }, { "lessThan": "475c58e1a471", "status": "affected", "version": "41003396f932", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/edac/thunderx_edac.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.12" }, { "lessThan": "4.12", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.306", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.268", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.209", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.148", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.75", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.14", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.2", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/thunderx: Fix possible out-of-bounds string access\n\nEnabling -Wstringop-overflow globally exposes a warning for a common bug\nin the usage of strncat():\n\n drivers/edac/thunderx_edac.c: In function \u0027thunderx_ocx_com_threaded_isr\u0027:\n drivers/edac/thunderx_edac.c:1136:17: error: \u0027strncat\u0027 specified bound 1024 equals destination size [-Werror=stringop-overflow=]\n 1136 | strncat(msg, other, OCX_MESSAGE_SIZE);\n | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n ...\n 1145 | strncat(msg, other, OCX_MESSAGE_SIZE);\n ...\n 1150 | strncat(msg, other, OCX_MESSAGE_SIZE);\n\n ...\n\nApparently the author of this driver expected strncat() to behave the\nway that strlcat() does, which uses the size of the destination buffer\nas its third argument rather than the length of the source buffer. The\nresult is that there is no check on the size of the allocated buffer.\n\nChange it to strlcat().\n\n [ bp: Trim compiler output, fixup commit message. ]" } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:47:18.979Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/71c17ee02538802ceafc830f0736aa35b564e601" }, { "url": "https://git.kernel.org/stable/c/5da3b6e7196f0b4f3728e4e25eb20233a9ddfaf6" }, { "url": "https://git.kernel.org/stable/c/6aa7865ba7ff7f0ede0035180fb3b9400ceb405a" }, { "url": "https://git.kernel.org/stable/c/700cf4bead80fac994dcc43ae1ca5d86d8959b21" }, { "url": "https://git.kernel.org/stable/c/9dbac9fdae6e3b411fc4c3fca3bf48f70609c398" }, { "url": "https://git.kernel.org/stable/c/e1c86511241588efffaa49556196f09a498d5057" }, { "url": "https://git.kernel.org/stable/c/426fae93c01dffa379225eb2bd4d3cdc42c6eec5" }, { "url": "https://git.kernel.org/stable/c/475c58e1a471e9b873e3e39958c64a2d278275c8" } ], "title": "EDAC/thunderx: Fix possible out-of-bounds string access", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52464", "datePublished": "2024-02-23T14:46:24.150Z", "dateReserved": "2024-02-20T12:30:33.296Z", "dateUpdated": "2024-11-04T14:47:18.979Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26584
Vulnerability from cvelistv5
Published
2024-02-21 14:59
Modified
2024-11-05 09:11
Severity ?
EPSS score ?
Summary
net: tls: handle backlogging of crypto requests
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-26584", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-02-26T17:14:36.035758Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-05T17:21:03.401Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:07:19.862Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/3ade391adc584f17b5570fd205de3ad029090368" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/tls/tls_sw.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "3ade391adc58", "status": "affected", "version": "a54667f6728c", "versionType": "git" }, { "lessThan": "cd1bbca03f3c", "status": "affected", "version": "a54667f6728c", "versionType": "git" }, { "lessThan": "13eca403876b", "status": "affected", "version": "a54667f6728c", "versionType": "git" }, { "lessThan": "ab6397f072e5", "status": "affected", "version": "a54667f6728c", "versionType": "git" }, { "lessThan": "859054147318", "status": "affected", "version": "a54667f6728c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/tls/tls_sw.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.16" }, { "lessThan": "4.16", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.160", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.84", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.18", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.6", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: handle backlogging of crypto requests\n\nSince we\u0027re setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our\nrequests to the crypto API, crypto_aead_{encrypt,decrypt} can return\n -EBUSY instead of -EINPROGRESS in valid situations. For example, when\nthe cryptd queue for AESNI is full (easy to trigger with an\nartificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued\nto the backlog but still processed. In that case, the async callback\nwill also be called twice: first with err == -EINPROGRESS, which it\nseems we can just ignore, then with err == 0.\n\nCompared to Sabrina\u0027s original patch this version uses the new\ntls_*crypt_async_wait() helpers and converts the EBUSY to\nEINPROGRESS to avoid having to modify all the error handling\npaths. The handling is identical." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:11:59.718Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/3ade391adc584f17b5570fd205de3ad029090368" }, { "url": "https://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72" }, { "url": "https://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754" }, { "url": "https://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694" }, { "url": "https://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3" } ], "title": "net: tls: handle backlogging of crypto requests", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26584", "datePublished": "2024-02-21T14:59:12.452Z", "dateReserved": "2024-02-19T14:20:24.125Z", "dateUpdated": "2024-11-05T09:11:59.718Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26675
Vulnerability from cvelistv5
Published
2024-04-02 07:01
Modified
2024-11-05 09:13
Severity ?
EPSS score ?
Summary
ppp_async: limit MRU to 64K
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T00:14:12.841Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4fdb14ba89faff6e6969a4dffdc8e54235d6e5ed" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/56fae81633ccee307cfcb032f706bf1863a56982" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b06e067e93fa4b98acfd3a9f38a398ab91bbc58b" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/58fbe665b097bf7b3144da7e7b91fb27aa8d0ae3" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4e2c4846b2507f6dfc9bea72b7567c2693a82a16" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7e5ef49670766c9742ffcd9cead7cdb018268719" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/210d938f963dddc543b07e66a79b7d8d4bd00bd8" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/cb88cb53badb8aeb3955ad6ce80b07b598e310b8" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-26675", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:53:26.335519Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-11T17:33:36.657Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ppp/ppp_async.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "4fdb14ba89fa", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "56fae81633cc", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "b06e067e93fa", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "58fbe665b097", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "4e2c4846b250", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "7e5ef4967076", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "210d938f963d", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "cb88cb53badb", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ppp/ppp_async.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.12" }, { "lessThan": "2.6.12", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.307", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.269", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.210", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.78", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.17", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.5", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp_async: limit MRU to 64K\n\nsyzbot triggered a warning [1] in __alloc_pages():\n\nWARN_ON_ONCE_GFP(order \u003e MAX_PAGE_ORDER, gfp)\n\nWillem fixed a similar issue in commit c0a2a1b0d631 (\"ppp: limit MRU to 64K\")\n\nAdopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)\n\n[1]:\n\n WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\nModules linked in:\nCPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\nWorkqueue: events_unbound flush_to_ldisc\npstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537\nsp : ffff800093967580\nx29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000\nx26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0\nx23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8\nx20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120\nx17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005\nx14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000\nx11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001\nx8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020\nx2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0\nCall trace:\n __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n __alloc_pages_node include/linux/gfp.h:238 [inline]\n alloc_pages_node include/linux/gfp.h:261 [inline]\n __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926\n __do_kmalloc_node mm/slub.c:3969 [inline]\n __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001\n kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590\n __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651\n __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715\n netdev_alloc_skb include/linux/skbuff.h:3235 [inline]\n dev_alloc_skb include/linux/skbuff.h:3248 [inline]\n ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]\n ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341\n tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390\n tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37\n receive_buf drivers/tty/tty_buffer.c:444 [inline]\n flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494\n process_one_work+0x694/0x1204 kernel/workqueue.c:2633\n process_scheduled_works kernel/workqueue.c:2706 [inline]\n worker_thread+0x938/0xef4 kernel/workqueue.c:2787\n kthread+0x288/0x310 kernel/kthread.c:388\n ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:13:40.628Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/4fdb14ba89faff6e6969a4dffdc8e54235d6e5ed" }, { "url": "https://git.kernel.org/stable/c/56fae81633ccee307cfcb032f706bf1863a56982" }, { "url": "https://git.kernel.org/stable/c/b06e067e93fa4b98acfd3a9f38a398ab91bbc58b" }, { "url": "https://git.kernel.org/stable/c/58fbe665b097bf7b3144da7e7b91fb27aa8d0ae3" }, { "url": "https://git.kernel.org/stable/c/4e2c4846b2507f6dfc9bea72b7567c2693a82a16" }, { "url": "https://git.kernel.org/stable/c/7e5ef49670766c9742ffcd9cead7cdb018268719" }, { "url": "https://git.kernel.org/stable/c/210d938f963dddc543b07e66a79b7d8d4bd00bd8" }, { "url": "https://git.kernel.org/stable/c/cb88cb53badb8aeb3955ad6ce80b07b598e310b8" } ], "title": "ppp_async: limit MRU to 64K", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26675", "datePublished": "2024-04-02T07:01:40.054Z", "dateReserved": "2024-02-19T14:20:24.151Z", "dateUpdated": "2024-11-05T09:13:40.628Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26982
Vulnerability from cvelistv5
Published
2024-05-01 05:27
Modified
2024-11-05 09:19
Severity ?
EPSS score ?
Summary
Squashfs: check the inode number is not the invalid value of zero
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T00:21:05.866Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/be383effaee3d89034f0828038f95065b518772e" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7def00ebc9f2d6a581ddf46ce4541f84a10680e5" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/9253c54e01b6505d348afbc02abaa4d9f8a01395" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-26982", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:45:06.926436Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-11T17:33:42.999Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/squashfs/inode.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "be383effaee3", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "7def00ebc9f2", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "9253c54e01b6", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/squashfs/inode.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.30", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check the inode number is not the invalid value of zero\n\nSyskiller has produced an out of bounds access in fill_meta_index().\n\nThat out of bounds access is ultimately caused because the inode\nhas an inode number with the invalid value of zero, which was not checked.\n\nThe reason this causes the out of bounds access is due to following\nsequence of events:\n\n1. Fill_meta_index() is called to allocate (via empty_meta_index())\n and fill a metadata index. It however suffers a data read error\n and aborts, invalidating the newly returned empty metadata index.\n It does this by setting the inode number of the index to zero,\n which means unused (zero is not a valid inode number).\n\n2. When fill_meta_index() is subsequently called again on another\n read operation, locate_meta_index() returns the previous index\n because it matches the inode number of 0. Because this index\n has been returned it is expected to have been filled, and because\n it hasn\u0027t been, an out of bounds access is performed.\n\nThis patch adds a sanity check which checks that the inode number\nis not zero when the inode is created and returns -EINVAL if it is.\n\n[phillip@squashfs.org.uk: whitespace fix]\n Link: https://lkml.kernel.org/r/20240409204723.446925-1-phillip@squashfs.org.uk" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:19:21.524Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/be383effaee3d89034f0828038f95065b518772e" }, { "url": "https://git.kernel.org/stable/c/7def00ebc9f2d6a581ddf46ce4541f84a10680e5" }, { "url": "https://git.kernel.org/stable/c/9253c54e01b6505d348afbc02abaa4d9f8a01395" } ], "title": "Squashfs: check the inode number is not the invalid value of zero", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26982", "datePublished": "2024-05-01T05:27:11.032Z", "dateReserved": "2024-02-19T14:20:24.204Z", "dateUpdated": "2024-11-05T09:19:21.524Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52881
Vulnerability from cvelistv5
Published
2024-05-29 10:15
Modified
2024-11-04 14:54
Severity ?
EPSS score ?
Summary
tcp: do not accept ACK of bytes we never sent
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T23:18:41.169Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/69eae75ca5255e876628ac5cee9eaab31f644b57" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/458f07ffeccd17f99942311e09ef574ddf4a414a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7ffff0cc929fdfc62a74b384c4903d6496c910f0" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b17a886ed29f3b70b78ccf632dad03e0c69e3c1a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fc" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-52881", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-03T16:46:40.495686Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-15T15:11:03.358Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/ipv4/tcp_input.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "69eae75ca525", "status": "affected", "version": "354e4aa391ed", "versionType": "git" }, { "lessThan": "458f07ffeccd", "status": "affected", "version": "354e4aa391ed", "versionType": "git" }, { "lessThan": "7ffff0cc929f", "status": "affected", "version": "354e4aa391ed", "versionType": "git" }, { "lessThan": "b17a886ed29f", "status": "affected", "version": "354e4aa391ed", "versionType": "git" }, { "lessThan": "0d4e0afdd665", "status": "affected", "version": "354e4aa391ed", "versionType": "git" }, { "lessThan": "008b807fe487", "status": "affected", "version": "354e4aa391ed", "versionType": "git" }, { "lessThan": "2087d53a66e9", "status": "affected", "version": "354e4aa391ed", "versionType": "git" }, { "lessThan": "3d501dd326fb", "status": "affected", "version": "354e4aa391ed", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/ipv4/tcp_input.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.8" }, { "lessThan": "3.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.333", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.302", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.264", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.204", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.143", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.68", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.7", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: do not accept ACK of bytes we never sent\n\nThis patch is based on a detailed report and ideas from Yepeng Pan\nand Christian Rossow.\n\nACK seq validation is currently following RFC 5961 5.2 guidelines:\n\n The ACK value is considered acceptable only if\n it is in the range of ((SND.UNA - MAX.SND.WND) \u003c= SEG.ACK \u003c=\n SND.NXT). All incoming segments whose ACK value doesn\u0027t satisfy the\n above condition MUST be discarded and an ACK sent back. It needs to\n be noted that RFC 793 on page 72 (fifth check) says: \"If the ACK is a\n duplicate (SEG.ACK \u003c SND.UNA), it can be ignored. If the ACK\n acknowledges something not yet sent (SEG.ACK \u003e SND.NXT) then send an\n ACK, drop the segment, and return\". The \"ignored\" above implies that\n the processing of the incoming data segment continues, which means\n the ACK value is treated as acceptable. This mitigation makes the\n ACK check more stringent since any ACK \u003c SND.UNA wouldn\u0027t be\n accepted, instead only ACKs that are in the range ((SND.UNA -\n MAX.SND.WND) \u003c= SEG.ACK \u003c= SND.NXT) get through.\n\nThis can be refined for new (and possibly spoofed) flows,\nby not accepting ACK for bytes that were never sent.\n\nThis greatly improves TCP security at a little cost.\n\nI added a Fixes: tag to make sure this patch will reach stable trees,\neven if the \u0027blamed\u0027 patch was adhering to the RFC.\n\ntp-\u003ebytes_acked was added in linux-4.2\n\nFollowing packetdrill test (courtesy of Yepeng Pan) shows\nthe issue at hand:\n\n0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3\n+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0\n+0 bind(3, ..., ...) = 0\n+0 listen(3, 1024) = 0\n\n// ---------------- Handshake ------------------- //\n\n// when window scale is set to 14 the window size can be extended to\n// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet\n// with ack number in (Server_ISN+1-1073725440. Server_ISN+1)\n// ,though this ack number acknowledges some data never\n// sent by the server.\n\n+0 \u003c S 0:0(0) win 65535 \u003cmss 1400,nop,wscale 14\u003e\n+0 \u003e S. 0:0(0) ack 1 \u003c...\u003e\n+0 \u003c . 1:1(0) ack 1 win 65535\n+0 accept(3, ..., ...) = 4\n\n// For the established connection, we send an ACK packet,\n// the ack packet uses ack number 1 - 1073725300 + 2^32,\n// where 2^32 is used to wrap around.\n// Note: we used 1073725300 instead of 1073725440 to avoid possible\n// edge cases.\n// 1 - 1073725300 + 2^32 = 3221241997\n\n// Oops, old kernels happily accept this packet.\n+0 \u003c . 1:1001(1000) ack 3221241997 win 65535\n\n// After the kernel fix the following will be replaced by a challenge ACK,\n// and prior malicious frame would be dropped.\n+0 \u003e . 1:1(0) ack 1001" } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:54:29.605Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/69eae75ca5255e876628ac5cee9eaab31f644b57" }, { "url": "https://git.kernel.org/stable/c/458f07ffeccd17f99942311e09ef574ddf4a414a" }, { "url": "https://git.kernel.org/stable/c/7ffff0cc929fdfc62a74b384c4903d6496c910f0" }, { "url": "https://git.kernel.org/stable/c/b17a886ed29f3b70b78ccf632dad03e0c69e3c1a" }, { "url": "https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fc" }, { "url": "https://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440" }, { "url": "https://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757" }, { "url": "https://git.kernel.org/stable/c/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27" } ], "title": "tcp: do not accept ACK of bytes we never sent", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52881", "datePublished": "2024-05-29T10:15:14.186Z", "dateReserved": "2024-05-21T15:35:00.781Z", "dateUpdated": "2024-11-04T14:54:29.605Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26907
Vulnerability from cvelistv5
Published
2024-04-17 10:27
Modified
2024-11-05 09:17
Severity ?
EPSS score ?
