Action not permitted
Modal body text goes here.
wid-sec-w-2024-2133
Vulnerability from csaf_certbund
Published
2024-09-12 22:00
Modified
2024-09-12 22:00
Summary
Linux Kernel: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder einen unspezifischen Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Der Kernel stellt den Kern des Linux Betriebssystems dar.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren oder einen unspezifischen Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-2133 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2133.json" }, { "category": "self", "summary": "WID-SEC-2024-2133 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2133" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46675 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091335-CVE-2024-46675-ba70@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46676 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091335-CVE-2024-46676-0b05@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46677 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091336-CVE-2024-46677-b53c@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46678 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091336-CVE-2024-46678-ca65@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46679 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091336-CVE-2024-46679-3527@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46680 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091336-CVE-2024-46680-f40d@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46681 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091337-CVE-2024-46681-6086@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46682 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091337-CVE-2024-46682-df82@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46684 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091337-CVE-2024-46684-d492@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46685 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091338-CVE-2024-46685-6606@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46686 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091338-CVE-2024-46686-5b18@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46687 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091338-CVE-2024-46687-5668@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46688 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091338-CVE-2024-46688-7a5a@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46689 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091339-CVE-2024-46689-4c19@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46690 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091339-CVE-2024-46690-38b2@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46691 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091339-CVE-2024-46691-93e1@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46692 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091339-CVE-2024-46692-f287@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46693 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091340-CVE-2024-46693-cbe3@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46694 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091340-CVE-2024-46694-0706@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46695 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091340-CVE-2024-46695-affc@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46696 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091340-CVE-2024-46696-a8c1@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46697 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091341-CVE-2024-46697-d166@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46698 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091341-CVE-2024-46698-357c@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46699 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091341-CVE-2024-46699-b1cf@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcement CVE-2024-46700 vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/2024091341-CVE-2024-46700-ed8e@gregkh/" }, { "category": "external", "summary": "Linux Kernel CVE Announcements vom 2024-09-12", "url": "https://lore.kernel.org/linux-cve-announce/" } ], "source_lang": "en-US", "title": "Linux Kernel: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-09-12T22:00:00.000+00:00", "generator": { "date": "2024-09-13T08:08:43.122+00:00", "engine": { "name": "BSI-WID", "version": "1.3.6" } }, "id": "WID-SEC-W-2024-2133", "initial_release_date": "2024-09-12T22:00:00.000+00:00", "revision_history": [ { "date": "2024-09-12T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Open Source Linux Kernel", "product": { "name": "Open Source Linux Kernel", "product_id": "T033107", "product_identification_helper": { "cpe": "cpe:/o:linux:linux_kernel:-" } } } ], "category": "vendor", "name": "Open Source" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-46673", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46673" }, { "cve": "CVE-2024-46674", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46674" }, { "cve": "CVE-2024-46675", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46675" }, { "cve": "CVE-2024-46676", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46676" }, { "cve": "CVE-2024-46677", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46677" }, { "cve": "CVE-2024-46678", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46678" }, { "cve": "CVE-2024-46679", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46679" }, { "cve": "CVE-2024-46680", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46680" }, { "cve": "CVE-2024-46681", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46681" }, { "cve": "CVE-2024-46682", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46682" }, { "cve": "CVE-2024-46683", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46683" }, { "cve": "CVE-2024-46684", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46684" }, { "cve": "CVE-2024-46685", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46685" }, { "cve": "CVE-2024-46686", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46686" }, { "cve": "CVE-2024-46687", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46687" }, { "cve": "CVE-2024-46688", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46688" }, { "cve": "CVE-2024-46689", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46689" }, { "cve": "CVE-2024-46690", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46690" }, { "cve": "CVE-2024-46691", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46691" }, { "cve": "CVE-2024-46692", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46692" }, { "cve": "CVE-2024-46693", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46693" }, { "cve": "CVE-2024-46694", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46694" }, { "cve": "CVE-2024-46695", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46695" }, { "cve": "CVE-2024-46696", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46696" }, { "cve": "CVE-2024-46697", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46697" }, { "cve": "CVE-2024-46698", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46698" }, { "cve": "CVE-2024-46699", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46699" }, { "cve": "CVE-2024-46700", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46700" }, { "cve": "CVE-2024-46701", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46701" }, { "cve": "CVE-2024-46702", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46702" }, { "cve": "CVE-2024-46703", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46703" }, { "cve": "CVE-2024-46704", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46704" }, { "cve": "CVE-2024-46705", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46705" }, { "cve": "CVE-2024-46706", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46706" }, { "cve": "CVE-2024-46707", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46707" }, { "cve": "CVE-2024-46708", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46708" }, { "cve": "CVE-2024-46709", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46709" }, { "cve": "CVE-2024-46710", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46710" }, { "cve": "CVE-2024-46711", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46711" }, { "cve": "CVE-2024-46712", "notes": [ { "category": "description", "text": "Im Linux-Kernel bestehen mehrere Schwachstellen. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie Bluetooth, Video/Aperture oder Ethtool, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer Use-after-free-, einer NULL-Zeiger-Dereferenz oder einer fehlenden Berechtigungspr\u00fcfung und mehr. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuf\u00fchren." } ], "product_status": { "known_affected": [ "T033107" ] }, "release_date": "2024-09-12T22:00:00.000+00:00", "title": "CVE-2024-46712" } ] }