Summary
RDMA/mlx5: Fix fortify source warning while accessing Eth segment
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T00:21:05.937Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/d27c48dc309da72c3b46351a1205d89687272baa" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/60ba938a8bc8c90e724c75f98e932f9fb7ae1b9d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/cad82f1671e41094acd3b9a60cd27d67a3c64a21" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/9a624a5f95733bac4648ecadb320ca83aa9c08fd" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/185fa07000e0a81d54cf8c05414cebff14469a5c" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4d5e86a56615cc387d21c629f9af8fb0e958d350" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" }, { "affected": [ { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "d27c48dc309d", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "5.11", "status": "unaffected", "version": "5.10.214", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "6.2", "status": "unaffected", "version": "6.183", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "6.7", "status": "unaffected", "version": "6.623", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "6.8", "status": "unaffected", "version": "6.711", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "5.16", "status": "unaffected", "version": "5.15.153", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "60ba938a8bc8", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" }, { "lessThanOrEqual": "cad82f1671e4", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" }, { "lessThanOrEqual": "9a624a5f9573", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" }, { "lessThanOrEqual": "185fa07000e0", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" }, { "lessThanOrEqual": "4d5e86a56615", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-26907", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-08-08T17:37:09.309309Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-08-08T17:55:29.365Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/infiniband/hw/mlx5/wr.c", "include/linux/mlx5/qp.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "d27c48dc309d", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "60ba938a8bc8", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "cad82f1671e4", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "9a624a5f9573", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "185fa07000e0", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "4d5e86a56615", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/infiniband/hw/mlx5/wr.c", "include/linux/mlx5/qp.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.214", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.153", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.83", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.23", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.11", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix fortify source warning while accessing Eth segment\n\n ------------[ cut here ]------------\n memcpy: detected field-spanning write (size 56) of single field \"eseg-\u003einline_hdr.start\" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2)\n WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy\n [last unloaded: mlx_compat(OE)]\n CPU: 0 PID: 293779 Comm: ssh Tainted: G OE 6.2.0-32-generic #32~22.04.1-Ubuntu\n Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da \u003c0f\u003e 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7\n RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046\n RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8\n R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80\n FS: 00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n \u003cTASK\u003e\n ? show_regs+0x72/0x90\n ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n ? __warn+0x8d/0x160\n ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n ? report_bug+0x1bb/0x1d0\n ? handle_bug+0x46/0x90\n ? exc_invalid_op+0x19/0x80\n ? asm_exc_invalid_op+0x1b/0x20\n ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib]\n ipoib_send+0x2ec/0x770 [ib_ipoib]\n ipoib_start_xmit+0x5a0/0x770 [ib_ipoib]\n dev_hard_start_xmit+0x8e/0x1e0\n ? validate_xmit_skb_list+0x4d/0x80\n sch_direct_xmit+0x116/0x3a0\n __dev_xmit_skb+0x1fd/0x580\n __dev_queue_xmit+0x284/0x6b0\n ? _raw_spin_unlock_irq+0xe/0x50\n ? __flush_work.isra.0+0x20d/0x370\n ? push_pseudo_header+0x17/0x40 [ib_ipoib]\n neigh_connected_output+0xcd/0x110\n ip_finish_output2+0x179/0x480\n ? __smp_call_single_queue+0x61/0xa0\n __ip_finish_output+0xc3/0x190\n ip_finish_output+0x2e/0xf0\n ip_output+0x78/0x110\n ? __pfx_ip_finish_output+0x10/0x10\n ip_local_out+0x64/0x70\n __ip_queue_xmit+0x18a/0x460\n ip_queue_xmit+0x15/0x30\n __tcp_transmit_skb+0x914/0x9c0\n tcp_write_xmit+0x334/0x8d0\n tcp_push_one+0x3c/0x60\n tcp_sendmsg_locked+0x2e1/0xac0\n tcp_sendmsg+0x2d/0x50\n inet_sendmsg+0x43/0x90\n sock_sendmsg+0x68/0x80\n sock_write_iter+0x93/0x100\n vfs_write+0x326/0x3c0\n ksys_write+0xbd/0xf0\n ? do_syscall_64+0x69/0x90\n __x64_sys_write+0x19/0x30\n do_syscall_\n---truncated---" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:17:58.753Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/d27c48dc309da72c3b46351a1205d89687272baa" }, { "url": "https://git.kernel.org/stable/c/60ba938a8bc8c90e724c75f98e932f9fb7ae1b9d" }, { "url": "https://git.kernel.org/stable/c/cad82f1671e41094acd3b9a60cd27d67a3c64a21" }, { "url": "https://git.kernel.org/stable/c/9a624a5f95733bac4648ecadb320ca83aa9c08fd" }, { "url": "https://git.kernel.org/stable/c/185fa07000e0a81d54cf8c05414cebff14469a5c" }, { "url": "https://git.kernel.org/stable/c/4d5e86a56615cc387d21c629f9af8fb0e958d350" } ], "title": "RDMA/mlx5: Fix fortify source warning while accessing Eth segment", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26907", "datePublished": "2024-04-17T10:27:54.194Z", "dateReserved": "2024-02-19T14:20:24.187Z", "dateUpdated": "2024-11-05T09:17:58.753Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-5564
Vulnerability from cvelistv5
Published
2024-05-31 18:31
Modified
2024-11-24 17:48
Severity ?
EPSS score ?
Summary
Libndp: buffer overflow in route information length field
References
▼ | URL | Tags |
---|---|---|
https://access.redhat.com/errata/RHSA-2024:4618 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:4619 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:4620 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:4622 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:4636 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:4640 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:4641 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:4642 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:4643 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/security/cve/CVE-2024-5564 | vdb-entry, x_refsource_REDHAT | |
https://bugzilla.redhat.com/show_bug.cgi?id=2284122 | issue-tracking, x_refsource_REDHAT |
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support |
Unaffected: 0:1.2-10.el7_9 < * cpe:/o:redhat:rhel_els:7 |
||||||||||||||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-5564", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-05-31T20:17:36.331326Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T18:02:43.761Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T21:18:06.467Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2024:4618", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4618" }, { "name": "RHSA-2024:4619", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4619" }, { "name": "RHSA-2024:4620", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4620" }, { "name": "RHSA-2024:4622", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4622" }, { "name": "RHSA-2024:4636", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4636" }, { "name": "RHSA-2024:4640", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4640" }, { "name": "RHSA-2024:4641", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4641" }, { "name": "RHSA-2024:4642", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4642" }, { "name": "RHSA-2024:4643", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:4643" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2024-5564" }, { "name": "RHBZ#2284122", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284122" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00011.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_els:7" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.2-10.el7_9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.7-7.el8_10", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_aus:8.2::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.7-4.el8_2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_tus:8.4::baseos", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_e4s:8.4::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.7-6.el8_4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_tus:8.4::baseos", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_e4s:8.4::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.7-6.el8_4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_tus:8.4::baseos", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_e4s:8.4::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.7-6.el8_4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos", "cpe:/o:redhat:rhel_aus:8.6::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.7-7.el8_6", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos", "cpe:/o:redhat:rhel_aus:8.6::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.7-7.el8_6", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos", "cpe:/o:redhat:rhel_aus:8.6::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.7-7.el8_6", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_eus:8.8::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 8.8 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.7-7.el8_8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.8-6.el9_4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_e4s:9.0::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.8-5.el9_0", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_eus:9.2::baseos" ], "defaultStatus": "affected", "packageName": "libndp", "product": "Red Hat Enterprise Linux 9.2 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.8-5.el9_2", "versionType": "rpm" } ] } ], "credits": [ { "lang": "en", "value": "Upstream acknowledges Evgeny Vereshchagin as the original reporter." } ], "datePublic": "2024-05-31T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route length information." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-120", "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-24T17:48:18.476Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2024:4618", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4618" }, { "name": "RHSA-2024:4619", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4619" }, { "name": "RHSA-2024:4620", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4620" }, { "name": "RHSA-2024:4622", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4622" }, { "name": "RHSA-2024:4636", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4636" }, { "name": "RHSA-2024:4640", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4640" }, { "name": "RHSA-2024:4641", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4641" }, { "name": "RHSA-2024:4642", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4642" }, { "name": "RHSA-2024:4643", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:4643" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2024-5564" }, { "name": "RHBZ#2284122", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284122" } ], "timeline": [ { "lang": "en", "time": "2024-05-31T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2024-05-31T00:00:00+00:00", "value": "Made public." } ], "title": "Libndp: buffer overflow in route information length field", "workarounds": [ { "lang": "en", "value": "Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available." } ], "x_redhatCweChain": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2024-5564", "datePublished": "2024-05-31T18:31:47.333Z", "dateReserved": "2024-05-31T13:34:41.061Z", "dateUpdated": "2024-11-24T17:48:18.476Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-46909
Vulnerability from cvelistv5
Published
2024-02-27 06:53
Modified
2024-11-04 11:55
Severity ?
EPSS score ?
Summary
ARM: footbridge: fix PCI interrupt mapping
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2021-46909", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-03-05T22:33:27.334758Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:13:15.270Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T05:17:42.879Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/532747fd5c7aaa17ee5cf79f3e947c31eb0e35cf" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2643da6aa57920d9159a1a579fb04f89a2b0d29a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/871b569a3e67f570df9f5ba195444dc7c621293b" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1fc087fdb98d556b416c82ed6e3964a30885f47a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c3efce8cc9807339633ee30e39882f4c8626ee1d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/30e3b4f256b4e366a61658c294f6a21b8626dda7" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/arm/mach-footbridge/cats-pci.c", "arch/arm/mach-footbridge/ebsa285-pci.c", "arch/arm/mach-footbridge/netwinder-pci.c", "arch/arm/mach-footbridge/personal-pci.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "532747fd5c7a", "status": "affected", "version": "30fdfb929e82", "versionType": "git" }, { "lessThan": "2643da6aa579", "status": "affected", "version": "30fdfb929e82", "versionType": "git" }, { "lessThan": "871b569a3e67", "status": "affected", "version": "30fdfb929e82", "versionType": "git" }, { "lessThan": "1fc087fdb98d", "status": "affected", "version": "30fdfb929e82", "versionType": "git" }, { "lessThan": "c3efce8cc980", "status": "affected", "version": "30fdfb929e82", "versionType": "git" }, { "lessThan": "30e3b4f256b4", "status": "affected", "version": "30fdfb929e82", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/arm/mach-footbridge/cats-pci.c", "arch/arm/mach-footbridge/ebsa285-pci.c", "arch/arm/mach-footbridge/netwinder-pci.c", "arch/arm/mach-footbridge/personal-pci.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.13" }, { "lessThan": "4.13", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.232", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.189", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.114", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.32", "versionType": "semver" }, { "lessThanOrEqual": "5.11.*", "status": "unaffected", "version": "5.11.16", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.12", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: footbridge: fix PCI interrupt mapping\n\nSince commit 30fdfb929e82 (\"PCI: Add a call to pci_assign_irq() in\npci_device_probe()\"), the PCI code will call the IRQ mapping function\nwhenever a PCI driver is probed. If these are marked as __init, this\ncauses an oops if a PCI driver is loaded or bound after the kernel has\ninitialised." } ], "providerMetadata": { "dateUpdated": "2024-11-04T11:55:41.003Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/532747fd5c7aaa17ee5cf79f3e947c31eb0e35cf" }, { "url": "https://git.kernel.org/stable/c/2643da6aa57920d9159a1a579fb04f89a2b0d29a" }, { "url": "https://git.kernel.org/stable/c/871b569a3e67f570df9f5ba195444dc7c621293b" }, { "url": "https://git.kernel.org/stable/c/1fc087fdb98d556b416c82ed6e3964a30885f47a" }, { "url": "https://git.kernel.org/stable/c/c3efce8cc9807339633ee30e39882f4c8626ee1d" }, { "url": "https://git.kernel.org/stable/c/30e3b4f256b4e366a61658c294f6a21b8626dda7" } ], "title": "ARM: footbridge: fix PCI interrupt mapping", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-46909", "datePublished": "2024-02-27T06:53:50.181Z", "dateReserved": "2024-02-25T13:45:52.718Z", "dateUpdated": "2024-11-04T11:55:41.003Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-47356
Vulnerability from cvelistv5
Published
2024-05-21 14:35
Modified
2024-11-04 12:04
Severity ?
EPSS score ?
Summary
mISDN: fix possible use-after-free in HFC_cleanup()
References
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "49331c07ef0f ", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": " 54ff32029289 ", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "7867ddc5f3de ", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "5f2818185da0 ", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "3ecd228c636e ", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "b7ee9ae1e0cf ", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "61370ff07e0a ", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": " ed7c3739d0a0 ", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "009fc857c5f6 ", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "4.4.* ", "status": "unaffected", "version": "4.4.276 ", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.276 ", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": " 4.14.240", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "4.19.* ", "status": "unaffected", "version": "4.19.198", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.133 ", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.51", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.18", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "5.13.*", "status": "unaffected", "version": " 5.13.3", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "5.14" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2021-47356", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-28T18:08:17.352199Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:13:31.862Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T05:32:08.504Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/49331c07ef0f8fdfa42b30ba6a83a657b29d7fbe" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/54ff3202928952a100c477248e65ac6db01258a7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7867ddc5f3de7f289aee63233afc0df4b62834c5" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5f2818185da0fe82a932f0856633038b66faf124" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/3ecd228c636ee17c14662729737fa07242a93cb0" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b7ee9ae1e0cf55a037c4a99af2acc5d78cb7802d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/61370ff07e0acc657559a8fac02551dfeb9d3020" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ed7c3739d0a07e2ec3ccbffe7e93cea01c438cda" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/009fc857c5f6fda81f2f7dd851b2d54193a8e733" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/isdn/hardware/mISDN/hfcpci.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "49331c07ef0f", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "54ff32029289", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "7867ddc5f3de", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "5f2818185da0", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "3ecd228c636e", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "b7ee9ae1e0cf", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "61370ff07e0a", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "ed7c3739d0a0", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "009fc857c5f6", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/isdn/hardware/mISDN/hfcpci.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.4.*", "status": "unaffected", "version": "4.4.276", "versionType": "semver" }, { "lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.276", "versionType": "semver" }, { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.240", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.198", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.133", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.51", "versionType": "semver" }, { "lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.18", "versionType": "semver" }, { "lessThanOrEqual": "5.13.*", "status": "unaffected", "version": "5.13.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.14", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: fix possible use-after-free in HFC_cleanup()\n\nThis module\u0027s remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver\u0027s remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself." } ], "providerMetadata": { "dateUpdated": "2024-11-04T12:04:21.025Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/49331c07ef0f8fdfa42b30ba6a83a657b29d7fbe" }, { "url": "https://git.kernel.org/stable/c/54ff3202928952a100c477248e65ac6db01258a7" }, { "url": "https://git.kernel.org/stable/c/7867ddc5f3de7f289aee63233afc0df4b62834c5" }, { "url": "https://git.kernel.org/stable/c/5f2818185da0fe82a932f0856633038b66faf124" }, { "url": "https://git.kernel.org/stable/c/3ecd228c636ee17c14662729737fa07242a93cb0" }, { "url": "https://git.kernel.org/stable/c/b7ee9ae1e0cf55a037c4a99af2acc5d78cb7802d" }, { "url": "https://git.kernel.org/stable/c/61370ff07e0acc657559a8fac02551dfeb9d3020" }, { "url": "https://git.kernel.org/stable/c/ed7c3739d0a07e2ec3ccbffe7e93cea01c438cda" }, { "url": "https://git.kernel.org/stable/c/009fc857c5f6fda81f2f7dd851b2d54193a8e733" } ], "title": "mISDN: fix possible use-after-free in HFC_cleanup()", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-47356", "datePublished": "2024-05-21T14:35:59.097Z", "dateReserved": "2024-05-21T14:28:16.987Z", "dateUpdated": "2024-11-04T12:04:21.025Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52667
Vulnerability from cvelistv5
Published
2024-05-17 14:01
Modified
2024-11-04 14:50
Severity ?
EPSS score ?
Summary
net/mlx5e: fix a potential double-free in fs_any_create_groups
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T23:11:34.566Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/72a729868592752b5a294d27453da264106983b1" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b2fa86b2aceb4bc9ada51cea90f61546d7512cbe" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2897c981ee63e1be5e530b1042484626a10b26d8" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/65a4ade8a6d205979292e88beeb6a626ddbd4779" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/aef855df7e1bbd5aa4484851561211500b22707e" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-52667", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:42:12.540016Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-11T17:32:50.865Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "72a729868592", "status": "affected", "version": "0f575c20bf06", "versionType": "git" }, { "lessThan": "b2fa86b2aceb", "status": "affected", "version": "0f575c20bf06", "versionType": "git" }, { "lessThan": "2897c981ee63", "status": "affected", "version": "0f575c20bf06", "versionType": "git" }, { "lessThan": "65a4ade8a6d2", "status": "affected", "version": "0f575c20bf06", "versionType": "git" }, { "lessThan": "aef855df7e1b", "status": "affected", "version": "0f575c20bf06", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.13" }, { "lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.76", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.15", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix a potential double-free in fs_any_create_groups\n\nWhen kcalloc() for ft-\u003eg succeeds but kvzalloc() for in fails,\nfs_any_create_groups() will free ft-\u003eg. However, its caller\nfs_any_create_table() will free ft-\u003eg again through calling\nmlx5e_destroy_flow_table(), which will lead to a double-free.\nFix this by setting ft-\u003eg to NULL in fs_any_create_groups()." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:50:45.107Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/72a729868592752b5a294d27453da264106983b1" }, { "url": "https://git.kernel.org/stable/c/b2fa86b2aceb4bc9ada51cea90f61546d7512cbe" }, { "url": "https://git.kernel.org/stable/c/2897c981ee63e1be5e530b1042484626a10b26d8" }, { "url": "https://git.kernel.org/stable/c/65a4ade8a6d205979292e88beeb6a626ddbd4779" }, { "url": "https://git.kernel.org/stable/c/aef855df7e1bbd5aa4484851561211500b22707e" } ], "title": "net/mlx5e: fix a potential double-free in fs_any_create_groups", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52667", "datePublished": "2024-05-17T14:01:48.454Z", "dateReserved": "2024-03-07T14:49:46.885Z", "dateUpdated": "2024-11-04T14:50:45.107Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-27397
Vulnerability from cvelistv5
Published
2024-05-09 16:37
Modified
2024-11-05 09:21
Severity ?
EPSS score ?
Summary
netfilter: nf_tables: use timestamp to check for set element timeout
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-27397", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-17T17:39:42.529200Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-17T17:44:15.867Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:34:52.250Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b45176b869673417ace338b87cf9cdb66e2eeb01" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/383182db8d58c4237772ba0764cded4938a235c3" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7395dfacfff65e9938ac0889dafa1ab01e987d15" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "include/net/netfilter/nf_tables.h", "net/netfilter/nf_tables_api.c", "net/netfilter/nft_set_hash.c", "net/netfilter/nft_set_pipapo.c", "net/netfilter/nft_set_rbtree.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "f8dfda798650", "status": "affected", "version": "c3e1b005ed1c", "versionType": "git" }, { "lessThan": "eaf1a29ea5d7", "status": "affected", "version": "c3e1b005ed1c", "versionType": "git" }, { "lessThan": "7b17de2a71e5", "status": "affected", "version": "c3e1b005ed1c", "versionType": "git" }, { "lessThan": "0d40e8cb1d1f", "status": "affected", "version": "c3e1b005ed1c", "versionType": "git" }, { "lessThan": "b45176b86967", "status": "affected", "version": "c3e1b005ed1c", "versionType": "git" }, { "lessThan": "383182db8d58", "status": "affected", "version": "c3e1b005ed1c", "versionType": "git" }, { "lessThan": "7395dfacfff6", "status": "affected", "version": "c3e1b005ed1c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "include/net/netfilter/nf_tables.h", "net/netfilter/nf_tables_api.c", "net/netfilter/nft_set_hash.c", "net/netfilter/nft_set_pipapo.c", "net/netfilter/nft_set_rbtree.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.1" }, { "lessThan": "4.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.97", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.5", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: use timestamp to check for set element timeout\n\nAdd a timestamp field at the beginning of the transaction, store it\nin the nftables per-netns area.\n\nUpdate set backend .insert, .deactivate and sync gc path to use the\ntimestamp, this avoids that an element expires while control plane\ntransaction is still unfinished.\n\n.lookup and .update, which are used from packet path, still use the\ncurrent time to check if the element has expired. And .get path and dump\nalso since this runs lockless under rcu read size lock. Then, there is\nasync gc which also needs to check the current time since it runs\nasynchronously from a workqueue." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:21:27.953Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/f8dfda798650241c1692058713ca4fef8e429061" }, { "url": "https://git.kernel.org/stable/c/eaf1a29ea5d7dba8e84e9e9f3b3f47d0cd540bfe" }, { "url": "https://git.kernel.org/stable/c/7b17de2a71e56c10335b565cc7ad238e6d984379" }, { "url": "https://git.kernel.org/stable/c/0d40e8cb1d1f56a994cdd2e015af622fdca9ed4d" }, { "url": "https://git.kernel.org/stable/c/b45176b869673417ace338b87cf9cdb66e2eeb01" }, { "url": "https://git.kernel.org/stable/c/383182db8d58c4237772ba0764cded4938a235c3" }, { "url": "https://git.kernel.org/stable/c/7395dfacfff65e9938ac0889dafa1ab01e987d15" } ], "title": "netfilter: nf_tables: use timestamp to check for set element timeout", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-27397", "datePublished": "2024-05-09T16:37:22.463Z", "dateReserved": "2024-02-25T13:47:42.677Z", "dateUpdated": "2024-11-05T09:21:27.953Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52700
Vulnerability from cvelistv5
Published
2024-05-21 15:22
Modified
2024-11-06 14:28
Severity ?
EPSS score ?
Summary
tipc: fix kernel warning when sending SYN message
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2023-52700", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-18T14:38:23.667896Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-06T14:28:36.244Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T23:11:35.606Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/54b6082aec178f16ad6d193b4ecdc9c4823d9a32" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/11a4d6f67cf55883dc78e31c247d1903ed7feccc" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/tipc/socket.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "54b6082aec17", "status": "affected", "version": "f25dcc7687d4", "versionType": "git" }, { "lessThan": "11a4d6f67cf5", "status": "affected", "version": "f25dcc7687d4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/tipc/socket.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.0" }, { "lessThan": "4.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.13", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.2", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix kernel warning when sending SYN message\n\nWhen sending a SYN message, this kernel stack trace is observed:\n\n...\n[ 13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550\n...\n[ 13.398494] Call Trace:\n[ 13.398630] \u003cTASK\u003e\n[ 13.398630] ? __alloc_skb+0xed/0x1a0\n[ 13.398630] tipc_msg_build+0x12c/0x670 [tipc]\n[ 13.398630] ? shmem_add_to_page_cache.isra.71+0x151/0x290\n[ 13.398630] __tipc_sendmsg+0x2d1/0x710 [tipc]\n[ 13.398630] ? tipc_connect+0x1d9/0x230 [tipc]\n[ 13.398630] ? __local_bh_enable_ip+0x37/0x80\n[ 13.398630] tipc_connect+0x1d9/0x230 [tipc]\n[ 13.398630] ? __sys_connect+0x9f/0xd0\n[ 13.398630] __sys_connect+0x9f/0xd0\n[ 13.398630] ? preempt_count_add+0x4d/0xa0\n[ 13.398630] ? fpregs_assert_state_consistent+0x22/0x50\n[ 13.398630] __x64_sys_connect+0x16/0x20\n[ 13.398630] do_syscall_64+0x42/0x90\n[ 13.398630] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nIt is because commit a41dad905e5a (\"iov_iter: saner checks for attempt\nto copy to/from iterator\") has introduced sanity check for copying\nfrom/to iov iterator. Lacking of copy direction from the iterator\nviewpoint would lead to kernel stack trace like above.\n\nThis commit fixes this issue by initializing the iov iterator with\nthe correct copy direction when sending SYN or ACK without data." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:51:23.410Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/54b6082aec178f16ad6d193b4ecdc9c4823d9a32" }, { "url": "https://git.kernel.org/stable/c/11a4d6f67cf55883dc78e31c247d1903ed7feccc" } ], "title": "tipc: fix kernel warning when sending SYN message", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52700", "datePublished": "2024-05-21T15:22:50.702Z", "dateReserved": "2024-03-07T14:49:46.891Z", "dateUpdated": "2024-11-06T14:28:36.244Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52626
Vulnerability from cvelistv5
Published
2024-03-26 17:49
Modified
2024-11-04 14:49
Severity ?
EPSS score ?
Summary
net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T23:03:21.274Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/40e0d0746390c5b0c31144f4f1688d72f3f8d790" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/33cdeae8c6fb58cc445f859b67c014dc9f60b4e0" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/3876638b2c7ebb2c9d181de1191db0de8cac143a" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-52626", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:54:09.330337Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-11T17:33:43.784Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "40e0d0746390", "status": "affected", "version": "e5d30f7da357", "versionType": "git" }, { "lessThan": "33cdeae8c6fb", "status": "affected", "version": "92214be5979c", "versionType": "git" }, { "lessThan": "3876638b2c7e", "status": "affected", "version": "92214be5979c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.7" }, { "lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.15", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix operation precedence bug in port timestamping napi_poll context\n\nIndirection (*) is of lower precedence than postfix increment (++). Logic\nin napi_poll context would cause an out-of-bound read by first increment\nthe pointer address by byte address space and then dereference the value.\nRather, the intended logic was to dereference first and then increment the\nunderlying value." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:49:58.841Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/40e0d0746390c5b0c31144f4f1688d72f3f8d790" }, { "url": "https://git.kernel.org/stable/c/33cdeae8c6fb58cc445f859b67c014dc9f60b4e0" }, { "url": "https://git.kernel.org/stable/c/3876638b2c7ebb2c9d181de1191db0de8cac143a" } ], "title": "net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52626", "datePublished": "2024-03-26T17:49:59.220Z", "dateReserved": "2024-03-06T09:52:12.090Z", "dateUpdated": "2024-11-04T14:49:58.841Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-47456
Vulnerability from cvelistv5
Published
2024-05-22 06:19
Modified
2024-11-04 12:06
Severity ?
EPSS score ?
Summary
can: peak_pci: peak_pci_remove(): fix UAF
References
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "affected", "version": "e6d9c80b7ca1" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "affected", "version": "3.4" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "0" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "4.4.290" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "4.9.288" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "4.14.253" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "4.19.214" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "5.4.156" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "5.10.76" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "5.14.15" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "5.15" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2021-47456", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-05-22T14:47:53.013850Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-467", "description": "CWE-467 Use of sizeof() on a Pointer Type", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:15:08.225Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T05:39:59.411Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1c616528ba4aeb1125a06b407572ab7b56acae38" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/447d44cd2f67a20b596ede3ca3cd67086dfd9ca9" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/34914971bb3244db4ce2be44e9438a9b30c56250" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/adbda14730aacce41c0d3596415aa39ad63eafd9" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1248582e47a9f7ce0ecd156c39fc61f8b6aa3699" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/28f28e4bc3a5e0051faa963f10b778ab38c1db69" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0e5afdc2315b0737edcf55bede4ee1640d2d464d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/949fe9b35570361bc6ee2652f89a0561b26eec98" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/can/sja1000/peak_pci.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "1c616528ba4a", "status": "affected", "version": "e6d9c80b7ca1", "versionType": "git" }, { "lessThan": "447d44cd2f67", "status": "affected", "version": "e6d9c80b7ca1", "versionType": "git" }, { "lessThan": "34914971bb32", "status": "affected", "version": "e6d9c80b7ca1", "versionType": "git" }, { "lessThan": "adbda14730aa", "status": "affected", "version": "e6d9c80b7ca1", "versionType": "git" }, { "lessThan": "1248582e47a9", "status": "affected", "version": "e6d9c80b7ca1", "versionType": "git" }, { "lessThan": "28f28e4bc3a5", "status": "affected", "version": "e6d9c80b7ca1", "versionType": "git" }, { "lessThan": "0e5afdc2315b", "status": "affected", "version": "e6d9c80b7ca1", "versionType": "git" }, { "lessThan": "949fe9b35570", "status": "affected", "version": "e6d9c80b7ca1", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/can/sja1000/peak_pci.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.4" }, { "lessThan": "3.4", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.4.*", "status": "unaffected", "version": "4.4.290", "versionType": "semver" }, { "lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.288", "versionType": "semver" }, { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.253", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.214", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.156", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.76", "versionType": "semver" }, { "lessThanOrEqual": "5.14.*", "status": "unaffected", "version": "5.14.15", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_pci: peak_pci_remove(): fix UAF\n\nWhen remove the module peek_pci, referencing \u0027chan\u0027 again after\nreleasing \u0027dev\u0027 will cause UAF.\n\nFix this by releasing \u0027dev\u0027 later.\n\nThe following log reveals it:\n\n[ 35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci]\n[ 35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537\n[ 35.965513 ] Call Trace:\n[ 35.965718 ] dump_stack_lvl+0xa8/0xd1\n[ 35.966028 ] print_address_description+0x87/0x3b0\n[ 35.966420 ] kasan_report+0x172/0x1c0\n[ 35.966725 ] ? peak_pci_remove+0x16f/0x270 [peak_pci]\n[ 35.967137 ] ? trace_irq_enable_rcuidle+0x10/0x170\n[ 35.967529 ] ? peak_pci_remove+0x16f/0x270 [peak_pci]\n[ 35.967945 ] __asan_report_load8_noabort+0x14/0x20\n[ 35.968346 ] peak_pci_remove+0x16f/0x270 [peak_pci]\n[ 35.968752 ] pci_device_remove+0xa9/0x250" } ], "providerMetadata": { "dateUpdated": "2024-11-04T12:06:17.867Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/1c616528ba4aeb1125a06b407572ab7b56acae38" }, { "url": "https://git.kernel.org/stable/c/447d44cd2f67a20b596ede3ca3cd67086dfd9ca9" }, { "url": "https://git.kernel.org/stable/c/34914971bb3244db4ce2be44e9438a9b30c56250" }, { "url": "https://git.kernel.org/stable/c/adbda14730aacce41c0d3596415aa39ad63eafd9" }, { "url": "https://git.kernel.org/stable/c/1248582e47a9f7ce0ecd156c39fc61f8b6aa3699" }, { "url": "https://git.kernel.org/stable/c/28f28e4bc3a5e0051faa963f10b778ab38c1db69" }, { "url": "https://git.kernel.org/stable/c/0e5afdc2315b0737edcf55bede4ee1640d2d464d" }, { "url": "https://git.kernel.org/stable/c/949fe9b35570361bc6ee2652f89a0561b26eec98" } ], "title": "can: peak_pci: peak_pci_remove(): fix UAF", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-47456", "datePublished": "2024-05-22T06:19:45.363Z", "dateReserved": "2024-05-21T14:58:30.833Z", "dateUpdated": "2024-11-04T12:06:17.867Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52686
Vulnerability from cvelistv5
Published
2024-05-17 14:24
Modified
2024-11-04 14:51
Severity ?
EPSS score ?
Summary
powerpc/powernv: Add a null pointer check in opal_event_init()
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T23:11:35.663Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8422d179cf46889c15ceff9ede48c5bfa4e7f0b4" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e93d7cf4c1ddbcd846739e7ad849f955a4f18031" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e6ad05e3ae9c84c5a71d7bb2d44dc845ae7990cf" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c0b111ea786ddcc8be0682612830796ece9436c7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/9a523e1da6d88c2034f946adfa4f74b236c95ca9" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a14c55eb461d630b836f80591d8caf1f74e62877" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e08c2e275fa1874de945b87093f925997722ee42" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8649829a1dd25199bbf557b2621cedb4bf9b3050" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-52686", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:42:02.769590Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-11T17:33:19.230Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/powerpc/platforms/powernv/opal-irqchip.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "8422d179cf46", "status": "affected", "version": "2717a33d6074", "versionType": "git" }, { "lessThan": "e93d7cf4c1dd", "status": "affected", "version": "2717a33d6074", "versionType": "git" }, { "lessThan": "e6ad05e3ae9c", "status": "affected", "version": "2717a33d6074", "versionType": "git" }, { "lessThan": "c0b111ea786d", "status": "affected", "version": "2717a33d6074", "versionType": "git" }, { "lessThan": "9a523e1da6d8", "status": "affected", "version": "2717a33d6074", "versionType": "git" }, { "lessThan": "a14c55eb461d", "status": "affected", "version": "2717a33d6074", "versionType": "git" }, { "lessThan": "e08c2e275fa1", "status": "affected", "version": "2717a33d6074", "versionType": "git" }, { "lessThan": "8649829a1dd2", "status": "affected", "version": "2717a33d6074", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/powerpc/platforms/powernv/opal-irqchip.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.11" }, { "lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.306", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.268", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.209", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.148", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.75", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.14", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.2", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/powernv: Add a null pointer check in opal_event_init()\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:51:06.257Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/8422d179cf46889c15ceff9ede48c5bfa4e7f0b4" }, { "url": "https://git.kernel.org/stable/c/e93d7cf4c1ddbcd846739e7ad849f955a4f18031" }, { "url": "https://git.kernel.org/stable/c/e6ad05e3ae9c84c5a71d7bb2d44dc845ae7990cf" }, { "url": "https://git.kernel.org/stable/c/c0b111ea786ddcc8be0682612830796ece9436c7" }, { "url": "https://git.kernel.org/stable/c/9a523e1da6d88c2034f946adfa4f74b236c95ca9" }, { "url": "https://git.kernel.org/stable/c/a14c55eb461d630b836f80591d8caf1f74e62877" }, { "url": "https://git.kernel.org/stable/c/e08c2e275fa1874de945b87093f925997722ee42" }, { "url": "https://git.kernel.org/stable/c/8649829a1dd25199bbf557b2621cedb4bf9b3050" } ], "title": "powerpc/powernv: Add a null pointer check in opal_event_init()", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52686", "datePublished": "2024-05-17T14:24:47.984Z", "dateReserved": "2024-03-07T14:49:46.888Z", "dateUpdated": "2024-11-04T14:51:06.257Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-7008
Vulnerability from cvelistv5
Published
2023-12-23 13:00
Modified
2024-11-23 03:39
Severity ?