cve-2024-46684
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46684", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:08:43.171193Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:08:57.536Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/binfmt_elf_fdpic.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c507da85e4f80c630deb9e98222ccf4118cbe6f8", "status": "affected", "version": "10e29251be0e9f774910c1baaa89355859491769", "versionType": "git" }, { "lessThan": "c6a09e342f8e6d3cac7f7c5c14085236aca284b9", "status": "affected", "version": "10e29251be0e9f774910c1baaa89355859491769", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/binfmt_elf_fdpic.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined\n\ncreate_elf_fdpic_tables() does not correctly account the space for the\nAUX vector when an architecture has ELF_HWCAP2 defined. Prior to the\ncommit 10e29251be0e (\"binfmt_elf_fdpic: fix /proc/\u003cpid\u003e/auxv\") it\nresulted in the last entry of the AUX vector being set to zero, but with\nthat change it results in a kernel BUG.\n\nFix that by adding one to the number of AUXV entries (nitems) when\nELF_HWCAP2 is defined." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:54.842Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c507da85e4f80c630deb9e98222ccf4118cbe6f8" }, { "url": "https://git.kernel.org/stable/c/c6a09e342f8e6d3cac7f7c5c14085236aca284b9" } ], "title": "binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46684", "datePublished": "2024-09-13T05:29:16.556Z", "dateReserved": "2024-09-11T15:12:18.248Z", "dateUpdated": "2024-12-19T09:20:54.842Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46681
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
pktgen: use cpus_read_lock() in pg_net_init()
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46681", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:09:32.507756Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:09:47.290Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/core/pktgen.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "5f5f7366dda8ae870e8305d6e7b3c0c2686cd2cf", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "979b581e4c69257acab1af415ddad6b2d78a2fa5", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/core/pktgen.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.12" }, { "lessThan": "2.6.12", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npktgen: use cpus_read_lock() in pg_net_init()\n\nI have seen the WARN_ON(smp_processor_id() != cpu) firing\nin pktgen_thread_worker() during tests.\n\nWe must use cpus_read_lock()/cpus_read_unlock()\naround the for_each_online_cpu(cpu) loop.\n\nWhile we are at it use WARN_ON_ONCE() to avoid a possible syslog flood." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:51.215Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/5f5f7366dda8ae870e8305d6e7b3c0c2686cd2cf" }, { "url": "https://git.kernel.org/stable/c/979b581e4c69257acab1af415ddad6b2d78a2fa5" } ], "title": "pktgen: use cpus_read_lock() in pg_net_init()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46681", "datePublished": "2024-09-13T05:29:14.671Z", "dateReserved": "2024-09-11T15:12:18.248Z", "dateUpdated": "2024-12-19T09:20:51.215Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46682
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46682", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:09:15.742949Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:09:29.944Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/nfsd/nfs4state.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "ba0b697de298285301c71c258598226e06494236", "status": "affected", "version": "3f29cc82a84c23cfd12b903029dd26002ca825f5", "versionType": "git" }, { "lessThan": "a204501e1743d695ca2930ed25a2be9f8ced96d3", "status": "affected", "version": "3f29cc82a84c23cfd12b903029dd26002ca825f5", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/nfsd/nfs4state.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.9" }, { "lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open\n\nPrior to commit 3f29cc82a84c (\"nfsd: split sc_status out of\nsc_type\") states_show() relied on sc_type field to be of valid\ntype before calling into a subfunction to show content of a\nparticular stateid. From that commit, we split the validity of\nthe stateid into sc_status and no longer changed sc_type to 0\nwhile unhashing the stateid. This resulted in kernel oopsing\nfor nfsv4.0 opens that stay around and in nfs4_show_open()\nwould derefence sc_file which was NULL.\n\nInstead, for closed open stateids forgo displaying information\nthat relies of having a valid sc_file.\n\nTo reproduce: mount the server with 4.0, read and close\na file and then on the server cat /proc/fs/nfsd/clients/2/states\n\n[ 513.590804] Call trace:\n[ 513.590925] _raw_spin_lock+0xcc/0x160\n[ 513.591119] nfs4_show_open+0x78/0x2c0 [nfsd]\n[ 513.591412] states_show+0x44c/0x488 [nfsd]\n[ 513.591681] seq_read_iter+0x5d8/0x760\n[ 513.591896] seq_read+0x188/0x208\n[ 513.592075] vfs_read+0x148/0x470\n[ 513.592241] ksys_read+0xcc/0x178" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:52.369Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/ba0b697de298285301c71c258598226e06494236" }, { "url": "https://git.kernel.org/stable/c/a204501e1743d695ca2930ed25a2be9f8ced96d3" } ], "title": "nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46682", "datePublished": "2024-09-13T05:29:15.294Z", "dateReserved": "2024-09-11T15:12:18.248Z", "dateUpdated": "2024-12-19T09:20:52.369Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46699
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
drm/v3d: Disable preemption while updating GPU stats
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46699", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:04:43.522963Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:04:58.484Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_sched.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "1e93467ef20308da5a94cde548ee17d523e8ba7b", "status": "affected", "version": "6abe93b621ab12e93cf0eb7e42a609b36be32da1", "versionType": "git" }, { "lessThan": "9d824c7fce58f59982228aa85b0376b113cdfa35", "status": "affected", "version": "6abe93b621ab12e93cf0eb7e42a609b36be32da1", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/v3d/v3d_sched.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Disable preemption while updating GPU stats\n\nWe forgot to disable preemption around the write_seqcount_begin/end() pair\nwhile updating GPU stats:\n\n [ ] WARNING: CPU: 2 PID: 12 at include/linux/seqlock.h:221 __seqprop_assert.isra.0+0x128/0x150 [v3d]\n [ ] Workqueue: v3d_bin drm_sched_run_job_work [gpu_sched]\n \u003c...snip...\u003e\n [ ] Call trace:\n [ ] __seqprop_assert.isra.0+0x128/0x150 [v3d]\n [ ] v3d_job_start_stats.isra.0+0x90/0x218 [v3d]\n [ ] v3d_bin_job_run+0x23c/0x388 [v3d]\n [ ] drm_sched_run_job_work+0x520/0x6d0 [gpu_sched]\n [ ] process_one_work+0x62c/0xb48\n [ ] worker_thread+0x468/0x5b0\n [ ] kthread+0x1c4/0x1e0\n [ ] ret_from_fork+0x10/0x20\n\nFix it." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:14.370Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/1e93467ef20308da5a94cde548ee17d523e8ba7b" }, { "url": "https://git.kernel.org/stable/c/9d824c7fce58f59982228aa85b0376b113cdfa35" } ], "title": "drm/v3d: Disable preemption while updating GPU stats", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46699", "datePublished": "2024-09-13T05:29:25.995Z", "dateReserved": "2024-09-11T15:12:18.250Z", "dateUpdated": "2024-12-19T09:21:14.370Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46683
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
drm/xe: prevent UAF around preempt fence