EPSS score ?
Summary
Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes
References
▼ | URL | Tags |
---|---|---|
https://access.redhat.com/errata/RHSA-2024:2463 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:3203 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/security/cve/CVE-2023-7008 | vdb-entry, x_refsource_REDHAT | |
https://bugzilla.redhat.com/show_bug.cgi?id=2222261 | ||
https://bugzilla.redhat.com/show_bug.cgi?id=2222672 | issue-tracking, x_refsource_REDHAT | |
https://github.com/systemd/systemd/issues/25676 |
Impacted products
Vendor | Product | Version | |||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Red Hat | Red Hat Enterprise Linux 8 |
Unaffected: 0:239-82.el8 < * cpe:/o:redhat:enterprise_linux:8::baseos |
||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-11-22T12:04:44.733Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2024:2463", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2463" }, { "name": "RHSA-2024:3203", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:3203" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2023-7008" }, { "tags": [ "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2222261" }, { "name": "RHBZ#2222672", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2222672" }, { "tags": [ "x_transferred" ], "url": "https://github.com/systemd/systemd/issues/25676" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMDEG5PKONWNHOEYSUDRT6JEOISRMN2/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHNBXGKJWISJETTTDTZKTBFIBJUOSLKL/" }, { "url": "https://security.netapp.com/advisory/ntap-20241122-0004/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::baseos" ], "defaultStatus": "affected", "packageName": "systemd", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:239-82.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos" ], "defaultStatus": "affected", "packageName": "systemd", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:252-32.el9_4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos" ], "defaultStatus": "affected", "packageName": "systemd", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:252-32.el9_4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:cryostat:2" ], "defaultStatus": "unaffected", "packageName": "systemd", "product": "Cryostat 2", "vendor": "Red Hat" } ], "datePublic": "2022-12-08T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-300", "description": "Channel Accessible by Non-Endpoint", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-23T03:39:26.132Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2024:2463", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2463" }, { "name": "RHSA-2024:3203", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:3203" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2023-7008" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2222261" }, { "name": "RHBZ#2222672", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2222672" }, { "url": "https://github.com/systemd/systemd/issues/25676" } ], "timeline": [ { "lang": "en", "time": "2023-07-12T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2022-12-08T00:00:00+00:00", "value": "Made public." } ], "title": "Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes", "workarounds": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability." } ], "x_redhatCweChain": "CWE-300: Channel Accessible by Non-Endpoint" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-7008", "datePublished": "2023-12-23T13:00:50.515Z", "dateReserved": "2023-12-20T15:28:32.966Z", "dateUpdated": "2024-11-23T03:39:26.132Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-36004
Vulnerability from cvelistv5
Published
2024-05-20 09:48
Modified
2024-11-05 09:26
Severity ?
EPSS score ?
Summary
i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-36004", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-20T17:00:59.391854Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:47:48.116Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:30:12.511Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/09b54d29f05129b092f7c793a70b689ffb3c7b2c" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/546d0fe9d76e8229a67369f9cb61e961d99038bd" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/fbbb2404340dd6178e281bd427c271f7d5ec1d22" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ff7431f898dd00892a545b7d0ce7adf5b926944f" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/152ed360cf2d273f88fc99a518b7eb868aae2939" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8d6105f637883c8c09825e962308c06e977de4f0" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1594dac8b1ed78f9e75c263327e198a2e5e25b0e" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2cc7d150550cc981aceedf008f5459193282425c" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/intel/i40e/i40e_main.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "09b54d29f051", "status": "affected", "version": "4d5957cbdecd", "versionType": "git" }, { "lessThan": "546d0fe9d76e", "status": "affected", "version": "4d5957cbdecd", "versionType": "git" }, { "lessThan": "fbbb2404340d", "status": "affected", "version": "4d5957cbdecd", "versionType": "git" }, { "lessThan": "ff7431f898dd", "status": "affected", "version": "4d5957cbdecd", "versionType": "git" }, { "lessThan": "152ed360cf2d", "status": "affected", "version": "4d5957cbdecd", "versionType": "git" }, { "lessThan": "8d6105f63788", "status": "affected", "version": "4d5957cbdecd", "versionType": "git" }, { "lessThan": "1594dac8b1ed", "status": "affected", "version": "4d5957cbdecd", "versionType": "git" }, { "lessThan": "2cc7d150550c", "status": "affected", "version": "4d5957cbdecd", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/intel/i40e/i40e_main.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.14" }, { "lessThan": "4.14", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.313", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.275", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.216", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.158", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.90", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.30", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.9", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Do not use WQ_MEM_RECLAIM flag for workqueue\n\nIssue reported by customer during SRIOV testing, call trace:\nWhen both i40e and the i40iw driver are loaded, a warning\nin check_flush_dependency is being triggered. This seems\nto be because of the i40e driver workqueue is allocated with\nthe WQ_MEM_RECLAIM flag, and the i40iw one is not.\n\nSimilar error was encountered on ice too and it was fixed by\nremoving the flag. Do the same for i40e too.\n\n[Feb 9 09:08] ------------[ cut here ]------------\n[ +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] is\nflushing !WQ_MEM_RECLAIM infiniband:0x0\n[ +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966\ncheck_flush_dependency+0x10b/0x120\n[ +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq\nsnd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4\nnls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtr\nrfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdma\nintel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssif\nisst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal\nintel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_core\niTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncore\nioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ich\nintel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_pad\nxfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbe\ndrm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intel\nlibata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirror\ndm_region_hash dm_log dm_mod fuse\n[ +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Not\ntainted 6.8.0-rc2-Feb-net_dev-Qiueue-00279-gbd43c5687e05 #1\n[ +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOS\nSE5C620.86B.02.01.0013.121520200651 12/15/2020\n[ +0.000001] Workqueue: i40e i40e_service_task [i40e]\n[ +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120\n[ +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 48\n81 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fd\nff \u003c0f\u003e 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90\n[ +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS: 00010282\n[ +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX:\n0000000000000027\n[ +0.000001] RDX: ffff94d47f620bc8 RSI: 0000000000000001 RDI:\nffff94d47f620bc0\n[ +0.000001] RBP: 0000000000000000 R08: 0000000000000000 R09:\n00000000ffff7fff\n[ +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12:\nffff94c5451ea180\n[ +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15:\nffff94c5f1330ab0\n[ +0.000001] FS: 0000000000000000(0000) GS:ffff94d47f600000(0000)\nknlGS:0000000000000000\n[ +0.000002] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4:\n00000000007706f0\n[ +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2:\n0000000000000000\n[ +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:\n0000000000000400\n[ +0.000001] PKRU: 55555554\n[ +0.000001] Call Trace:\n[ +0.000001] \u003cTASK\u003e\n[ +0.000002] ? __warn+0x80/0x130\n[ +0.000003] ? check_flush_dependency+0x10b/0x120\n[ +0.000002] ? report_bug+0x195/0x1a0\n[ +0.000005] ? handle_bug+0x3c/0x70\n[ +0.000003] ? exc_invalid_op+0x14/0x70\n[ +0.000002] ? asm_exc_invalid_op+0x16/0x20\n[ +0.000006] ? check_flush_dependency+0x10b/0x120\n[ +0.000002] ? check_flush_dependency+0x10b/0x120\n[ +0.000002] __flush_workqueue+0x126/0x3f0\n[ +0.000015] ib_cache_cleanup_one+0x1c/0xe0 [ib_core]\n[ +0.000056] __ib_unregister_device+0x6a/0xb0 [ib_core]\n[ +0.000023] ib_unregister_device_and_put+0x34/0x50 [ib_core]\n[ +0.000020] i40iw_close+0x4b/0x90 [irdma]\n[ +0.000022] i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e]\n[ +0.000035] i40e_service_task+0x126/0x190 [i40e]\n[ +0.000024] process_one_work+0x174/0x340\n[ +0.000003] worker_th\n---truncated---" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:26:36.799Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/09b54d29f05129b092f7c793a70b689ffb3c7b2c" }, { "url": "https://git.kernel.org/stable/c/546d0fe9d76e8229a67369f9cb61e961d99038bd" }, { "url": "https://git.kernel.org/stable/c/fbbb2404340dd6178e281bd427c271f7d5ec1d22" }, { "url": "https://git.kernel.org/stable/c/ff7431f898dd00892a545b7d0ce7adf5b926944f" }, { "url": "https://git.kernel.org/stable/c/152ed360cf2d273f88fc99a518b7eb868aae2939" }, { "url": "https://git.kernel.org/stable/c/8d6105f637883c8c09825e962308c06e977de4f0" }, { "url": "https://git.kernel.org/stable/c/1594dac8b1ed78f9e75c263327e198a2e5e25b0e" }, { "url": "https://git.kernel.org/stable/c/2cc7d150550cc981aceedf008f5459193282425c" } ], "title": "i40e: Do not use WQ_MEM_RECLAIM flag for workqueue", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-36004", "datePublished": "2024-05-20T09:48:04.926Z", "dateReserved": "2024-05-17T13:50:33.150Z", "dateUpdated": "2024-11-05T09:26:36.799Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26859
Vulnerability from cvelistv5
Published
2024-04-17 10:27
Modified
2024-11-05 09:17
Severity ?
EPSS score ?
Summary
net/bnx2x: Prevent access to a freed page in page_pool
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-26859", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-04-23T14:02:31.556726Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-05T17:21:09.772Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:14:13.698Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7bcc090c81116c66936a7415f2c6b1483a4bcfd9" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4f37d3a7e004bbf560c21441ca9c022168017ec4" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8eebff95ce9558be66a36aa7cfb43223f3ab4699" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8ffcd3ccdbda0c918c4a0f922ef1c17010f1b598" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/cf7d8cba639ae792a42c2a137b495eac262ac36c" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/3a9f78b297e08ca8e88ae3ecff1f6fe2766dc5eb" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c51f8b6930db3f259b8820b589f2459d2df3fc68" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/44f9f1abb0ecc43023225ab9539167facbabf0ec" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/d27e2da94a42655861ca4baea30c8cd65546f25d" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "7bcc090c8111", "status": "affected", "version": "4cace675d687", "versionType": "git" }, { "lessThan": "4f37d3a7e004", "status": "affected", "version": "4cace675d687", "versionType": "git" }, { "lessThan": "8eebff95ce95", "status": "affected", "version": "4cace675d687", "versionType": "git" }, { "lessThan": "8ffcd3ccdbda", "status": "affected", "version": "4cace675d687", "versionType": "git" }, { "lessThan": "cf7d8cba639a", "status": "affected", "version": "4cace675d687", "versionType": "git" }, { "lessThan": "3a9f78b297e0", "status": "affected", "version": "4cace675d687", "versionType": "git" }, { "lessThan": "c51f8b6930db", "status": "affected", "version": "4cace675d687", "versionType": "git" }, { "lessThan": "44f9f1abb0ec", "status": "affected", "version": "4cace675d687", "versionType": "git" }, { "lessThan": "d27e2da94a42", "status": "affected", "version": "4cace675d687", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.2" }, { "lessThan": "4.2", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.311", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.273", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.214", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.153", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.83", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.23", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.11", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.2", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/bnx2x: Prevent access to a freed page in page_pool\n\nFix race condition leading to system crash during EEH error handling\n\nDuring EEH error recovery, the bnx2x driver\u0027s transmit timeout logic\ncould cause a race condition when handling reset tasks. The\nbnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(),\nwhich ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload()\nSGEs are freed using bnx2x_free_rx_sge_range(). However, this could\noverlap with the EEH driver\u0027s attempt to reset the device using\nbnx2x_io_slot_reset(), which also tries to free SGEs. This race\ncondition can result in system crashes due to accessing freed memory\nlocations in bnx2x_free_rx_sge()\n\n799 static inline void bnx2x_free_rx_sge(struct bnx2x *bp,\n800\t\t\t\tstruct bnx2x_fastpath *fp, u16 index)\n801 {\n802\tstruct sw_rx_page *sw_buf = \u0026fp-\u003erx_page_ring[index];\n803 struct page *page = sw_buf-\u003epage;\n....\nwhere sw_buf was set to NULL after the call to dma_unmap_page()\nby the preceding thread.\n\n EEH: Beginning: \u0027slot_reset\u0027\n PCI 0011:01:00.0#10000: EEH: Invoking bnx2x-\u003eslot_reset()\n bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing...\n bnx2x 0011:01:00.0: enabling device (0140 -\u003e 0142)\n bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --\u003e driver unload\n Kernel attempted to read user page (0) - exploit attempt? (uid: 0)\n BUG: Kernel NULL pointer dereference on read at 0x00000000\n Faulting instruction address: 0xc0080000025065fc\n Oops: Kernel access of bad area, sig: 11 [#1]\n .....\n Call Trace:\n [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable)\n [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0\n [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550\n [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60\n [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170\n [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0\n [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64\n\nTo solve this issue, we need to verify page pool allocations before\nfreeing." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:17:06.556Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/7bcc090c81116c66936a7415f2c6b1483a4bcfd9" }, { "url": "https://git.kernel.org/stable/c/4f37d3a7e004bbf560c21441ca9c022168017ec4" }, { "url": "https://git.kernel.org/stable/c/8eebff95ce9558be66a36aa7cfb43223f3ab4699" }, { "url": "https://git.kernel.org/stable/c/8ffcd3ccdbda0c918c4a0f922ef1c17010f1b598" }, { "url": "https://git.kernel.org/stable/c/cf7d8cba639ae792a42c2a137b495eac262ac36c" }, { "url": "https://git.kernel.org/stable/c/3a9f78b297e08ca8e88ae3ecff1f6fe2766dc5eb" }, { "url": "https://git.kernel.org/stable/c/c51f8b6930db3f259b8820b589f2459d2df3fc68" }, { "url": "https://git.kernel.org/stable/c/44f9f1abb0ecc43023225ab9539167facbabf0ec" }, { "url": "https://git.kernel.org/stable/c/d27e2da94a42655861ca4baea30c8cd65546f25d" } ], "title": "net/bnx2x: Prevent access to a freed page in page_pool", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26859", "datePublished": "2024-04-17T10:27:23.709Z", "dateReserved": "2024-02-19T14:20:24.183Z", "dateUpdated": "2024-11-05T09:17:06.556Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26974
Vulnerability from cvelistv5
Published
2024-05-01 05:20
Modified
2024-11-05 09:19
Severity ?
EPSS score ?