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46683", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:08:58.866096Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:09:13.919Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/xe/xe_exec_queue.c", "drivers/gpu/drm/xe/xe_exec_queue_types.h", "drivers/gpu/drm/xe/xe_preempt_fence.c", "drivers/gpu/drm/xe/xe_preempt_fence_types.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "10081b0b0ed201f53e24bd92deb2e0f3c3e713d4", "status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "versionType": "git" }, { "lessThan": "730b72480e29f63fd644f5fa57c9d46109428953", "status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/xe/xe_exec_queue.c", "drivers/gpu/drm/xe/xe_exec_queue_types.h", "drivers/gpu/drm/xe/xe_preempt_fence.c", "drivers/gpu/drm/xe/xe_preempt_fence_types.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: prevent UAF around preempt fence\n\nThe fence lock is part of the queue, therefore in the current design\nanything locking the fence should then also hold a ref to the queue to\nprevent the queue from being freed.\n\nHowever, currently it looks like we signal the fence and then drop the\nqueue ref, but if something is waiting on the fence, the waiter is\nkicked to wake up at some later point, where upon waking up it first\ngrabs the lock before checking the fence state. But if we have already\ndropped the queue ref, then the lock might already be freed as part of\nthe queue, leading to uaf.\n\nTo prevent this, move the fence lock into the fence itself so we don\u0027t\nrun into lifetime issues. Alternative might be to have device level\nlock, or only release the queue in the fence release callback, however\nthat might require pushing to another worker to avoid locking issues.\n\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020\n(cherry picked from commit 7116c35aacedc38be6d15bd21b2fc936eed0008b)" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:53.621Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/10081b0b0ed201f53e24bd92deb2e0f3c3e713d4" }, { "url": "https://git.kernel.org/stable/c/730b72480e29f63fd644f5fa57c9d46109428953" } ], "title": "drm/xe: prevent UAF around preempt fence", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46683", "datePublished": "2024-09-13T05:29:15.926Z", "dateReserved": "2024-09-11T15:12:18.248Z", "dateUpdated": "2024-12-19T09:20:53.621Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46686
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46686", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:08:12.875027Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:08:26.623Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/smb/client/smb2pdu.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "6df57c63c200cd05e085c3b695128260e21959b7", "status": "affected", "version": "edf38e9f4269591d26b3783c0b348c9345580c3c", "versionType": "git" }, { "lessThan": "a01859dd6aebf826576513850a3b05992809e9d2", "status": "affected", "version": "a6559cc1d35d3eeafb0296aca347b2f745a28a74", "versionType": "git" }, { "lessThan": "b902fb78ab21299e4dd1775e7e8d251d5c0735bc", "status": "affected", "version": "a6559cc1d35d3eeafb0296aca347b2f745a28a74", "versionType": "git" }, { "lessThan": "c724b2ab6a46435b4e7d58ad2fbbdb7a318823cf", "status": "affected", "version": "a6559cc1d35d3eeafb0296aca347b2f745a28a74", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/smb/client/smb2pdu.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()\n\nThis happens when called from SMB2_read() while using rdma\nand reaching the rdma_readwrite_threshold." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:57.678Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/6df57c63c200cd05e085c3b695128260e21959b7" }, { "url": "https://git.kernel.org/stable/c/a01859dd6aebf826576513850a3b05992809e9d2" }, { "url": "https://git.kernel.org/stable/c/b902fb78ab21299e4dd1775e7e8d251d5c0735bc" }, { "url": "https://git.kernel.org/stable/c/c724b2ab6a46435b4e7d58ad2fbbdb7a318823cf" } ], "title": "smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46686", "datePublished": "2024-09-13T05:29:17.821Z", "dateReserved": "2024-09-11T15:12:18.248Z", "dateUpdated": "2024-12-19T09:20:57.678Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46676
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
nfc: pn533: Add poll mod list filling check
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46676", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:44:14.123605Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:44:28.585Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/nfc/pn533/pn533.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c5e05237444f32f6cfe5d907603a232c77a08b31", "status": "affected", "version": "dfccd0f580445d176acea174175b3e6518cc91f7", "versionType": "git" }, { "lessThan": "8ddaea033de051ed61b39f6b69ad54a411172b33", "status": "affected", "version": "dfccd0f580445d176acea174175b3e6518cc91f7", "versionType": "git" }, { "lessThan": "7535db0624a2dede374c42040808ad9a9101d723", "status": "affected", "version": "dfccd0f580445d176acea174175b3e6518cc91f7", "versionType": "git" }, { "lessThan": "7ecd3dd4f8eecd3309432156ccfe24768e009ec4", "status": "affected", "version": "dfccd0f580445d176acea174175b3e6518cc91f7", "versionType": "git" }, { "lessThan": "56ad559cf6d87f250a8d203b555dfc3716afa946", "status": "affected", "version": "dfccd0f580445d176acea174175b3e6518cc91f7", "versionType": "git" }, { "lessThan": "64513d0e546a1f19e390f7e5eba3872bfcbdacf5", "status": "affected", "version": "dfccd0f580445d176acea174175b3e6518cc91f7", "versionType": "git" }, { "lessThan": "febccb39255f9df35527b88c953b2e0deae50e53", "status": "affected", "version": "dfccd0f580445d176acea174175b3e6518cc91f7", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/nfc/pn533/pn533.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.12" }, { "lessThan": "3.12", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.283", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: Add poll mod list filling check\n\nIn case of im_protocols value is 1 and tm_protocols value is 0 this\ncombination successfully passes the check\n\u0027if (!im_protocols \u0026\u0026 !tm_protocols)\u0027 in the nfc_start_poll().\nBut then after pn533_poll_create_mod_list() call in pn533_start_poll()\npoll mod list will remain empty and dev-\u003epoll_mod_count will remain 0\nwhich lead to division by zero.\n\nNormally no im protocol has value 1 in the mask, so this combination is\nnot expected by driver. But these protocol values actually come from\nuserspace via Netlink interface (NFC_CMD_START_POLL operation). So a\nbroken or malicious program may pass a message containing a \"bad\"\ncombination of protocol parameter values so that dev-\u003epoll_mod_count\nis not incremented inside pn533_poll_create_mod_list(), thus leading\nto division by zero.\nCall trace looks like:\nnfc_genl_start_poll()\n nfc_start_poll()\n -\u003estart_poll()\n pn533_start_poll()\n\nAdd poll mod list filling check.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:45.387Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c5e05237444f32f6cfe5d907603a232c77a08b31" }, { "url": "https://git.kernel.org/stable/c/8ddaea033de051ed61b39f6b69ad54a411172b33" }, { "url": "https://git.kernel.org/stable/c/7535db0624a2dede374c42040808ad9a9101d723" }, { "url": "https://git.kernel.org/stable/c/7ecd3dd4f8eecd3309432156ccfe24768e009ec4" }, { "url": "https://git.kernel.org/stable/c/56ad559cf6d87f250a8d203b555dfc3716afa946" }, { "url": "https://git.kernel.org/stable/c/64513d0e546a1f19e390f7e5eba3872bfcbdacf5" }, { "url": "https://git.kernel.org/stable/c/febccb39255f9df35527b88c953b2e0deae50e53" } ], "title": "nfc: pn533: Add poll mod list filling check", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46676", "datePublished": "2024-09-13T05:29:11.598Z", "dateReserved": "2024-09-11T15:12:18.247Z", "dateUpdated": "2024-12-19T09:20:45.387Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46698
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
video/aperture: optionally match the device in sysfb_disable()
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46698", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:04:59.820597Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:05:14.743Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/firmware/sysfb.c", "drivers/of/platform.c", "drivers/video/aperture.c", "include/linux/sysfb.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "17e78f43de0c6da34204cc858b4cc05671ea9acf", "status": "affected", "version": "5ae3716cfdcd286268133867f67d0803847acefc", "versionType": "git" }, { "lessThan": "b49420d6a1aeb399e5b107fc6eb8584d0860fbd7", "status": "affected", "version": "5ae3716cfdcd286268133867f67d0803847acefc", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/firmware/sysfb.c", "drivers/of/platform.c", "drivers/video/aperture.c", "include/linux/sysfb.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.5" }, { "lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo/aperture: optionally match the device in sysfb_disable()\n\nIn aperture_remove_conflicting_pci_devices(), we currently only\ncall sysfb_disable() on vga class devices. This leads to the\nfollowing problem when the pimary device is not VGA compatible:\n\n1. A PCI device with a non-VGA class is the boot display\n2. That device is probed first and it is not a VGA device so\n sysfb_disable() is not called, but the device resources\n are freed by aperture_detach_platform_device()\n3. Non-primary GPU has a VGA class and it ends up calling sysfb_disable()\n4. NULL pointer dereference via sysfb_disable() since the resources\n have already been freed by aperture_detach_platform_device() when\n it was called by the other device.\n\nFix this by passing a device pointer to sysfb_disable() and checking\nthe device to determine if we should execute it or not.\n\nv2: Fix build when CONFIG_SCREEN_INFO is not set\nv3: Move device check into the mutex\n Drop primary variable in aperture_remove_conflicting_pci_devices()\n Drop __init on pci sysfb_pci_dev_is_enabled()" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:13.035Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/17e78f43de0c6da34204cc858b4cc05671ea9acf" }, { "url": "https://git.kernel.org/stable/c/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7" } ], "title": "video/aperture: optionally match the device in sysfb_disable()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46698", "datePublished": "2024-09-13T05:29:25.387Z", "dateReserved": "2024-09-11T15:12:18.250Z", "dateUpdated": "2024-12-19T09:21:13.035Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46701
Vulnerability from cvelistv5
Published
2024-09-13 06:27
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
libfs: fix infinite directory reads for offset dir
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46701", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:04:11.603675Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:04:25.862Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/libfs.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "308b4fc2403b335894592ee9dc212a5e58bb309f", "status": "affected", "version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1", "versionType": "git" }, { "lessThan": "64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a", "status": "affected", "version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/libfs.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.6" }, { "lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibfs: fix infinite directory reads for offset dir\n\nAfter we switch tmpfs dir operations from simple_dir_operations to\nsimple_offset_dir_operations, every rename happened will fill new dentry\nto dest dir\u0027s maple tree(\u0026SHMEM_I(inode)-\u003edir_offsets-\u003emt) with a free\nkey starting with octx-\u003enewx_offset, and then set newx_offset equals to\nfree key + 1. This will lead to infinite readdir combine with rename\nhappened at the same time, which fail generic/736 in xfstests(detail show\nas below).\n\n1. create 5000 files(1 2 3...) under one dir\n2. call readdir(man 3 readdir) once, and get one entry\n3. rename(entry, \"TEMPFILE\"), then rename(\"TEMPFILE\", entry)\n4. loop 2~3, until readdir return nothing or we loop too many\n times(tmpfs break test with the second condition)\n\nWe choose the same logic what commit 9b378f6ad48cf (\"btrfs: fix infinite\ndirectory reads\") to fix it, record the last_index when we open dir, and\ndo not emit the entry which index \u003e= last_index. The file-\u003eprivate_data\nnow used in offset dir can use directly to do this, and we also update\nthe last_index when we llseek the dir file.\n\n[brauner: only update last_index after seek when offset is zero like Jan suggested]" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:16.967Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/308b4fc2403b335894592ee9dc212a5e58bb309f" }, { "url": "https://git.kernel.org/stable/c/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a" } ], "title": "libfs: fix infinite directory reads for offset dir", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46701", "datePublished": "2024-09-13T06:27:29.911Z", "dateReserved": "2024-09-11T15:12:18.251Z", "dateUpdated": "2024-12-19T09:21:16.967Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46706
Vulnerability from cvelistv5
Published
2024-09-13 06:27
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46706", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:02:49.399006Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:03:05.411Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/tty/serial/fsl_lpuart.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "8eb92cfca6c2c5a15ab1773f3d18ab8d8f7dbb68", "status": "affected", "version": "43543e6f539b3e646348c253059f75e27d63c94d", "versionType": "git" }, { "lessThan": "3ecf625d4acb71d726bc0b49403cf68388b3d58d", "status": "affected", "version": "43543e6f539b3e646348c253059f75e27d63c94d", "versionType": "git" }, { "lessThan": "dc98d76a15bc29a9a4e76f2f65f39f3e590fb15c", "status": "affected", "version": "43543e6f539b3e646348c253059f75e27d63c94d", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/tty/serial/fsl_lpuart.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.2" }, { "lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.48", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: fsl_lpuart: mark last busy before uart_add_one_port\n\nWith \"earlycon initcall_debug=1 loglevel=8\" in bootargs, kernel\nsometimes boot hang. It is because normal console still is not ready,\nbut runtime suspend is called, so early console putchar will hang\nin waiting TRDE set in UARTSTAT.\n\nThe lpuart driver has auto suspend delay set to 3000ms, but during\nuart_add_one_port, a child device serial ctrl will added and probed with\nits pm runtime enabled(see serial_ctrl.c).\nThe runtime suspend call path is:\ndevice_add\n |-\u003e bus_probe_device\n |-\u003edevice_initial_probe\n\t |-\u003e__device_attach\n |-\u003e pm_runtime_get_sync(dev-\u003eparent);\n\t\t\t |-\u003e pm_request_idle(dev);\n\t\t\t |-\u003e pm_runtime_put(dev-\u003eparent);\n\nSo in the end, before normal console ready, the lpuart get runtime\nsuspended. And earlycon putchar will hang.\n\nTo address the issue, mark last busy just after pm_runtime_enable,\nthree seconds is long enough to switch from bootconsole to normal\nconsole." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:22.835Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/8eb92cfca6c2c5a15ab1773f3d18ab8d8f7dbb68" }, { "url": "https://git.kernel.org/stable/c/3ecf625d4acb71d726bc0b49403cf68388b3d58d" }, { "url": "https://git.kernel.org/stable/c/dc98d76a15bc29a9a4e76f2f65f39f3e590fb15c" } ], "title": "tty: serial: fsl_lpuart: mark last busy before uart_add_one_port", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46706", "datePublished": "2024-09-13T06:27:33.085Z", "dateReserved": "2024-09-11T15:12:18.252Z", "dateUpdated": "2024-12-19T09:21:22.835Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46692
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
firmware: qcom: scm: Mark get_wq_ctx() as atomic call
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46692", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:06:36.463188Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:06:51.373Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/firmware/qcom/qcom_scm-smc.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "cdf7efe4b02aa93813db0bf1ca596ad298ab6b06", "status": "affected", "version": "6bf32599223634294cdc6efb359ffaab1d68073c", "versionType": "git" }, { "lessThan": "e40115c33c0d79c940545b6b12112aace7acd9f5", "status": "affected", "version": "6bf32599223634294cdc6efb359ffaab1d68073c", "versionType": "git" }, { "lessThan": "9960085a3a82c58d3323c1c20b991db6045063b0", "status": "affected", "version": "6bf32599223634294cdc6efb359ffaab1d68073c", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/firmware/qcom/qcom_scm-smc.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: scm: Mark get_wq_ctx() as atomic call\n\nCurrently get_wq_ctx() is wrongly configured as a standard call. When two\nSMC calls are in sleep and one SMC wakes up, it calls get_wq_ctx() to\nresume the corresponding sleeping thread. But if get_wq_ctx() is\ninterrupted, goes to sleep and another SMC call is waiting to be allocated\na waitq context, it leads to a deadlock.\n\nTo avoid this get_wq_ctx() must be an atomic call and can\u0027t be a standard\nSMC call. Hence mark get_wq_ctx() as a fast call." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:05.382Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/cdf7efe4b02aa93813db0bf1ca596ad298ab6b06" }, { "url": "https://git.kernel.org/stable/c/e40115c33c0d79c940545b6b12112aace7acd9f5" }, { "url": "https://git.kernel.org/stable/c/9960085a3a82c58d3323c1c20b991db6045063b0" } ], "title": "firmware: qcom: scm: Mark get_wq_ctx() as atomic call", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46692", "datePublished": "2024-09-13T05:29:21.631Z", "dateReserved": "2024-09-11T15:12:18.249Z", "dateUpdated": "2024-12-19T09:21:05.382Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46690