Summary
crypto: qat - resolve race condition during AER recovery
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-26974", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-28T17:47:45.425638Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:49:36.315Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:21:05.752Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/daba62d9eeddcc5b1081be7d348ca836c83c59d7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8e81cd58aee14a470891733181a47d123193ba81" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/d03092550f526a79cf1ade7f0dfa74906f39eb71" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4ae5a97781ce7d6ecc9c7055396535815b64ca4f" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/226fc408c5fcd23cc4186f05ea3a09a7a9aef2f7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8a5a7611ccc7b1fba8d933a9f22a2e76859d94dc" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0c2cf5142bfb634c0ef0a1a69cdf37950747d0be" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/bb279ead42263e9fb09480f02a4247b2c287d828" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7d42e097607c4d246d99225bf2b195b6167a210c" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/crypto/intel/qat/qat_common/adf_aer.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "daba62d9eedd", "status": "affected", "version": "d8cba25d2c68", "versionType": "git" }, { "lessThan": "8e81cd58aee1", "status": "affected", "version": "d8cba25d2c68", "versionType": "git" }, { "lessThan": "d03092550f52", "status": "affected", "version": "d8cba25d2c68", "versionType": "git" }, { "lessThan": "4ae5a97781ce", "status": "affected", "version": "d8cba25d2c68", "versionType": "git" }, { "lessThan": "226fc408c5fc", "status": "affected", "version": "d8cba25d2c68", "versionType": "git" }, { "lessThan": "8a5a7611ccc7", "status": "affected", "version": "d8cba25d2c68", "versionType": "git" }, { "lessThan": "0c2cf5142bfb", "status": "affected", "version": "d8cba25d2c68", "versionType": "git" }, { "lessThan": "bb279ead4226", "status": "affected", "version": "d8cba25d2c68", "versionType": "git" }, { "lessThan": "7d42e097607c", "status": "affected", "version": "d8cba25d2c68", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/crypto/intel/qat/qat_common/adf_aer.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.17" }, { "lessThan": "3.17", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.312", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.274", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.215", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.154", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.84", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.24", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.12", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - resolve race condition during AER recovery\n\nDuring the PCI AER system\u0027s error recovery process, the kernel driver\nmay encounter a race condition with freeing the reset_data structure\u0027s\nmemory. If the device restart will take more than 10 seconds the function\nscheduling that restart will exit due to a timeout, and the reset_data\nstructure will be freed. However, this data structure is used for\ncompletion notification after the restart is completed, which leads\nto a UAF bug.\n\nThis results in a KFENCE bug notice.\n\n BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat]\n Use-after-free read at 0x00000000bc56fddf (in kfence-#142):\n adf_device_reset_worker+0x38/0xa0 [intel_qat]\n process_one_work+0x173/0x340\n\nTo resolve this race condition, the memory associated to the container\nof the work_struct is freed on the worker if the timeout expired,\notherwise on the function that schedules the worker.\nThe timeout detection can be done by checking if the caller is\nstill waiting for completion or not by using completion_done() function." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:19:13.670Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/daba62d9eeddcc5b1081be7d348ca836c83c59d7" }, { "url": "https://git.kernel.org/stable/c/8e81cd58aee14a470891733181a47d123193ba81" }, { "url": "https://git.kernel.org/stable/c/d03092550f526a79cf1ade7f0dfa74906f39eb71" }, { "url": "https://git.kernel.org/stable/c/4ae5a97781ce7d6ecc9c7055396535815b64ca4f" }, { "url": "https://git.kernel.org/stable/c/226fc408c5fcd23cc4186f05ea3a09a7a9aef2f7" }, { "url": "https://git.kernel.org/stable/c/8a5a7611ccc7b1fba8d933a9f22a2e76859d94dc" }, { "url": "https://git.kernel.org/stable/c/0c2cf5142bfb634c0ef0a1a69cdf37950747d0be" }, { "url": "https://git.kernel.org/stable/c/bb279ead42263e9fb09480f02a4247b2c287d828" }, { "url": "https://git.kernel.org/stable/c/7d42e097607c4d246d99225bf2b195b6167a210c" } ], "title": "crypto: qat - resolve race condition during AER recovery", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26974", "datePublished": "2024-05-01T05:20:14.163Z", "dateReserved": "2024-02-19T14:20:24.203Z", "dateUpdated": "2024-11-05T09:19:13.670Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52669
Vulnerability from cvelistv5
Published
2024-05-17 14:01
Modified
2024-11-04 14:50
Severity ?
EPSS score ?
Summary
crypto: s390/aes - Fix buffer overread in CTR mode
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-52669", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-24T14:16:01.568740Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:24:13.633Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T23:11:34.492Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/cd51e26a3b89706beec64f2d8296cfb1c34e0c79" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a7f580cdb42ec3d53bbb7c4e4335a98423703285" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/dbc9a791a70ea47be9f2acf251700fe254a2ab23" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/d68ac38895e84446848b7647ab9458d54cacba3e" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e78f1a43e72daf77705ad5b9946de66fc708b874" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/d07f951903fa9922c375b8ab1ce81b18a0034e3b" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/s390/crypto/aes_s390.c", "arch/s390/crypto/paes_s390.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "cd51e26a3b89", "status": "affected", "version": "0200f3ecc196", "versionType": "git" }, { "lessThan": "a7f580cdb42e", "status": "affected", "version": "0200f3ecc196", "versionType": "git" }, { "lessThan": "dbc9a791a70e", "status": "affected", "version": "0200f3ecc196", "versionType": "git" }, { "lessThan": "d68ac38895e8", "status": "affected", "version": "0200f3ecc196", "versionType": "git" }, { "lessThan": "e78f1a43e72d", "status": "affected", "version": "0200f3ecc196", "versionType": "git" }, { "lessThan": "d07f951903fa", "status": "affected", "version": "0200f3ecc196", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/s390/crypto/aes_s390.c", "arch/s390/crypto/paes_s390.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.0" }, { "lessThan": "3.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.210", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.76", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.15", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: s390/aes - Fix buffer overread in CTR mode\n\nWhen processing the last block, the s390 ctr code will always read\na whole block, even if there isn\u0027t a whole block of data left. Fix\nthis by using the actual length left and copy it into a buffer first\nfor processing." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:50:47.497Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/cd51e26a3b89706beec64f2d8296cfb1c34e0c79" }, { "url": "https://git.kernel.org/stable/c/a7f580cdb42ec3d53bbb7c4e4335a98423703285" }, { "url": "https://git.kernel.org/stable/c/dbc9a791a70ea47be9f2acf251700fe254a2ab23" }, { "url": "https://git.kernel.org/stable/c/d68ac38895e84446848b7647ab9458d54cacba3e" }, { "url": "https://git.kernel.org/stable/c/e78f1a43e72daf77705ad5b9946de66fc708b874" }, { "url": "https://git.kernel.org/stable/c/d07f951903fa9922c375b8ab1ce81b18a0034e3b" } ], "title": "crypto: s390/aes - Fix buffer overread in CTR mode", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52669", "datePublished": "2024-05-17T14:01:57.025Z", "dateReserved": "2024-03-07T14:49:46.885Z", "dateUpdated": "2024-11-04T14:50:47.497Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35855
Vulnerability from cvelistv5
Published
2024-05-17 14:47
Modified
2024-11-05 09:23
Severity ?
EPSS score ?
Summary
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-35855", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-17T16:58:00.643012Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:33:37.309Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:48.376Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1b73f6e4ea770410a937a8db98f77e52594d23a0" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e24d2487424779c02760ff50cd9021b8676e19ef" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c17976b42d546ee118ca300db559630ee96fb758" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b996e8699da810e4c915841d6aaef761007f933a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/feabdac2057e863d0e140a2adf3d232eb4882db4" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b183b915beef818a25e3154d719ca015a1ae0770" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/79b5b4b18bc85b19d3a518483f9abbbe6d7b3ba4" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "1b73f6e4ea77", "status": "affected", "version": "2bffc5322fd8", "versionType": "git" }, { "lessThan": "e24d24874247", "status": "affected", "version": "2bffc5322fd8", "versionType": "git" }, { "lessThan": "c17976b42d54", "status": "affected", "version": "2bffc5322fd8", "versionType": "git" }, { "lessThan": "b996e8699da8", "status": "affected", "version": "2bffc5322fd8", "versionType": "git" }, { "lessThan": "feabdac2057e", "status": "affected", "version": "2bffc5322fd8", "versionType": "git" }, { "lessThan": "b183b915beef", "status": "affected", "version": "2bffc5322fd8", "versionType": "git" }, { "lessThan": "79b5b4b18bc8", "status": "affected", "version": "2bffc5322fd8", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.1" }, { "lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.275", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.216", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.158", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.90", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.30", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.9", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update\n\nThe rule activity update delayed work periodically traverses the list of\nconfigured rules and queries their activity from the device.\n\nAs part of this task it accesses the entry pointed by \u0027ventry-\u003eentry\u0027,\nbut this entry can be changed concurrently by the rehash delayed work,\nleading to a use-after-free [1].\n\nFix by closing the race and perform the activity query under the\n\u0027vregion-\u003elock\u0027 mutex.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140\nRead of size 8 at addr ffff8881054ed808 by task kworker/0:18/181\n\nCPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140\n mlxsw_sp_acl_rule_activity_update_work+0x219/0x400\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 1039:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 1039:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:23:48.196Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/1b73f6e4ea770410a937a8db98f77e52594d23a0" }, { "url": "https://git.kernel.org/stable/c/e24d2487424779c02760ff50cd9021b8676e19ef" }, { "url": "https://git.kernel.org/stable/c/c17976b42d546ee118ca300db559630ee96fb758" }, { "url": "https://git.kernel.org/stable/c/b996e8699da810e4c915841d6aaef761007f933a" }, { "url": "https://git.kernel.org/stable/c/feabdac2057e863d0e140a2adf3d232eb4882db4" }, { "url": "https://git.kernel.org/stable/c/b183b915beef818a25e3154d719ca015a1ae0770" }, { "url": "https://git.kernel.org/stable/c/79b5b4b18bc85b19d3a518483f9abbbe6d7b3ba4" } ], "title": "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35855", "datePublished": "2024-05-17T14:47:31.436Z", "dateReserved": "2024-05-17T13:50:33.106Z", "dateUpdated": "2024-11-05T09:23:48.196Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-47073
Vulnerability from cvelistv5
Published
2024-03-01 21:15
Modified
2024-11-04 11:58
Severity ?
EPSS score ?
Summary
platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2021-47073", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-03-05T22:11:59.293322Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:13:23.078Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T05:24:39.704Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/75cfc833da4a2111106d4c134e93e0c7f41e35e7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6fa78a6b9a3beb676a010dc489c1257f7e432525" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0cf036a0d325200e6c27b90908e51195bbc557b1" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8d746ea7c687bab060a2c05a35c449302406cd52" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/3a53587423d25c87af4b4126a806a0575104b45e" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/platform/x86/dell/dell-smbios-wmi.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "75cfc833da4a", "status": "affected", "version": "1a258e670434", "versionType": "git" }, { "lessThan": "6fa78a6b9a3b", "status": "affected", "version": "1a258e670434", "versionType": "git" }, { "lessThan": "0cf036a0d325", "status": "affected", "version": "1a258e670434", "versionType": "git" }, { "lessThan": "8d746ea7c687", "status": "affected", "version": "1a258e670434", "versionType": "git" }, { "lessThan": "3a53587423d2", "status": "affected", "version": "1a258e670434", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/platform/x86/dell/dell-smbios-wmi.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.15" }, { "lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.192", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.122", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.40", "versionType": "semver" }, { "lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios\n\ninit_dell_smbios_wmi() only registers the dell_smbios_wmi_driver on systems\nwhere the Dell WMI interface is supported. While exit_dell_smbios_wmi()\nunregisters it unconditionally, this leads to the following oops:\n\n[ 175.722921] ------------[ cut here ]------------\n[ 175.722925] Unexpected driver unregister!\n[ 175.722939] WARNING: CPU: 1 PID: 3630 at drivers/base/driver.c:194 driver_unregister+0x38/0x40\n...\n[ 175.723089] Call Trace:\n[ 175.723094] cleanup_module+0x5/0xedd [dell_smbios]\n...\n[ 175.723148] ---[ end trace 064c34e1ad49509d ]---\n\nMake the unregister happen on the same condition the register happens\nto fix this." } ], "providerMetadata": { "dateUpdated": "2024-11-04T11:58:54.614Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/75cfc833da4a2111106d4c134e93e0c7f41e35e7" }, { "url": "https://git.kernel.org/stable/c/6fa78a6b9a3beb676a010dc489c1257f7e432525" }, { "url": "https://git.kernel.org/stable/c/0cf036a0d325200e6c27b90908e51195bbc557b1" }, { "url": "https://git.kernel.org/stable/c/8d746ea7c687bab060a2c05a35c449302406cd52" }, { "url": "https://git.kernel.org/stable/c/3a53587423d25c87af4b4126a806a0575104b45e" } ], "title": "platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-47073", "datePublished": "2024-03-01T21:15:11.466Z", "dateReserved": "2024-02-29T22:33:44.297Z", "dateUpdated": "2024-11-04T11:58:54.614Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-43789
Vulnerability from cvelistv5
Published
2023-10-12 11:43
Modified
2024-11-23 02:03
Severity ?
EPSS score ?
Summary
Libxpm: out of bounds read on xpm with corrupted colormap
References
▼ | URL | Tags |
---|---|---|
https://access.redhat.com/errata/RHSA-2024:2146 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:2217 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:2974 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:3022 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/security/cve/CVE-2023-43789 | vdb-entry, x_refsource_REDHAT | |
https://bugzilla.redhat.com/show_bug.cgi?id=2242249 | issue-tracking, x_refsource_REDHAT |
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ |
Version: 0 ≤ |
||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T19:52:11.025Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2024:2146", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2146" }, { "name": "RHSA-2024:2217", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2217" }, { "name": "RHSA-2024:2974", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2974" }, { "name": "RHSA-2024:3022", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:3022" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2023-43789" }, { "name": "RHBZ#2242249", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242249" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63IBRFLQVZSMOAZBZOBKFWJP26ILRAGQ/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3KFUQT42R7TB4D7RISNSBQFJGLTQGUL/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFAJTBNO3PAIA6EGZR4PN62H6RLKNDTE/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZECBCLDYUGLDSVV75ECPIBW7JXOB3747/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://gitlab.freedesktop.org/xorg/lib/libxpm", "defaultStatus": "unaffected", "packageName": "libXpm", "versions": [ { "lessThan": "3.5.17", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream" ], "defaultStatus": "affected", "packageName": "libXpm", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:3.5.12-11.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream" ], "defaultStatus": "affected", "packageName": "motif", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:2.3.4-20.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "libXpm", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:3.5.13-10.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "motif", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:2.3.4-28.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "unknown", "packageName": "libXpm", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "libXpm", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "motif", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" } ], "datePublic": "2023-10-04T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-23T02:03:19.871Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2024:2146", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2146" }, { "name": "RHSA-2024:2217", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2217" }, { "name": "RHSA-2024:2974", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2974" }, { "name": "RHSA-2024:3022", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:3022" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2023-43789" }, { "name": "RHBZ#2242249", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242249" } ], "timeline": [ { "lang": "en", "time": "2023-10-05T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2023-10-04T00:00:00+00:00", "value": "Made public." } ], "title": "Libxpm: out of bounds read on xpm with corrupted colormap", "x_redhatCweChain": "CWE-125: Out-of-bounds Read" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-43789", "datePublished": "2023-10-12T11:43:20.009Z", "dateReserved": "2023-09-22T09:52:31.109Z", "dateUpdated": "2024-11-23T02:03:19.871Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-47353
Vulnerability from cvelistv5
Published
2024-05-21 14:35
Modified
2024-11-04 12:04
Severity ?
EPSS score ?
Summary
udf: Fix NULL pointer dereference in udf_symlink function
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2021-47353", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-23T19:03:03.353127Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:14:54.819Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T05:32:08.447Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2f3d9ddd32a28803baa547e6274983b67d5e287c" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/371566f63cbd0bb6fbb25b8fe9d5798268d35af9" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/baea588a42d675e35daeaddd10fbc9700550bc4d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/3638705ecd5ad2785e996f820121c0ad15ce64b5" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/80d505aee6398cf8beb72475c7edcf1733c1c68b" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/21bf1414580c36ffc8d8de043beb3508cf812238" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/aebed6b19e51a34003d998da5ebb1dfdd2cb1d02" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5150877e4d99f85057a458daac7cd7c01005d5c6" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/udf/namei.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "2f3d9ddd32a2", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "371566f63cbd", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "baea588a42d6", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "3638705ecd5a", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "80d505aee639", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "21bf1414580c", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "aebed6b19e51", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "5150877e4d99", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "fa236c2b2d44", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/udf/namei.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.4.*", "status": "unaffected", "version": "4.4.276", "versionType": "semver" }, { "lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.276", "versionType": "semver" }, { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.240", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.198", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.133", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.51", "versionType": "semver" }, { "lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.18", "versionType": "semver" }, { "lessThanOrEqual": "5.13.*", "status": "unaffected", "version": "5.13.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.14", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix NULL pointer dereference in udf_symlink function\n\nIn function udf_symlink, epos.bh is assigned with the value returned\nby udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c\nand returns the value of sb_getblk function that could be NULL.\nThen, epos.bh is used without any check, causing a possible\nNULL pointer dereference when sb_getblk fails.\n\nThis fix adds a check to validate the value of epos.bh." } ], "providerMetadata": { "dateUpdated": "2024-11-04T12:04:17.505Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/2f3d9ddd32a28803baa547e6274983b67d5e287c" }, { "url": "https://git.kernel.org/stable/c/371566f63cbd0bb6fbb25b8fe9d5798268d35af9" }, { "url": "https://git.kernel.org/stable/c/baea588a42d675e35daeaddd10fbc9700550bc4d" }, { "url": "https://git.kernel.org/stable/c/3638705ecd5ad2785e996f820121c0ad15ce64b5" }, { "url": "https://git.kernel.org/stable/c/80d505aee6398cf8beb72475c7edcf1733c1c68b" }, { "url": "https://git.kernel.org/stable/c/21bf1414580c36ffc8d8de043beb3508cf812238" }, { "url": "https://git.kernel.org/stable/c/aebed6b19e51a34003d998da5ebb1dfdd2cb1d02" }, { "url": "https://git.kernel.org/stable/c/5150877e4d99f85057a458daac7cd7c01005d5c6" }, { "url": "https://git.kernel.org/stable/c/fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43" } ], "title": "udf: Fix NULL pointer dereference in udf_symlink function", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-47353", "datePublished": "2024-05-21T14:35:57.122Z", "dateReserved": "2024-05-21T14:28:16.986Z", "dateUpdated": "2024-11-04T12:04:17.505Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-4693
Vulnerability from cvelistv5
Published
2023-10-25 10:27
Modified
2024-11-23 03:30
Severity ?