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46690", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:07:08.535058Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:07:22.328Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/nfsd/nfs4state.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "1b46a871e980e3daa16fd5e77539966492e8910a", "status": "affected", "version": "c5967721e1063648b0506481585ba7e2e49a075e", "versionType": "git" }, { "lessThan": "40927f3d0972bf86357a32a5749be71a551241b6", "status": "affected", "version": "c5967721e1063648b0506481585ba7e2e49a075e", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/nfsd/nfs4state.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.9" }, { "lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease\n\nIt is not safe to dereference fl-\u003ec.flc_owner without first confirming\nfl-\u003efl_lmops is the expected manager. nfsd4_deleg_getattr_conflict()\ntests fl_lmops but largely ignores the result and assumes that flc_owner\nis an nfs4_delegation anyway. This is wrong.\n\nWith this patch we restore the \"!= \u0026nfsd_lease_mng_ops\" case to behave\nas it did before the change mentioned below. This is the same as the\ncurrent code, but without any reference to a possible delegation." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:02.857Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/1b46a871e980e3daa16fd5e77539966492e8910a" }, { "url": "https://git.kernel.org/stable/c/40927f3d0972bf86357a32a5749be71a551241b6" } ], "title": "nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46690", "datePublished": "2024-09-13T05:29:20.368Z", "dateReserved": "2024-09-11T15:12:18.249Z", "dateUpdated": "2024-12-19T09:21:02.857Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46710
Vulnerability from cvelistv5
Published
2024-09-13 06:33
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
drm/vmwgfx: Prevent unmapping active read buffers
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46710", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T14:59:47.963109Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:00:04.356Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "58a3714db4d9dcaeb9fc4905141e17b9f536c0a5", "status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "versionType": "git" }, { "lessThan": "0851b1ec650adadcaa23ec96daad95a55bf966f0", "status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "versionType": "git" }, { "lessThan": "d5228d158e4c0b1663b3983044913c15c3d0135e", "status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "versionType": "git" }, { "lessThan": "aba07b9a0587f50e5d3346eaa19019cf3f86c0ea", "status": "affected", "version": "485d98d472d53f9617ffdfba5e677ac29ad4fe20", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c", "drivers/gpu/drm/vmwgfx/vmwgfx_bo.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.19" }, { "lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.113", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.54", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Prevent unmapping active read buffers\n\nThe kms paths keep a persistent map active to read and compare the cursor\nbuffer. These maps can race with each other in simple scenario where:\na) buffer \"a\" mapped for update\nb) buffer \"a\" mapped for compare\nc) do the compare\nd) unmap \"a\" for compare\ne) update the cursor\nf) unmap \"a\" for update\nAt step \"e\" the buffer has been unmapped and the read contents is bogus.\n\nPrevent unmapping of active read buffers by simply keeping a count of\nhow many paths have currently active maps and unmap only when the count\nreaches 0." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:28.053Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/58a3714db4d9dcaeb9fc4905141e17b9f536c0a5" }, { "url": "https://git.kernel.org/stable/c/0851b1ec650adadcaa23ec96daad95a55bf966f0" }, { "url": "https://git.kernel.org/stable/c/d5228d158e4c0b1663b3983044913c15c3d0135e" }, { "url": "https://git.kernel.org/stable/c/aba07b9a0587f50e5d3346eaa19019cf3f86c0ea" } ], "title": "drm/vmwgfx: Prevent unmapping active read buffers", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46710", "datePublished": "2024-09-13T06:33:42.285Z", "dateReserved": "2024-09-11T15:12:18.252Z", "dateUpdated": "2024-12-19T09:21:28.053Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46673
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
scsi: aacraid: Fix double-free on probe failure
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46673", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:45:02.828351Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:45:17.225Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/scsi/aacraid/comminit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "d237c7d06ffddcdb5d36948c527dc01284388218", "status": "affected", "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab", "versionType": "git" }, { "lessThan": "564e1986b00c5f05d75342f8407f75f0a17b94df", "status": "affected", "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab", "versionType": "git" }, { "lessThan": "9e96dea7eff6f2bbcd0b42a098012fc66af9eb69", "status": "affected", "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab", "versionType": "git" }, { "lessThan": "85449b28ff6a89c4513115e43ddcad949b5890c9", "status": "affected", "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab", "versionType": "git" }, { "lessThan": "60962c3d8e18e5d8dfa16df788974dd7f35bd87a", "status": "affected", "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab", "versionType": "git" }, { "lessThan": "8a3995a3ffeca280a961b59f5c99843d81b15929", "status": "affected", "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab", "versionType": "git" }, { "lessThan": "4b540ec7c0045c2d01c4e479f34bbc8f147afa4c", "status": "affected", "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab", "versionType": "git" }, { "lessThan": "919ddf8336f0b84c0453bac583808c9f165a85c2", "status": "affected", "version": "8e0c5ebde82b08f6d996e11983890fc4cc085fab", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/scsi/aacraid/comminit.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.15" }, { "lessThan": "2.6.15", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.321", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.283", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: aacraid: Fix double-free on probe failure\n\naac_probe_one() calls hardware-specific init functions through the\naac_driver_ident::init pointer, all of which eventually call down to\naac_init_adapter().\n\nIf aac_init_adapter() fails after allocating memory for aac_dev::queues,\nit frees the memory but does not clear that member.\n\nAfter the hardware-specific init function returns an error,\naac_probe_one() goes down an error path that frees the memory pointed to\nby aac_dev::queues, resulting.in a double-free." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:41.474Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/d237c7d06ffddcdb5d36948c527dc01284388218" }, { "url": "https://git.kernel.org/stable/c/564e1986b00c5f05d75342f8407f75f0a17b94df" }, { "url": "https://git.kernel.org/stable/c/9e96dea7eff6f2bbcd0b42a098012fc66af9eb69" }, { "url": "https://git.kernel.org/stable/c/85449b28ff6a89c4513115e43ddcad949b5890c9" }, { "url": "https://git.kernel.org/stable/c/60962c3d8e18e5d8dfa16df788974dd7f35bd87a" }, { "url": "https://git.kernel.org/stable/c/8a3995a3ffeca280a961b59f5c99843d81b15929" }, { "url": "https://git.kernel.org/stable/c/4b540ec7c0045c2d01c4e479f34bbc8f147afa4c" }, { "url": "https://git.kernel.org/stable/c/919ddf8336f0b84c0453bac583808c9f165a85c2" } ], "title": "scsi: aacraid: Fix double-free on probe failure", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46673", "datePublished": "2024-09-13T05:29:09.649Z", "dateReserved": "2024-09-11T15:12:18.247Z", "dateUpdated": "2024-12-19T09:20:41.474Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46694
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
drm/amd/display: avoid using null object of framebuffer
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46694", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:06:03.603728Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:06:18.392Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "093ee72ed35c2338c87c26b6ba6f0b7789c9e14e", "status": "affected", "version": "5d945cbcd4b16a29d6470a80dfb19738f9a4319f", "versionType": "git" }, { "lessThan": "f6f5e39a3fe7cbdba190f42b28b40bdff03c8cf0", "status": "affected", "version": "5d945cbcd4b16a29d6470a80dfb19738f9a4319f", "versionType": "git" }, { "lessThan": "49e1b214f3239b78967c6ddb8f8ec47ae047b051", "status": "affected", "version": "5d945cbcd4b16a29d6470a80dfb19738f9a4319f", "versionType": "git" }, { "lessThan": "3b9a33235c773c7a3768060cf1d2cf8a9153bc37", "status": "affected", "version": "5d945cbcd4b16a29d6470a80dfb19738f9a4319f", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.0" }, { "lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: avoid using null object of framebuffer\n\nInstead of using state-\u003efb-\u003eobj[0] directly, get object from framebuffer\nby calling drm_gem_fb_get_obj() and return error code when object is\nnull to avoid using null object of framebuffer.\n\n(cherry picked from commit 73dd0ad9e5dad53766ea3e631303430116f834b3)" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:07.959Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/093ee72ed35c2338c87c26b6ba6f0b7789c9e14e" }, { "url": "https://git.kernel.org/stable/c/f6f5e39a3fe7cbdba190f42b28b40bdff03c8cf0" }, { "url": "https://git.kernel.org/stable/c/49e1b214f3239b78967c6ddb8f8ec47ae047b051" }, { "url": "https://git.kernel.org/stable/c/3b9a33235c773c7a3768060cf1d2cf8a9153bc37" } ], "title": "drm/amd/display: avoid using null object of framebuffer", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46694", "datePublished": "2024-09-13T05:29:22.889Z", "dateReserved": "2024-09-11T15:12:18.249Z", "dateUpdated": "2024-12-19T09:21:07.959Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46704
Vulnerability from cvelistv5
Published
2024-09-13 06:27
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
workqueue: Fix spruious data race in __flush_work()
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46704", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:03:23.715213Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:03:38.514Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "kernel/workqueue.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "91d09642127a32fde231face2ff489af70eef316", "status": "affected", "version": "134874e2eee9380c2700411d4844cbc29297bc01", "versionType": "git" }, { "lessThan": "8bc35475ef1a23b0e224f3242eb11c76cab0ea88", "status": "affected", "version": "134874e2eee9380c2700411d4844cbc29297bc01", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "kernel/workqueue.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix spruious data race in __flush_work()\n\nWhen flushing a work item for cancellation, __flush_work() knows that it\nexclusively owns the work item through its PENDING bit. 134874e2eee9\n(\"workqueue: Allow cancel_work_sync() and disable_work() from atomic\ncontexts on BH work items\") added a read of @work-\u003edata to determine whether\nto use busy wait for BH work items that are being canceled. While the read\nis safe when @from_cancel, @work-\u003edata was read before testing @from_cancel\nto simplify code structure:\n\n\tdata = *work_data_bits(work);\n\tif (from_cancel \u0026\u0026\n\t !WARN_ON_ONCE(data \u0026 WORK_STRUCT_PWQ) \u0026\u0026 (data \u0026 WORK_OFFQ_BH)) {\n\nWhile the read data was never used if !@from_cancel, this could trigger\nKCSAN data race detection spuriously:\n\n ==================================================================\n BUG: KCSAN: data-race in __flush_work / __flush_work\n\n write to 0xffff8881223aa3e8 of 8 bytes by task 3998 on cpu 0:\n instrument_write include/linux/instrumented.h:41 [inline]\n ___set_bit include/asm-generic/bitops/instrumented-non-atomic.h:28 [inline]\n insert_wq_barrier kernel/workqueue.c:3790 [inline]\n start_flush_work kernel/workqueue.c:4142 [inline]\n __flush_work+0x30b/0x570 kernel/workqueue.c:4178\n flush_work kernel/workqueue.c:4229 [inline]\n ...\n\n read to 0xffff8881223aa3e8 of 8 bytes by task 50 on cpu 1:\n __flush_work+0x42a/0x570 kernel/workqueue.c:4188\n flush_work kernel/workqueue.c:4229 [inline]\n flush_delayed_work+0x66/0x70 kernel/workqueue.c:4251\n ...\n\n value changed: 0x0000000000400000 -\u003e 0xffff88810006c00d\n\nReorganize the code so that @from_cancel is tested before @work-\u003edata is\naccessed. The only problem is triggering KCSAN detection spuriously. This\nshouldn\u0027t need READ_ONCE() or other access qualifiers.\n\nNo functional changes." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:20.522Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/91d09642127a32fde231face2ff489af70eef316" }, { "url": "https://git.kernel.org/stable/c/8bc35475ef1a23b0e224f3242eb11c76cab0ea88" } ], "title": "workqueue: Fix spruious data race in __flush_work()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46704", "datePublished": "2024-09-13T06:27:31.822Z", "dateReserved": "2024-09-11T15:12:18.251Z", "dateUpdated": "2024-12-19T09:21:20.522Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46695
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
selinux,smack: don't bypass permissions check in inode_setsecctx hook
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46695", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:05:47.775114Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:06:01.561Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "security/selinux/hooks.c", "security/smack/smack_lsm.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "2dbc4b7bac60b02cc6e70d05bf6a7dfd551f9dda", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "fe0cd53791119f6287b6532af8ce41576d664930", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "eebec98791d0137e455cc006411bb92a54250924", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "459584258d47ec3cc6245a82e8a49c9d08eb8b57", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "f71ec019257ba4f7ab198bd948c5902a207bad96", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "76a0e79bc84f466999fa501fce5bf7a07641b8a7", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "security/selinux/hooks.c", "security/smack/smack_lsm.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.227", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.168", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.113", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux,smack: don\u0027t bypass permissions check in inode_setsecctx hook\n\nMarek Gresko reports that the root user on an NFS client is able to\nchange the security labels on files on an NFS filesystem that is\nexported with root squashing enabled.\n\nThe end of the kerneldoc comment for __vfs_setxattr_noperm() states:\n\n * This function requires the caller to lock the inode\u0027s i_mutex before it\n * is executed. It also assumes that the caller will make the appropriate\n * permission checks.\n\nnfsd_setattr() does do permissions checking via fh_verify() and\nnfsd_permission(), but those don\u0027t do all the same permissions checks\nthat are done by security_inode_setxattr() and its related LSM hooks do.\n\nSince nfsd_setattr() is the only consumer of security_inode_setsecctx(),\nsimplest solution appears to be to replace the call to\n__vfs_setxattr_noperm() with a call to __vfs_setxattr_locked(). This\nfixes the above issue and has the added benefit of causing nfsd to\nrecall conflicting delegations on a file when a client tries to change\nits security label." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:09.240Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/2dbc4b7bac60b02cc6e70d05bf6a7dfd551f9dda" }, { "url": "https://git.kernel.org/stable/c/fe0cd53791119f6287b6532af8ce41576d664930" }, { "url": "https://git.kernel.org/stable/c/eebec98791d0137e455cc006411bb92a54250924" }, { "url": "https://git.kernel.org/stable/c/459584258d47ec3cc6245a82e8a49c9d08eb8b57" }, { "url": "https://git.kernel.org/stable/c/f71ec019257ba4f7ab198bd948c5902a207bad96" }, { "url": "https://git.kernel.org/stable/c/76a0e79bc84f466999fa501fce5bf7a07641b8a7" } ], "title": "selinux,smack: don\u0027t bypass permissions check in inode_setsecctx hook", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46695", "datePublished": "2024-09-13T05:29:23.506Z", "dateReserved": "2024-09-11T15:12:18.249Z", "dateUpdated": "2024-12-19T09:21:09.240Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46677
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
gtp: fix a potential NULL pointer dereference