EPSS score ?
Summary
Grub2: out-of-bounds read at fs/ntfs.c
References
▼ | URL | Tags |
---|---|---|
https://access.redhat.com/errata/RHSA-2024:2456 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:3184 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/security/cve/CVE-2023-4693 | vdb-entry, x_refsource_REDHAT | |
https://bugzilla.redhat.com/show_bug.cgi?id=2238343 | issue-tracking, x_refsource_REDHAT | |
https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager/ | ||
https://lists.gnu.org/archive/html/grub-devel/2023-10/msg00028.html | ||
https://seclists.org/oss-sec/2023/q4/37 |
Impacted products
Vendor | Product | Version | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Red Hat | Red Hat Enterprise Linux 8 |
Unaffected: 1:2.02-156.el8 < * cpe:/o:redhat:enterprise_linux:8::baseos |
||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:37:59.265Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2024:2456", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2456" }, { "name": "RHSA-2024:3184", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:3184" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2023-4693" }, { "name": "RHBZ#2238343", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238343" }, { "tags": [ "x_transferred" ], "url": "https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUU42E7CPYLATXOYVYNW6YTXXULAOV6L/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRJ5UZRXX2KLR4IKBJEQUNGOCXMMDLY/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PERFILCHFEUGG3OAMC6W55P6DDIBZK4Q/" }, { "tags": [ "x_transferred" ], "url": "https://lists.gnu.org/archive/html/grub-devel/2023-10/msg00028.html" }, { "tags": [ "x_transferred" ], "url": "https://seclists.org/oss-sec/2023/q4/37" }, { "tags": [ "x_transferred" ], "url": "https://security.gentoo.org/glsa/202311-14" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20231208-0002/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::baseos" ], "defaultStatus": "affected", "packageName": "grub2", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1:2.02-156.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::baseos" ], "defaultStatus": "affected", "packageName": "grub2", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1:2.06-77.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "grub2", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" } ], "datePublic": "2023-10-03T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "An out-of-bounds read flaw was found on grub2\u0027s NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Low" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-23T03:30:32.531Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2024:2456", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2456" }, { "name": "RHSA-2024:3184", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:3184" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2023-4693" }, { "name": "RHBZ#2238343", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238343" }, { "url": "https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager/" }, { "url": "https://lists.gnu.org/archive/html/grub-devel/2023-10/msg00028.html" }, { "url": "https://seclists.org/oss-sec/2023/q4/37" } ], "timeline": [ { "lang": "en", "time": "2023-09-11T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2023-10-03T00:00:00+00:00", "value": "Made public." } ], "title": "Grub2: out-of-bounds read at fs/ntfs.c", "x_redhatCweChain": "CWE-125: Out-of-bounds Read" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-4693", "datePublished": "2023-10-25T10:27:29.100Z", "dateReserved": "2023-08-31T21:53:46.147Z", "dateUpdated": "2024-11-23T03:30:32.531Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26801
Vulnerability from cvelistv5
Published
2024-04-04 08:20
Modified
2024-11-05 09:16
Severity ?
EPSS score ?
Summary
Bluetooth: Avoid potential use-after-free in hci_error_reset
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T00:14:13.522Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e0b278650f07acf2e0932149183458468a731c03" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/98fb98fd37e42fd4ce13ff657ea64503e24b6090" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/da4569d450b193e39e87119fd316c0291b585d14" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/45085686b9559bfbe3a4f41d3d695a520668f5e1" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2ab9a19d896f5a0dd386e1f001c5309bc35f433b" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/dd594cdc24f2e48dab441732e6dfcafd6b0711d1" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2449007d3f73b2842c9734f45f0aadb522daf592" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-26801", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-08-15T19:27:12.303916Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-15T19:27:19.532Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/bluetooth/hci_core.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "e0b278650f07", "status": "affected", "version": "c7741d16a57c", "versionType": "git" }, { "lessThan": "98fb98fd37e4", "status": "affected", "version": "c7741d16a57c", "versionType": "git" }, { "lessThan": "6dd0a9dfa99f", "status": "affected", "version": "c7741d16a57c", "versionType": "git" }, { "lessThan": "da4569d450b1", "status": "affected", "version": "c7741d16a57c", "versionType": "git" }, { "lessThan": "45085686b955", "status": "affected", "version": "c7741d16a57c", "versionType": "git" }, { "lessThan": "2ab9a19d896f", "status": "affected", "version": "c7741d16a57c", "versionType": "git" }, { "lessThan": "dd594cdc24f2", "status": "affected", "version": "c7741d16a57c", "versionType": "git" }, { "lessThan": "2449007d3f73", "status": "affected", "version": "c7741d16a57c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/bluetooth/hci_core.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.0" }, { "lessThan": "4.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.309", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.271", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.212", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.151", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.81", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.21", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.9", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Avoid potential use-after-free in hci_error_reset\n\nWhile handling the HCI_EV_HARDWARE_ERROR event, if the underlying\nBT controller is not responding, the GPIO reset mechanism would\nfree the hci_dev and lead to a use-after-free in hci_error_reset.\n\nHere\u0027s the call trace observed on a ChromeOS device with Intel AX201:\n queue_work_on+0x3e/0x6c\n __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth \u003cHASH:3b4a6\u003e]\n ? init_wait_entry+0x31/0x31\n __hci_cmd_sync+0x16/0x20 [bluetooth \u003cHASH:3b4a 6\u003e]\n hci_error_reset+0x4f/0xa4 [bluetooth \u003cHASH:3b4a 6\u003e]\n process_one_work+0x1d8/0x33f\n worker_thread+0x21b/0x373\n kthread+0x13a/0x152\n ? pr_cont_work+0x54/0x54\n ? kthread_blkcg+0x31/0x31\n ret_from_fork+0x1f/0x30\n\nThis patch holds the reference count on the hci_dev while processing\na HCI_EV_HARDWARE_ERROR event to avoid potential crash." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:16:04.890Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/e0b278650f07acf2e0932149183458468a731c03" }, { "url": "https://git.kernel.org/stable/c/98fb98fd37e42fd4ce13ff657ea64503e24b6090" }, { "url": "https://git.kernel.org/stable/c/6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2" }, { "url": "https://git.kernel.org/stable/c/da4569d450b193e39e87119fd316c0291b585d14" }, { "url": "https://git.kernel.org/stable/c/45085686b9559bfbe3a4f41d3d695a520668f5e1" }, { "url": "https://git.kernel.org/stable/c/2ab9a19d896f5a0dd386e1f001c5309bc35f433b" }, { "url": "https://git.kernel.org/stable/c/dd594cdc24f2e48dab441732e6dfcafd6b0711d1" }, { "url": "https://git.kernel.org/stable/c/2449007d3f73b2842c9734f45f0aadb522daf592" } ], "title": "Bluetooth: Avoid potential use-after-free in hci_error_reset", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26801", "datePublished": "2024-04-04T08:20:29.211Z", "dateReserved": "2024-02-19T14:20:24.179Z", "dateUpdated": "2024-11-05T09:16:04.890Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52878
Vulnerability from cvelistv5
Published
2024-05-21 15:32
Modified
2024-11-04 14:54
Severity ?
EPSS score ?
Summary
can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-52878", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-21T17:05:12.659416Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:23:41.925Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T23:18:41.163Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/826120c9ba68f2d0dbae58e99013929c883d1444" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0d30931f1fa0fb893fb7d5dc32b6b7edfb775be4" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/53c468008a7c9ca3f5fc985951f35ec2acae85bc" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/8ab67da060157362b2e0926692c659808784708f" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/6411959c10fe917288cbb1038886999148560057" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/can/dev/skb.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "826120c9ba68", "status": "affected", "version": "a6e4bc530403", "versionType": "git" }, { "lessThan": "0d30931f1fa0", "status": "affected", "version": "a6e4bc530403", "versionType": "git" }, { "lessThan": "53c468008a7c", "status": "affected", "version": "a6e4bc530403", "versionType": "git" }, { "lessThan": "8ab67da06015", "status": "affected", "version": "a6e4bc530403", "versionType": "git" }, { "lessThan": "6411959c10fe", "status": "affected", "version": "a6e4bc530403", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/can/dev/skb.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.33" }, { "lessThan": "2.6.33", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.139", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.63", "versionType": "semver" }, { "lessThanOrEqual": "6.5.*", "status": "unaffected", "version": "6.5.12", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.2", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.7", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_put_echo_skb(): don\u0027t crash kernel if can_priv::echo_skb is accessed out of bounds\n\nIf the \"struct can_priv::echoo_skb\" is accessed out of bounds, this\nwould cause a kernel crash. Instead, issue a meaningful warning\nmessage and return with an error." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:54:26.015Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/826120c9ba68f2d0dbae58e99013929c883d1444" }, { "url": "https://git.kernel.org/stable/c/0d30931f1fa0fb893fb7d5dc32b6b7edfb775be4" }, { "url": "https://git.kernel.org/stable/c/53c468008a7c9ca3f5fc985951f35ec2acae85bc" }, { "url": "https://git.kernel.org/stable/c/8ab67da060157362b2e0926692c659808784708f" }, { "url": "https://git.kernel.org/stable/c/6411959c10fe917288cbb1038886999148560057" } ], "title": "can: dev: can_put_echo_skb(): don\u0027t crash kernel if can_priv::echo_skb is accessed out of bounds", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52878", "datePublished": "2024-05-21T15:32:10.616Z", "dateReserved": "2024-05-21T15:19:24.264Z", "dateUpdated": "2024-11-04T14:54:26.015Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-43788
Vulnerability from cvelistv5
Published
2023-10-10 12:26
Modified
2024-11-23 02:03
Severity ?
EPSS score ?
Summary
Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()
References
▼ | URL | Tags |
---|---|---|
https://access.redhat.com/errata/RHSA-2024:2146 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:2217 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:2974 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:3022 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/security/cve/CVE-2023-43788 | vdb-entry, x_refsource_REDHAT | |
https://bugzilla.redhat.com/show_bug.cgi?id=2242248 | issue-tracking, x_refsource_REDHAT |
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ |
Version: 0 ≤ |
||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T19:52:11.310Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2024:2146", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2146" }, { "name": "RHSA-2024:2217", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2217" }, { "name": "RHSA-2024:2974", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2974" }, { "name": "RHSA-2024:3022", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:3022" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2023-43788" }, { "name": "RHBZ#2242248", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242248" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63IBRFLQVZSMOAZBZOBKFWJP26ILRAGQ/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3KFUQT42R7TB4D7RISNSBQFJGLTQGUL/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFAJTBNO3PAIA6EGZR4PN62H6RLKNDTE/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V6FARGWN7VWXXWPXYNEEDJLRR3EWFZ3T/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZECBCLDYUGLDSVV75ECPIBW7JXOB3747/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://gitlab.freedesktop.org/xorg/lib/libxpm", "defaultStatus": "unaffected", "packageName": "libXpm", "versions": [ { "lessThan": "3.5.17", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream" ], "defaultStatus": "affected", "packageName": "libXpm", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:3.5.12-11.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream" ], "defaultStatus": "affected", "packageName": "motif", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:2.3.4-20.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "libXpm", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:3.5.13-10.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "motif", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:2.3.4-28.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "unknown", "packageName": "libXpm", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "libXpm", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "motif", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" } ], "datePublic": "2023-10-04T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-23T02:03:08.274Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2024:2146", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2146" }, { "name": "RHSA-2024:2217", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2217" }, { "name": "RHSA-2024:2974", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2974" }, { "name": "RHSA-2024:3022", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:3022" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2023-43788" }, { "name": "RHBZ#2242248", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242248" } ], "timeline": [ { "lang": "en", "time": "2023-10-05T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2023-10-04T00:00:00+00:00", "value": "Made public." } ], "title": "Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()", "x_redhatCweChain": "CWE-125: Out-of-bounds Read" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-43788", "datePublished": "2023-10-10T12:26:08.737Z", "dateReserved": "2023-09-22T09:52:31.109Z", "dateUpdated": "2024-11-23T02:03:08.274Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35854
Vulnerability from cvelistv5
Published
2024-05-17 14:47
Modified
2024-11-05 09:23
Severity ?
EPSS score ?
Summary
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
References
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "affected", "version": "c9c9af91f1d9" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "affected", "version": "5.1" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "0" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "5.4.275" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "5.10.216" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "5.15.158" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "6.1.90" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "6.6.30" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "6.8.9" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "6.9" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-35854", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-05-17T16:58:28.959142Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:33:41.287Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:47.699Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "e118e7ea24d1", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "a429a912d6c7", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "4c89642ca47f", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "813e2ab753a8", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "311eeaa7b9e2", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "a02687044e12", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" }, { "lessThan": "542259888899", "status": "affected", "version": "c9c9af91f1d9", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.1" }, { "lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.275", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.216", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.158", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.90", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.30", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.9", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash\n\nThe rehash delayed work migrates filters from one region to another\naccording to the number of available credits.\n\nThe migrated from region is destroyed at the end of the work if the\nnumber of credits is non-negative as the assumption is that this is\nindicative of migration being complete. This assumption is incorrect as\na non-negative number of credits can also be the result of a failed\nmigration.\n\nThe destruction of a region that still has filters referencing it can\nresult in a use-after-free [1].\n\nFix by not destroying the region if migration failed.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\nRead of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858\n\nCPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\n mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70\n mlxsw_sp_acl_atcam_entry_del+0x81/0x210\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 174:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 7:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_region_destroy+0x272/0x310\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:23:46.957Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388" }, { "url": "https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1" }, { "url": "https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121" }, { "url": "https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887" }, { "url": "https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049" }, { "url": "https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1" }, { "url": "https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519" } ], "title": "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35854", "datePublished": "2024-05-17T14:47:30.775Z", "dateReserved": "2024-05-17T13:50:33.106Z", "dateUpdated": "2024-11-05T09:23:46.957Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-47495
Vulnerability from cvelistv5
Published
2024-05-22 08:19
Modified
2024-11-04 12:07
Severity ?
EPSS score ?
Summary
usbnet: sanity check for maxpacket
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2021-47495", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-22T15:49:07.936135Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:15:06.481Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T05:39:59.809Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b9eba0a4a527e04d712f0e0401e5391ef124b33e" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/524f333e98138d909a0a0c574a9ff6737dce2767" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/74b3b27cf9fecce00cd8918b7882fd81191d0aa4" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/002d82227c0abe29118cf80f7e2f396b22d448ed" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/492140e45d2bf27c1014243f8616a9b612144e20" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/693ecbe8f799405f8775719deedb1f76265d375a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7e8b6a4f18edee070213cb6a77118e8a412253c5" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/397430b50a363d8b7bdda00522123f82df6adc5e" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/usb/usbnet.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "b9eba0a4a527", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "524f333e9813", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "74b3b27cf9fe", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "002d82227c0a", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "492140e45d2b", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "693ecbe8f799", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "7e8b6a4f18ed", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" }, { "lessThan": "397430b50a36", "status": "affected", "version": "1da177e4c3f4", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/usb/usbnet.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.4.*", "status": "unaffected", "version": "4.4.291", "versionType": "semver" }, { "lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.289", "versionType": "semver" }, { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.254", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.215", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.157", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.77", "versionType": "semver" }, { "lessThanOrEqual": "5.14.*", "status": "unaffected", "version": "5.14.16", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.15", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: sanity check for maxpacket\n\nmaxpacket of 0 makes no sense and oopses as we need to divide\nby it. Give up.\n\nV2: fixed typo in log and stylistic issues" } ], "providerMetadata": { "dateUpdated": "2024-11-04T12:07:01.504Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/b9eba0a4a527e04d712f0e0401e5391ef124b33e" }, { "url": "https://git.kernel.org/stable/c/524f333e98138d909a0a0c574a9ff6737dce2767" }, { "url": "https://git.kernel.org/stable/c/74b3b27cf9fecce00cd8918b7882fd81191d0aa4" }, { "url": "https://git.kernel.org/stable/c/002d82227c0abe29118cf80f7e2f396b22d448ed" }, { "url": "https://git.kernel.org/stable/c/492140e45d2bf27c1014243f8616a9b612144e20" }, { "url": "https://git.kernel.org/stable/c/693ecbe8f799405f8775719deedb1f76265d375a" }, { "url": "https://git.kernel.org/stable/c/7e8b6a4f18edee070213cb6a77118e8a412253c5" }, { "url": "https://git.kernel.org/stable/c/397430b50a363d8b7bdda00522123f82df6adc5e" } ], "title": "usbnet: sanity check for maxpacket", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-47495", "datePublished": "2024-05-22T08:19:42.732Z", "dateReserved": "2024-05-22T06:20:56.202Z", "dateUpdated": "2024-11-04T12:07:01.504Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-47069
Vulnerability from cvelistv5
Published
2024-03-01 21:15
Modified
2024-11-04 11:58
Severity ?