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46677", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:12:57.670993Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:13:12.743Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/gtp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "620fe9809752fae91b4190e897b81ed9976dfb39", "status": "affected", "version": "1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9", "versionType": "git" }, { "lessThan": "bdd99e5f0ad5fa727b16f2101fe880aa2bff2f8e", "status": "affected", "version": "1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9", "versionType": "git" }, { "lessThan": "8bbb9e4e0e66a39282e582d0440724055404b38c", "status": "affected", "version": "1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9", "versionType": "git" }, { "lessThan": "4643b91691e969b1b9ad54bf552d7a990cfa3b87", "status": "affected", "version": "1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9", "versionType": "git" }, { "lessThan": "e8b9930b0eb045d19e883c65ff9676fc89320c70", "status": "affected", "version": "1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9", "versionType": "git" }, { "lessThan": "28c67f0f84f889fe9f4cbda8354132b20dc9212d", "status": "affected", "version": "1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9", "versionType": "git" }, { "lessThan": "612edd35f2a3910ab1f61c1f2338889d4ba99fa2", "status": "affected", "version": "1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9", "versionType": "git" }, { "lessThan": "defd8b3c37b0f9cb3e0f60f47d3d78d459d57fda", "status": "affected", "version": "1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/gtp.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.12" }, { "lessThan": "4.12", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.321", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.283", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: fix a potential NULL pointer dereference\n\nWhen sockfd_lookup() fails, gtp_encap_enable_socket() returns a\nNULL pointer, but its callers only check for error pointers thus miss\nthe NULL pointer case.\n\nFix it by returning an error pointer with the error code carried from\nsockfd_lookup().\n\n(I found this bug during code inspection.)" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:46.569Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/620fe9809752fae91b4190e897b81ed9976dfb39" }, { "url": "https://git.kernel.org/stable/c/bdd99e5f0ad5fa727b16f2101fe880aa2bff2f8e" }, { "url": "https://git.kernel.org/stable/c/8bbb9e4e0e66a39282e582d0440724055404b38c" }, { "url": "https://git.kernel.org/stable/c/4643b91691e969b1b9ad54bf552d7a990cfa3b87" }, { "url": "https://git.kernel.org/stable/c/e8b9930b0eb045d19e883c65ff9676fc89320c70" }, { "url": "https://git.kernel.org/stable/c/28c67f0f84f889fe9f4cbda8354132b20dc9212d" }, { "url": "https://git.kernel.org/stable/c/612edd35f2a3910ab1f61c1f2338889d4ba99fa2" }, { "url": "https://git.kernel.org/stable/c/defd8b3c37b0f9cb3e0f60f47d3d78d459d57fda" } ], "title": "gtp: fix a potential NULL pointer dereference", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46677", "datePublished": "2024-09-13T05:29:12.203Z", "dateReserved": "2024-09-11T15:12:18.247Z", "dateUpdated": "2024-12-19T09:20:46.569Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46708
Vulnerability from cvelistv5
Published
2024-09-13 06:33
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
pinctrl: qcom: x1e80100: Fix special pin offsets
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46708", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:02:14.934448Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:02:30.664Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/pinctrl/qcom/pinctrl-x1e80100.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "0197bf772f657fbdea5e9bdec5eea6e67d82cbde", "status": "affected", "version": "05e4941d97ef05ddaa742a57301daab8a2f7db5b", "versionType": "git" }, { "lessThan": "d3692d95cc4d88114b070ee63cffc976f00f207f", "status": "affected", "version": "05e4941d97ef05ddaa742a57301daab8a2f7db5b", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/pinctrl/qcom/pinctrl-x1e80100.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: qcom: x1e80100: Fix special pin offsets\n\nRemove the erroneus 0x100000 offset to prevent the boards from crashing\non pin state setting, as well as for the intended state changes to take\neffect." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:25.392Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/0197bf772f657fbdea5e9bdec5eea6e67d82cbde" }, { "url": "https://git.kernel.org/stable/c/d3692d95cc4d88114b070ee63cffc976f00f207f" } ], "title": "pinctrl: qcom: x1e80100: Fix special pin offsets", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46708", "datePublished": "2024-09-13T06:33:40.510Z", "dateReserved": "2024-09-11T15:12:18.252Z", "dateUpdated": "2024-12-19T09:21:25.392Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46680
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
Bluetooth: btnxpuart: Fix random crash seen while removing driver
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46680", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:09:48.767576Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:10:03.450Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/bluetooth/btnxpuart.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "662a55986b88807da4d112d838c8aaa05810e938", "status": "affected", "version": "86d55f124b52de2ba0d066d89b766bcc0387fd72", "versionType": "git" }, { "lessThan": "29a1d9971e38f92c84b363ff50379dd434ddfe1c", "status": "affected", "version": "86d55f124b52de2ba0d066d89b766bcc0387fd72", "versionType": "git" }, { "lessThan": "35237475384ab3622f63c3c09bdf6af6dacfe9c3", "status": "affected", "version": "86d55f124b52de2ba0d066d89b766bcc0387fd72", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/bluetooth/btnxpuart.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.4" }, { "lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Fix random crash seen while removing driver\n\nThis fixes the random kernel crash seen while removing the driver, when\nrunning the load/unload test over multiple iterations.\n\n1) modprobe btnxpuart\n2) hciconfig hci0 reset\n3) hciconfig (check hci0 interface up with valid BD address)\n4) modprobe -r btnxpuart\nRepeat steps 1 to 4\n\nThe ps_wakeup() call in btnxpuart_close() schedules the psdata-\u003ework(),\nwhich gets scheduled after module is removed, causing a kernel crash.\n\nThis hidden issue got highlighted after enabling Power Save by default\nin 4183a7be7700 (Bluetooth: btnxpuart: Enable Power Save feature on\nstartup)\n\nThe new ps_cleanup() deasserts UART break immediately while closing\nserdev device, cancels any scheduled ps_work and destroys the ps_lock\nmutex.\n\n[ 85.884604] Unable to handle kernel paging request at virtual address ffffd4a61638f258\n[ 85.884624] Mem abort info:\n[ 85.884625] ESR = 0x0000000086000007\n[ 85.884628] EC = 0x21: IABT (current EL), IL = 32 bits\n[ 85.884633] SET = 0, FnV = 0\n[ 85.884636] EA = 0, S1PTW = 0\n[ 85.884638] FSC = 0x07: level 3 translation fault\n[ 85.884642] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041dd0000\n[ 85.884646] [ffffd4a61638f258] pgd=1000000095fff003, p4d=1000000095fff003, pud=100000004823d003, pmd=100000004823e003, pte=0000000000000000\n[ 85.884662] Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP\n[ 85.890932] Modules linked in: algif_hash algif_skcipher af_alg overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_spdif snd_soc_fsl_micfil snd_soc_fsl_sai snd_soc_fsl_utils gpio_ir_recv rc_core fuse [last unloaded: btnxpuart(O)]\n[ 85.927297] CPU: 1 PID: 67 Comm: kworker/1:3 Tainted: G O 6.1.36+g937b1be4345a #1\n[ 85.936176] Hardware name: FSL i.MX8MM EVK board (DT)\n[ 85.936182] Workqueue: events 0xffffd4a61638f380\n[ 85.936198] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 85.952817] pc : 0xffffd4a61638f258\n[ 85.952823] lr : 0xffffd4a61638f258\n[ 85.952827] sp : ffff8000084fbd70\n[ 85.952829] x29: ffff8000084fbd70 x28: 0000000000000000 x27: 0000000000000000\n[ 85.963112] x26: ffffd4a69133f000 x25: ffff4bf1c8540990 x24: ffff4bf215b87305\n[ 85.963119] x23: ffff4bf215b87300 x22: ffff4bf1c85409d0 x21: ffff4bf1c8540970\n[ 85.977382] x20: 0000000000000000 x19: ffff4bf1c8540880 x18: 0000000000000000\n[ 85.977391] x17: 0000000000000000 x16: 0000000000000133 x15: 0000ffffe2217090\n[ 85.977399] x14: 0000000000000001 x13: 0000000000000133 x12: 0000000000000139\n[ 85.977407] x11: 0000000000000001 x10: 0000000000000a60 x9 : ffff8000084fbc50\n[ 85.977417] x8 : ffff4bf215b7d000 x7 : ffff4bf215b83b40 x6 : 00000000000003e8\n[ 85.977424] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000000\n[ 85.977432] x2 : 0000000000000000 x1 : ffff4bf1c4265880 x0 : 0000000000000000\n[ 85.977443] Call trace:\n[ 85.977446] 0xffffd4a61638f258\n[ 85.977451] 0xffffd4a61638f3e8\n[ 85.977455] process_one_work+0x1d4/0x330\n[ 85.977464] worker_thread+0x6c/0x430\n[ 85.977471] kthread+0x108/0x10c\n[ 85.977476] ret_from_fork+0x10/0x20\n[ 85.977488] Code: bad PC value\n[ 85.977491] ---[ end trace 0000000000000000 ]---\n\nPreset since v6.9.11" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:50.040Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/662a55986b88807da4d112d838c8aaa05810e938" }, { "url": "https://git.kernel.org/stable/c/29a1d9971e38f92c84b363ff50379dd434ddfe1c" }, { "url": "https://git.kernel.org/stable/c/35237475384ab3622f63c3c09bdf6af6dacfe9c3" } ], "title": "Bluetooth: btnxpuart: Fix random crash seen while removing driver", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46680", "datePublished": "2024-09-13T05:29:14.057Z", "dateReserved": "2024-09-11T15:12:18.248Z", "dateUpdated": "2024-12-19T09:20:50.040Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46700