EPSS score ?
Summary
ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2021-47069", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-21T16:15:09.996738Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-21T16:15:20.262Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T05:24:39.653Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/4528c0c323085e645b8765913b4a7fd42cf49b65" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/807fa14536b26803b858da878b643be72952a097" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a11ddb37bf367e6b5239b95ca759e5389bb46048" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "ipc/mqueue.c", "ipc/msg.c", "ipc/sem.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "4528c0c32308", "status": "affected", "version": "0d97a82ba830", "versionType": "git" }, { "lessThan": "807fa14536b2", "status": "affected", "version": "0d97a82ba830", "versionType": "git" }, { "lessThan": "a11ddb37bf36", "status": "affected", "version": "0d97a82ba830", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "ipc/mqueue.c", "ipc/msg.c", "ipc/sem.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.6" }, { "lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.40", "versionType": "semver" }, { "lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry\n\ndo_mq_timedreceive calls wq_sleep with a stack local address. The\nsender (do_mq_timedsend) uses this address to later call pipelined_send.\n\nThis leads to a very hard to trigger race where a do_mq_timedreceive\ncall might return and leave do_mq_timedsend to rely on an invalid\naddress, causing the following crash:\n\n RIP: 0010:wake_q_add_safe+0x13/0x60\n Call Trace:\n __x64_sys_mq_timedsend+0x2a9/0x490\n do_syscall_64+0x80/0x680\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n RIP: 0033:0x7f5928e40343\n\nThe race occurs as:\n\n1. do_mq_timedreceive calls wq_sleep with the address of `struct\n ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it\n holds a valid `struct ext_wait_queue *` as long as the stack has not\n been overwritten.\n\n2. `ewq_addr` gets added to info-\u003ee_wait_q[RECV].list in wq_add, and\n do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call\n __pipelined_op.\n\n3. Sender calls __pipelined_op::smp_store_release(\u0026this-\u003estate,\n STATE_READY). Here is where the race window begins. (`this` is\n `ewq_addr`.)\n\n4. If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it\n will see `state == STATE_READY` and break.\n\n5. do_mq_timedreceive returns, and `ewq_addr` is no longer guaranteed\n to be a `struct ext_wait_queue *` since it was on do_mq_timedreceive\u0027s\n stack. (Although the address may not get overwritten until another\n function happens to touch it, which means it can persist around for an\n indefinite time.)\n\n6. do_mq_timedsend::__pipelined_op() still believes `ewq_addr` is a\n `struct ext_wait_queue *`, and uses it to find a task_struct to pass to\n the wake_q_add_safe call. In the lucky case where nothing has\n overwritten `ewq_addr` yet, `ewq_addr-\u003etask` is the right task_struct.\n In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a\n bogus address as the receiver\u0027s task_struct causing the crash.\n\ndo_mq_timedsend::__pipelined_op() should not dereference `this` after\nsetting STATE_READY, as the receiver counterpart is now free to return.\nChange __pipelined_op to call wake_q_add_safe on the receiver\u0027s\ntask_struct returned by get_task_struct, instead of dereferencing `this`\nwhich sits on the receiver\u0027s stack.\n\nAs Manfred pointed out, the race potentially also exists in\nipc/msg.c::expunge_all and ipc/sem.c::wake_up_sem_queue_prepare. Fix\nthose in the same way." } ], "providerMetadata": { "dateUpdated": "2024-11-04T11:58:49.999Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/4528c0c323085e645b8765913b4a7fd42cf49b65" }, { "url": "https://git.kernel.org/stable/c/807fa14536b26803b858da878b643be72952a097" }, { "url": "https://git.kernel.org/stable/c/a11ddb37bf367e6b5239b95ca759e5389bb46048" } ], "title": "ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-47069", "datePublished": "2024-03-01T21:15:08.598Z", "dateReserved": "2024-02-29T22:33:44.296Z", "dateUpdated": "2024-11-04T11:58:49.999Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-22365
Vulnerability from cvelistv5
Published
2024-02-06 00:00
Modified
2024-08-01 22:43
Severity ?
EPSS score ?
Summary
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-22365", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-02-15T21:07:13.510998Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:52:23.208Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T22:43:34.704Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://github.com/linux-pam/linux-pam" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/01/18/3" }, { "tags": [ "x_transferred" ], "url": "https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0" }, { "tags": [ "x_transferred" ], "url": "https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2024-02-06T07:26:23.317057", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "url": "https://github.com/linux-pam/linux-pam" }, { "url": "http://www.openwall.com/lists/oss-security/2024/01/18/3" }, { "url": "https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0" }, { "url": "https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb" } ] } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2024-22365", "datePublished": "2024-02-06T00:00:00", "dateReserved": "2024-01-09T00:00:00", "dateUpdated": "2024-08-01T22:43:34.704Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35835
Vulnerability from cvelistv5
Published
2024-05-17 14:02
Modified
2024-11-06 21:08
Severity ?
EPSS score ?
Summary
net/mlx5e: fix a double-free in arfs_create_groups
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-35835", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-17T17:01:13.319923Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-06T21:08:42.977Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:48.621Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "e3d3ed8c1529", "status": "affected", "version": "1cabe6b0965e", "versionType": "git" }, { "lessThan": "2501afe6c4c9", "status": "affected", "version": "1cabe6b0965e", "versionType": "git" }, { "lessThan": "cf116d9c3c2a", "status": "affected", "version": "1cabe6b0965e", "versionType": "git" }, { "lessThan": "c57ca114eb00", "status": "affected", "version": "1cabe6b0965e", "versionType": "git" }, { "lessThan": "42876db001bb", "status": "affected", "version": "1cabe6b0965e", "versionType": "git" }, { "lessThan": "b21db3f1ab79", "status": "affected", "version": "1cabe6b0965e", "versionType": "git" }, { "lessThan": "66cc521a739c", "status": "affected", "version": "1cabe6b0965e", "versionType": "git" }, { "lessThan": "3c6d5189246f", "status": "affected", "version": "1cabe6b0965e", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.7" }, { "lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.307", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.269", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.210", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.76", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.15", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.3", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix a double-free in arfs_create_groups\n\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\nft-\u003eg and return an error. However, arfs_create_table, the only caller of\narfs_create_groups, will hold this error and call to\nmlx5e_destroy_flow_table, in which the ft-\u003eg will be freed again." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:23:18.630Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629" }, { "url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7" }, { "url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5" }, { "url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056" }, { "url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb" }, { "url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7" }, { "url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b" }, { "url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b" } ], "title": "net/mlx5e: fix a double-free in arfs_create_groups", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35835", "datePublished": "2024-05-17T14:02:23.469Z", "dateReserved": "2024-05-17T13:50:33.103Z", "dateUpdated": "2024-11-06T21:08:42.977Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35960
Vulnerability from cvelistv5
Published
2024-05-20 09:41
Modified
2024-11-05 09:25
Severity ?
EPSS score ?
Summary
net/mlx5: Properly link new fs rules into the tree
References
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "de0139719cdd", "status": "affected", "version": "74491de93712", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "3d90ca9145f6", "status": "affected", "version": "74491de93712", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "7aaee12b804c", "status": "affected", "version": "74491de93712", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "2e8dc5cffc84", "status": "affected", "version": "74491de93712", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "5cf5337ef701", "status": "affected", "version": "74491de93712", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "adf67a03af39", "status": "affected", "version": "74491de93712", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "7c6782ad4911", "status": "affected", "version": "74491de93712", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "affected", "version": "4.10" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "4.20", "status": "unaffected", "version": "4.19.313", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "5.5", "status": "unaffected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "5.11", "status": "unaffected", "version": "5.10.216", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "5.16", "status": "unaffected", "version": "5.15.156", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "6.2", "status": "unaffected", "version": "6.1.87", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "6.7", "status": "unaffected", "version": "6.6.28", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "lessThanOrEqual": "6.9", "status": "unaffected", "version": "6.8.7", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unaffected", "version": "6.9" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-35960", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-18T14:49:37.756975Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-18T16:47:23.146Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:49.117Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/de0139719cdda82806a47580ca0df06fc85e0bd2" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1263b0b26077b1183c3c45a0a2479573a351d423" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/3d90ca9145f6b97b38d0c2b6b30f6ca6af9c1801" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7aaee12b804c5e0374e7b132b6ec2158ff33dd64" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2e8dc5cffc844dacfa79f056dea88002312f253f" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5cf5337ef701830f173b4eec00a4f984adeb57a0" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/adf67a03af39095f05d82050f15813d6f700159d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/7c6782ad4911cbee874e85630226ed389ff2e453" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "de0139719cdd", "status": "affected", "version": "74491de93712", "versionType": "git" }, { "lessThan": "1263b0b26077", "status": "affected", "version": "74491de93712", "versionType": "git" }, { "lessThan": "3d90ca9145f6", "status": "affected", "version": "74491de93712", "versionType": "git" }, { "lessThan": "7aaee12b804c", "status": "affected", "version": "74491de93712", "versionType": "git" }, { "lessThan": "2e8dc5cffc84", "status": "affected", "version": "74491de93712", "versionType": "git" }, { "lessThan": "5cf5337ef701", "status": "affected", "version": "74491de93712", "versionType": "git" }, { "lessThan": "adf67a03af39", "status": "affected", "version": "74491de93712", "versionType": "git" }, { "lessThan": "7c6782ad4911", "status": "affected", "version": "74491de93712", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.10" }, { "lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.313", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.275", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.216", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.156", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.87", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.28", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Properly link new fs rules into the tree\n\nPreviously, add_rule_fg would only add newly created rules from the\nhandle into the tree when they had a refcount of 1. On the other hand,\ncreate_flow_handle tries hard to find and reference already existing\nidentical rules instead of creating new ones.\n\nThese two behaviors can result in a situation where create_flow_handle\n1) creates a new rule and references it, then\n2) in a subsequent step during the same handle creation references it\n again,\nresulting in a rule with a refcount of 2 that is not linked into the\ntree, will have a NULL parent and root and will result in a crash when\nthe flow group is deleted because del_sw_hw_rule, invoked on rule\ndeletion, assumes node-\u003eparent is != NULL.\n\nThis happened in the wild, due to another bug related to incorrect\nhandling of duplicate pkt_reformat ids, which lead to the code in\ncreate_flow_handle incorrectly referencing a just-added rule in the same\nflow handle, resulting in the problem described above. Full details are\nat [1].\n\nThis patch changes add_rule_fg to add new rules without parents into\nthe tree, properly initializing them and avoiding the crash. This makes\nit more consistent with how rules are added to an FTE in\ncreate_flow_handle." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:25:47.057Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/de0139719cdda82806a47580ca0df06fc85e0bd2" }, { "url": "https://git.kernel.org/stable/c/1263b0b26077b1183c3c45a0a2479573a351d423" }, { "url": "https://git.kernel.org/stable/c/3d90ca9145f6b97b38d0c2b6b30f6ca6af9c1801" }, { "url": "https://git.kernel.org/stable/c/7aaee12b804c5e0374e7b132b6ec2158ff33dd64" }, { "url": "https://git.kernel.org/stable/c/2e8dc5cffc844dacfa79f056dea88002312f253f" }, { "url": "https://git.kernel.org/stable/c/5cf5337ef701830f173b4eec00a4f984adeb57a0" }, { "url": "https://git.kernel.org/stable/c/adf67a03af39095f05d82050f15813d6f700159d" }, { "url": "https://git.kernel.org/stable/c/7c6782ad4911cbee874e85630226ed389ff2e453" } ], "title": "net/mlx5: Properly link new fs rules into the tree", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35960", "datePublished": "2024-05-20T09:41:51.900Z", "dateReserved": "2024-05-17T13:50:33.137Z", "dateUpdated": "2024-11-05T09:25:47.057Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-4692
Vulnerability from cvelistv5
Published
2023-10-25 10:27
Modified
2024-11-23 03:30
Severity ?
EPSS score ?
Summary
Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution
References
▼ | URL | Tags |
---|---|---|
https://access.redhat.com/errata/RHSA-2024:2456 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2024:3184 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/security/cve/CVE-2023-4692 | vdb-entry, x_refsource_REDHAT | |
https://bugzilla.redhat.com/show_bug.cgi?id=2236613 | issue-tracking, x_refsource_REDHAT | |
https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager/ | ||
https://lists.gnu.org/archive/html/grub-devel/2023-10/msg00028.html | ||
https://seclists.org/oss-sec/2023/q4/37 |
Impacted products
Vendor | Product | Version | |||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ |
Patch: 2.12 |
||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:37:59.322Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2024:2456", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:2456" }, { "name": "RHSA-2024:3184", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2024:3184" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/security/cve/CVE-2023-4692" }, { "name": "RHBZ#2236613", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236613" }, { "tags": [ "x_transferred" ], "url": "https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUU42E7CPYLATXOYVYNW6YTXXULAOV6L/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRJ5UZRXX2KLR4IKBJEQUNGOCXMMDLY/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PERFILCHFEUGG3OAMC6W55P6DDIBZK4Q/" }, { "tags": [ "x_transferred" ], "url": "https://lists.gnu.org/archive/html/grub-devel/2023-10/msg00028.html" }, { "tags": [ "x_transferred" ], "url": "https://seclists.org/oss-sec/2023/q4/37" }, { "tags": [ "x_transferred" ], "url": "https://security.gentoo.org/glsa/202311-14" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20231208-0002/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://git.savannah.gnu.org/git/grub.git/", "packageName": "grub", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "2.12", "versionType": "custom" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::baseos" ], "defaultStatus": "affected", "packageName": "grub2", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1:2.02-156.el8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::baseos" ], "defaultStatus": "affected", "packageName": "grub2", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1:2.06-77.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "grub2", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" } ], "datePublic": "2023-10-03T00:00:00+00:00", "descriptions": [ { "lang": "en", "value": "An out-of-bounds write flaw was found in grub2\u0027s NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub\u0027s heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Low" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-122", "description": "Heap-based Buffer Overflow", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-23T03:30:14.176Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2024:2456", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:2456" }, { "name": "RHSA-2024:3184", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:3184" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2023-4692" }, { "name": "RHBZ#2236613", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236613" }, { "url": "https://dfir.ru/2023/10/03/cve-2023-4692-cve-2023-4693-vulnerabilities-in-the-grub-boot-manager/" }, { "url": "https://lists.gnu.org/archive/html/grub-devel/2023-10/msg00028.html" }, { "url": "https://seclists.org/oss-sec/2023/q4/37" } ], "timeline": [ { "lang": "en", "time": "2023-08-31T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2023-10-03T00:00:00+00:00", "value": "Made public." } ], "title": "Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution", "x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2023-4692", "datePublished": "2023-10-25T10:27:29.173Z", "dateReserved": "2023-08-31T21:53:09.692Z", "dateUpdated": "2024-11-23T03:30:14.176Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-26759
Vulnerability from cvelistv5
Published
2024-04-03 17:00
Modified
2024-11-05 09:15
Severity ?
EPSS score ?
Summary
mm/swap: fix race when skipping swapcache
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-26759", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-04-08T14:03:53.009974Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:49:35.865Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:14:13.279Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "include/linux/swap.h", "mm/memory.c", "mm/swap.h", "mm/swapfile.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "2dedda77d449", "status": "affected", "version": "0bcac06f27d7", "versionType": "git" }, { "lessThan": "305152314df8", "status": "affected", "version": "0bcac06f27d7", "versionType": "git" }, { "lessThan": "d183a4631acf", "status": "affected", "version": "0bcac06f27d7", "versionType": "git" }, { "lessThan": "13ddaf26be32", "status": "affected", "version": "0bcac06f27d7", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "include/linux/swap.h", "mm/memory.c", "mm/swap.h", "mm/swapfile.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.15" }, { "lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.80", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.19", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swap: fix race when skipping swapcache\n\nWhen skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads\nswapin the same entry at the same time, they get different pages (A, B). \nBefore one thread (T0) finishes the swapin and installs page (A) to the\nPTE, another thread (T1) could finish swapin of page (B), swap_free the\nentry, then swap out the possibly modified page reusing the same entry. \nIt breaks the pte_same check in (T0) because PTE value is unchanged,\ncausing ABA problem. Thread (T0) will install a stalled page (A) into the\nPTE and cause data corruption.\n\nOne possible callstack is like this:\n\nCPU0 CPU1\n---- ----\ndo_swap_page() do_swap_page() with same entry\n\u003cdirect swapin path\u003e \u003cdirect swapin path\u003e\n\u003calloc page A\u003e \u003calloc page B\u003e\nswap_read_folio() \u003c- read to page A swap_read_folio() \u003c- read to page B\n\u003cslow on later locks or interrupt\u003e \u003cfinished swapin first\u003e\n... set_pte_at()\n swap_free() \u003c- entry is free\n \u003cwrite to page B, now page A stalled\u003e\n \u003cswap out page B to same swap entry\u003e\npte_same() \u003c- Check pass, PTE seems\n unchanged, but page A\n is stalled!\nswap_free() \u003c- page B content lost!\nset_pte_at() \u003c- staled page A installed!\n\nAnd besides, for ZRAM, swap_free() allows the swap device to discard the\nentry content, so even if page (B) is not modified, if swap_read_folio()\non CPU0 happens later than swap_free() on CPU1, it may also cause data\nloss.\n\nTo fix this, reuse swapcache_prepare which will pin the swap entry using\nthe cache flag, and allow only one thread to swap it in, also prevent any\nparallel code from putting the entry in the cache. Release the pin after\nPT unlocked.\n\nRacers just loop and wait since it\u0027s a rare and very short event. A\nschedule_timeout_uninterruptible(1) call is added to avoid repeated page\nfaults wasting too much CPU, causing livelock or adding too much noise to\nperf statistics. A similar livelock issue was described in commit\n029c4628b2eb (\"mm: swap: get rid of livelock in swapin readahead\")\n\nReproducer:\n\nThis race issue can be triggered easily using a well constructed\nreproducer and patched brd (with a delay in read path) [1]:\n\nWith latest 6.8 mainline, race caused data loss can be observed easily:\n$ gcc -g -lpthread test-thread-swap-race.c \u0026\u0026 ./a.out\n Polulating 32MB of memory region...\n Keep swapping out...\n Starting round 0...\n Spawning 65536 workers...\n 32746 workers spawned, wait for done...\n Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss!\n Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss!\n Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss!\n Round 0 Failed, 15 data loss!\n\nThis reproducer spawns multiple threads sharing the same memory region\nusing a small swap device. Every two threads updates mapped pages one by\none in opposite direction trying to create a race, with one dedicated\nthread keep swapping out the data out using madvise.\n\nThe reproducer created a reproduce rate of about once every 5 minutes, so\nthe race should be totally possible in production.\n\nAfter this patch, I ran the reproducer for over a few hundred rounds and\nno data loss observed.\n\nPerformance overhead is minimal, microbenchmark swapin 10G from 32G\nzram:\n\nBefore: 10934698 us\nAfter: 11157121 us\nCached: 13155355 us (Dropping SWP_SYNCHRONOUS_IO flag)\n\n[kasong@tencent.com: v4]\n Link: https://lkml.kernel.org/r/20240219082040.7495-1-ryncsn@gmail.com" } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:15:13.980Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95" }, { "url": "https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a" }, { "url": "https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d" }, { "url": "https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458" } ], "title": "mm/swap: fix race when skipping swapcache", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-26759", "datePublished": "2024-04-03T17:00:43.288Z", "dateReserved": "2024-02-19T14:20:24.170Z", "dateUpdated": "2024-11-05T09:15:13.980Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35845
Vulnerability from cvelistv5
Published
2024-05-17 14:40
Modified
2024-11-05 09:23
Severity ?
EPSS score ?
Summary
wifi: iwlwifi: dbg-tlv: ensure NUL termination
References
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "affected", "version": "a9248de42464" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "affected", "version": "5.5" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "0" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "5.10.214" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "5.15.153" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "6.1.83" } ] }, { "cpes": [ "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "6.6.23" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "6.7.11" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "6.8.2" } ] }, { "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [ { "status": "unknown", "version": "6.9" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-35845", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-17T17:22:01.418573Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-134", "description": "CWE-134 Use of Externally-Controlled Format String", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:33:54.776Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:21:48.557Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/fabe2db7de32a881e437ee69db32e0de785a6209" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/96aa40761673da045a7774f874487cdb50c6a2f7" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c855a1a5b7e3de57e6b1b29563113d5e3bfdb89a" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/783d413f332a3ebec916664b366c28f58147f82c" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/fec14d1cdd92f340b9ba2bd220abf96f9609f2a9" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/71d4186d470e9cda7cd1a0921b4afda737c6f641" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "fabe2db7de32", "status": "affected", "version": "a9248de42464", "versionType": "git" }, { "lessThan": "96aa40761673", "status": "affected", "version": "a9248de42464", "versionType": "git" }, { "lessThan": "c855a1a5b7e3", "status": "affected", "version": "a9248de42464", "versionType": "git" }, { "lessThan": "783d413f332a", "status": "affected", "version": "a9248de42464", "versionType": "git" }, { "lessThan": "fec14d1cdd92", "status": "affected", "version": "a9248de42464", "versionType": "git" }, { "lessThan": "71d4186d470e", "status": "affected", "version": "a9248de42464", "versionType": "git" }, { "lessThan": "ea1d166fae14", "status": "affected", "version": "a9248de42464", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.5" }, { "lessThan": "5.5", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.214", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.153", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.83", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.23", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.11", "versionType": "semver" }, { "lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.2", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: dbg-tlv: ensure NUL termination\n\nThe iwl_fw_ini_debug_info_tlv is used as a string, so we must\nensure the string is terminated correctly before using it." } ], "providerMetadata": { "dateUpdated": "2024-11-05T09:23:36.255Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/fabe2db7de32a881e437ee69db32e0de785a6209" }, { "url": "https://git.kernel.org/stable/c/96aa40761673da045a7774f874487cdb50c6a2f7" }, { "url": "https://git.kernel.org/stable/c/c855a1a5b7e3de57e6b1b29563113d5e3bfdb89a" }, { "url": "https://git.kernel.org/stable/c/783d413f332a3ebec916664b366c28f58147f82c" }, { "url": "https://git.kernel.org/stable/c/fec14d1cdd92f340b9ba2bd220abf96f9609f2a9" }, { "url": "https://git.kernel.org/stable/c/71d4186d470e9cda7cd1a0921b4afda737c6f641" }, { "url": "https://git.kernel.org/stable/c/ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea" } ], "title": "wifi: iwlwifi: dbg-tlv: ensure NUL termination", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-35845", "datePublished": "2024-05-17T14:40:12.134Z", "dateReserved": "2024-05-17T13:50:33.105Z", "dateUpdated": "2024-11-05T09:23:36.255Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-52675
Vulnerability from cvelistv5
Published
2024-05-17 14:24
Modified
2024-11-04 14:50
Severity ?
EPSS score ?
Summary
powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-52675", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-17T17:39:04.688861Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-17T17:42:18.376Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T23:11:35.401Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/75fc599bcdcb1de093c9ced2e3cccc832f3787f3" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/1e80aa25d186a7aa212df5acd8c75f55ac8dae34" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/5a669f3511d273c8c1ab1c1d268fbcdf53fc7a05" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/f105c263009839d80fad6998324a4e1b3511cba0" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a2da3f9b1a1019c887ee1d164475a8fcdb0a3fec" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/024352f7928b28f53609660663329d8c0f4ad032" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c7d828e12b326ea50fb80c369d7aa87519ed14c6" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0a233867a39078ebb0f575e2948593bbff5826b3" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/powerpc/perf/imc-pmu.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "75fc599bcdcb", "status": "affected", "version": "885dcd709ba9", "versionType": "git" }, { "lessThan": "1e80aa25d186", "status": "affected", "version": "885dcd709ba9", "versionType": "git" }, { "lessThan": "5a669f3511d2", "status": "affected", "version": "885dcd709ba9", "versionType": "git" }, { "lessThan": "f105c2630098", "status": "affected", "version": "885dcd709ba9", "versionType": "git" }, { "lessThan": "a2da3f9b1a10", "status": "affected", "version": "885dcd709ba9", "versionType": "git" }, { "lessThan": "024352f7928b", "status": "affected", "version": "885dcd709ba9", "versionType": "git" }, { "lessThan": "c7d828e12b32", "status": "affected", "version": "885dcd709ba9", "versionType": "git" }, { "lessThan": "0a233867a390", "status": "affected", "version": "885dcd709ba9", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/powerpc/perf/imc-pmu.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.14" }, { "lessThan": "4.14", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.306", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.268", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.209", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.148", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.75", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.14", "versionType": "semver" }, { "lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.2", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/imc-pmu: Add a null pointer check in update_events_in_group()\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure." } ], "providerMetadata": { "dateUpdated": "2024-11-04T14:50:54.528Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/75fc599bcdcb1de093c9ced2e3cccc832f3787f3" }, { "url": "https://git.kernel.org/stable/c/1e80aa25d186a7aa212df5acd8c75f55ac8dae34" }, { "url": "https://git.kernel.org/stable/c/5a669f3511d273c8c1ab1c1d268fbcdf53fc7a05" }, { "url": "https://git.kernel.org/stable/c/f105c263009839d80fad6998324a4e1b3511cba0" }, { "url": "https://git.kernel.org/stable/c/a2da3f9b1a1019c887ee1d164475a8fcdb0a3fec" }, { "url": "https://git.kernel.org/stable/c/024352f7928b28f53609660663329d8c0f4ad032" }, { "url": "https://git.kernel.org/stable/c/c7d828e12b326ea50fb80c369d7aa87519ed14c6" }, { "url": "https://git.kernel.org/stable/c/0a233867a39078ebb0f575e2948593bbff5826b3" } ], "title": "powerpc/imc-pmu: Add a null pointer check in update_events_in_group()", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2023-52675", "datePublished": "2024-05-17T14:24:40.721Z", "dateReserved": "2024-03-07T14:49:46.886Z", "dateUpdated": "2024-11-04T14:50:54.528Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-46972
Vulnerability from cvelistv5
Published
2024-02-27 18:47
Modified
2024-11-04 11:56
Severity ?
EPSS score ?
Summary
ovl: fix leaked dentry
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2021-46972", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-28T17:00:35.229463Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-28T17:00:43.713Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T05:17:42.888Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/71d58457a8afc650da5d3292a7f7029317654d95" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/cf3e3330bc5719fa9d658e3e2f596bde89344a94" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/d587cfaef72b1b6f4b2774827123bce91f497cc8" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/eaab1d45cdb4bb0c846bd23c3d666d5b90af7b41" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/overlayfs/namei.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "71d58457a8af", "status": "affected", "version": "6815f479ca90", "versionType": "git" }, { "lessThan": "cf3e3330bc57", "status": "affected", "version": "6815f479ca90", "versionType": "git" }, { "lessThan": "d587cfaef72b", "status": "affected", "version": "6815f479ca90", "versionType": "git" }, { "lessThan": "eaab1d45cdb4", "status": "affected", "version": "6815f479ca90", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/overlayfs/namei.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.8" }, { "lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.35", "versionType": "semver" }, { "lessThanOrEqual": "5.11.*", "status": "unaffected", "version": "5.11.19", "versionType": "semver" }, { "lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.2", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix leaked dentry\n\nSince commit 6815f479ca90 (\"ovl: use only uppermetacopy state in\novl_lookup()\"), overlayfs doesn\u0027t put temporary dentry when there is a\nmetacopy error, which leads to dentry leaks when shutting down the related\nsuperblock:\n\n overlayfs: refusing to follow metacopy origin for (/file0)\n ...\n BUG: Dentry (____ptrval____){i=3f33,n=file3} still in use (1) [unmount of overlay overlay]\n ...\n WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d\n CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1\n ...\n RIP: 0010:umount_check.cold+0x107/0x14d\n ...\n Call Trace:\n d_walk+0x28c/0x950\n ? dentry_lru_isolate+0x2b0/0x2b0\n ? __kasan_slab_free+0x12/0x20\n do_one_tree+0x33/0x60\n shrink_dcache_for_umount+0x78/0x1d0\n generic_shutdown_super+0x70/0x440\n kill_anon_super+0x3e/0x70\n deactivate_locked_super+0xc4/0x160\n deactivate_super+0xfa/0x140\n cleanup_mnt+0x22e/0x370\n __cleanup_mnt+0x1a/0x30\n task_work_run+0x139/0x210\n do_exit+0xb0c/0x2820\n ? __kasan_check_read+0x1d/0x30\n ? find_held_lock+0x35/0x160\n ? lock_release+0x1b6/0x660\n ? mm_update_next_owner+0xa20/0xa20\n ? reacquire_held_locks+0x3f0/0x3f0\n ? __sanitizer_cov_trace_const_cmp4+0x22/0x30\n do_group_exit+0x135/0x380\n __do_sys_exit_group.isra.0+0x20/0x20\n __x64_sys_exit_group+0x3c/0x50\n do_syscall_64+0x45/0x70\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n ...\n VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds. Have a nice day...\n\nThis fix has been tested with a syzkaller reproducer." } ], "providerMetadata": { "dateUpdated": "2024-11-04T11:56:55.701Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/71d58457a8afc650da5d3292a7f7029317654d95" }, { "url": "https://git.kernel.org/stable/c/cf3e3330bc5719fa9d658e3e2f596bde89344a94" }, { "url": "https://git.kernel.org/stable/c/d587cfaef72b1b6f4b2774827123bce91f497cc8" }, { "url": "https://git.kernel.org/stable/c/eaab1d45cdb4bb0c846bd23c3d666d5b90af7b41" } ], "title": "ovl: fix leaked dentry", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-46972", "datePublished": "2024-02-27T18:47:07.276Z", "dateReserved": "2024-02-27T18:42:55.943Z", "dateUpdated": "2024-11-04T11:56:55.701Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-47310
Vulnerability from cvelistv5
Published
2024-05-21 14:35
Modified
2024-11-04 12:03
Severity ?
EPSS score ?
Summary
net: ti: fix UAF in tlan_remove_one
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2021-47310", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-21T15:35:38.649783Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:14:17.488Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-04T05:32:08.440Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a18a8d9cfbb112ad72e625372849adc3986fd6bf" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/c263ae8c7e4c482387de5e6c89e213f8173fe8b6" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0538b0ab7d2c396e385694228c7cdcd2d2c514e9" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/a0a817b2d308fac090a05cbbe80988e073ac5193" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/b7e5563f2a7862a9e4796abb9908b092f677e3c1" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/f2a062fcfe1d6f1b0a86fa76ae21c277d65f4405" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/93efab0ef2a607fff9166d447c4035f98b5db342" }, { "tags": [ "x_transferred" ], "url": "https://git.kernel.org/stable/c/0336f8ffece62f882ab3012820965a786a983f70" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/ti/tlan.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "a18a8d9cfbb1", "status": "affected", "version": "1e0a8b13d355", "versionType": "git" }, { "lessThan": "c263ae8c7e4c", "status": "affected", "version": "1e0a8b13d355", "versionType": "git" }, { "lessThan": "0538b0ab7d2c", "status": "affected", "version": "1e0a8b13d355", "versionType": "git" }, { "lessThan": "a0a817b2d308", "status": "affected", "version": "1e0a8b13d355", "versionType": "git" }, { "lessThan": "b7e5563f2a78", "status": "affected", "version": "1e0a8b13d355", "versionType": "git" }, { "lessThan": "f2a062fcfe1d", "status": "affected", "version": "1e0a8b13d355", "versionType": "git" }, { "lessThan": "93efab0ef2a6", "status": "affected", "version": "1e0a8b13d355", "versionType": "git" }, { "lessThan": "0336f8ffece6", "status": "affected", "version": "1e0a8b13d355", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/ethernet/ti/tlan.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.10" }, { "lessThan": "3.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.4.*", "status": "unaffected", "version": "4.4.277", "versionType": "semver" }, { "lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.277", "versionType": "semver" }, { "lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.241", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.199", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.135", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.53", "versionType": "semver" }, { "lessThanOrEqual": "5.13.*", "status": "unaffected", "version": "5.13.5", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "5.14", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ti: fix UAF in tlan_remove_one\n\npriv is netdev private data and it cannot be\nused after free_netdev() call. Using priv after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction." } ], "providerMetadata": { "dateUpdated": "2024-11-04T12:03:27.584Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/a18a8d9cfbb112ad72e625372849adc3986fd6bf" }, { "url": "https://git.kernel.org/stable/c/c263ae8c7e4c482387de5e6c89e213f8173fe8b6" }, { "url": "https://git.kernel.org/stable/c/0538b0ab7d2c396e385694228c7cdcd2d2c514e9" }, { "url": "https://git.kernel.org/stable/c/a0a817b2d308fac090a05cbbe80988e073ac5193" }, { "url": "https://git.kernel.org/stable/c/b7e5563f2a7862a9e4796abb9908b092f677e3c1" }, { "url": "https://git.kernel.org/stable/c/f2a062fcfe1d6f1b0a86fa76ae21c277d65f4405" }, { "url": "https://git.kernel.org/stable/c/93efab0ef2a607fff9166d447c4035f98b5db342" }, { "url": "https://git.kernel.org/stable/c/0336f8ffece62f882ab3012820965a786a983f70" } ], "title": "net: ti: fix UAF in tlan_remove_one", "x_generator": { "engine": "bippy-9e1c9544281a" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2021-47310", "datePublished": "2024-05-21T14:35:28.649Z", "dateReserved": "2024-05-21T14:28:16.972Z", "dateUpdated": "2024-11-04T12:03:27.584Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.