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
drm/amdgpu/mes: fix mes ring buffer overflow
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46700", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:04:27.535167Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:04:42.253Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c", "drivers/gpu/drm/amd/amdgpu/mes_v11_0.c", "drivers/gpu/drm/amd/amdgpu/mes_v12_0.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "ed37550d7c516017c3b0324bdf144e2fa563ffb0", "status": "affected", "version": "de3246254156e7f32e5591ad0b3b740ffde8258e", "versionType": "git" }, { "lessThan": "11752c013f562a1124088a35bd314aa0e9f0e88f", "status": "affected", "version": "de3246254156e7f32e5591ad0b3b740ffde8258e", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c", "drivers/gpu/drm/amd/amdgpu/mes_v11_0.c", "drivers/gpu/drm/amd/amdgpu/mes_v12_0.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.11" }, { "lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/mes: fix mes ring buffer overflow\n\nwait memory room until enough before writing mes packets\nto avoid ring buffer overflow.\n\nv2: squash in sched_hw_submission fix\n\n(cherry picked from commit 34e087e8920e635c62e2ed6a758b0cd27f836d13)" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:15.788Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/ed37550d7c516017c3b0324bdf144e2fa563ffb0" }, { "url": "https://git.kernel.org/stable/c/11752c013f562a1124088a35bd314aa0e9f0e88f" } ], "title": "drm/amdgpu/mes: fix mes ring buffer overflow", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46700", "datePublished": "2024-09-13T05:29:26.616Z", "dateReserved": "2024-09-11T15:12:18.251Z", "dateUpdated": "2024-12-19T09:21:15.788Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46687
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46687", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:07:56.587484Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:08:11.126Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/btrfs/bio.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "51722b99f41f5e722ffa10b8f61e802a0e70b331", "status": "affected", "version": "852eee62d31abd695cd43e1b875d664ed292a8ca", "versionType": "git" }, { "lessThan": "4a3b9e1a8e6cd1a8d427a905e159de58d38941cc", "status": "affected", "version": "852eee62d31abd695cd43e1b875d664ed292a8ca", "versionType": "git" }, { "lessThan": "10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10", "status": "affected", "version": "852eee62d31abd695cd43e1b875d664ed292a8ca", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/btrfs/bio.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()\n\n[BUG]\nThere is an internal report that KASAN is reporting use-after-free, with\nthe following backtrace:\n\n BUG: KASAN: slab-use-after-free in btrfs_check_read_bio+0xa68/0xb70 [btrfs]\n Read of size 4 at addr ffff8881117cec28 by task kworker/u16:2/45\n CPU: 1 UID: 0 PID: 45 Comm: kworker/u16:2 Not tainted 6.11.0-rc2-next-20240805-default+ #76\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]\n Call Trace:\n dump_stack_lvl+0x61/0x80\n print_address_description.constprop.0+0x5e/0x2f0\n print_report+0x118/0x216\n kasan_report+0x11d/0x1f0\n btrfs_check_read_bio+0xa68/0xb70 [btrfs]\n process_one_work+0xce0/0x12a0\n worker_thread+0x717/0x1250\n kthread+0x2e3/0x3c0\n ret_from_fork+0x2d/0x70\n ret_from_fork_asm+0x11/0x20\n\n Allocated by task 20917:\n kasan_save_stack+0x37/0x60\n kasan_save_track+0x10/0x30\n __kasan_slab_alloc+0x7d/0x80\n kmem_cache_alloc_noprof+0x16e/0x3e0\n mempool_alloc_noprof+0x12e/0x310\n bio_alloc_bioset+0x3f0/0x7a0\n btrfs_bio_alloc+0x2e/0x50 [btrfs]\n submit_extent_page+0x4d1/0xdb0 [btrfs]\n btrfs_do_readpage+0x8b4/0x12a0 [btrfs]\n btrfs_readahead+0x29a/0x430 [btrfs]\n read_pages+0x1a7/0xc60\n page_cache_ra_unbounded+0x2ad/0x560\n filemap_get_pages+0x629/0xa20\n filemap_read+0x335/0xbf0\n vfs_read+0x790/0xcb0\n ksys_read+0xfd/0x1d0\n do_syscall_64+0x6d/0x140\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n Freed by task 20917:\n kasan_save_stack+0x37/0x60\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x37/0x50\n __kasan_slab_free+0x4b/0x60\n kmem_cache_free+0x214/0x5d0\n bio_free+0xed/0x180\n end_bbio_data_read+0x1cc/0x580 [btrfs]\n btrfs_submit_chunk+0x98d/0x1880 [btrfs]\n btrfs_submit_bio+0x33/0x70 [btrfs]\n submit_one_bio+0xd4/0x130 [btrfs]\n submit_extent_page+0x3ea/0xdb0 [btrfs]\n btrfs_do_readpage+0x8b4/0x12a0 [btrfs]\n btrfs_readahead+0x29a/0x430 [btrfs]\n read_pages+0x1a7/0xc60\n page_cache_ra_unbounded+0x2ad/0x560\n filemap_get_pages+0x629/0xa20\n filemap_read+0x335/0xbf0\n vfs_read+0x790/0xcb0\n ksys_read+0xfd/0x1d0\n do_syscall_64+0x6d/0x140\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n[CAUSE]\nAlthough I cannot reproduce the error, the report itself is good enough\nto pin down the cause.\n\nThe call trace is the regular endio workqueue context, but the\nfree-by-task trace is showing that during btrfs_submit_chunk() we\nalready hit a critical error, and is calling btrfs_bio_end_io() to error\nout. And the original endio function called bio_put() to free the whole\nbio.\n\nThis means a double freeing thus causing use-after-free, e.g.:\n\n1. Enter btrfs_submit_bio() with a read bio\n The read bio length is 128K, crossing two 64K stripes.\n\n2. The first run of btrfs_submit_chunk()\n\n2.1 Call btrfs_map_block(), which returns 64K\n2.2 Call btrfs_split_bio()\n Now there are two bios, one referring to the first 64K, the other\n referring to the second 64K.\n2.3 The first half is submitted.\n\n3. The second run of btrfs_submit_chunk()\n\n3.1 Call btrfs_map_block(), which by somehow failed\n Now we call btrfs_bio_end_io() to handle the error\n\n3.2 btrfs_bio_end_io() calls the original endio function\n Which is end_bbio_data_read(), and it calls bio_put() for the\n original bio.\n\n Now the original bio is freed.\n\n4. The submitted first 64K bio finished\n Now we call into btrfs_check_read_bio() and tries to advance the bio\n iter.\n But since the original bio (thus its iter) is already freed, we\n trigger the above use-after free.\n\n And even if the memory is not poisoned/corrupted, we will later call\n the original endio function, causing a double freeing.\n\n[FIX]\nInstead of calling btrfs_bio_end_io(), call btrfs_orig_bbio_end_io(),\nwhich has the extra check on split bios and do the pr\n---truncated---" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:58.871Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/51722b99f41f5e722ffa10b8f61e802a0e70b331" }, { "url": "https://git.kernel.org/stable/c/4a3b9e1a8e6cd1a8d427a905e159de58d38941cc" }, { "url": "https://git.kernel.org/stable/c/10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10" } ], "title": "btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46687", "datePublished": "2024-09-13T05:29:18.429Z", "dateReserved": "2024-09-11T15:12:18.249Z", "dateUpdated": "2024-12-19T09:20:58.871Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46707
Vulnerability from cvelistv5
Published
2024-09-13 06:27
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46707", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:02:32.191138Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:02:47.903Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "arch/arm64/kvm/sys_regs.c", "arch/arm64/kvm/vgic/vgic.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "15818af2f7aa55eff375333cb7689df15d3f24ef", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "96b076e8ee5bc3a1126848c8add0f74bd30dc9d1", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "94d4fbad01b19ec5eab3d6b50aaec4f9db8b2d8d", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "9d7629bec5c3f80bd0e3bf8103c06a2f7046bd92", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "2073132f6ed3079369e857a8deb33d11bdd983bc", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "3e6245ebe7ef341639e9a7e402b3ade8ad45a19f", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "arch/arm64/kvm/sys_regs.c", "arch/arm64/kvm/vgic/vgic.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.107", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.48", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3\n\nOn a system with a GICv3, if a guest hasn\u0027t been configured with\nGICv3 and that the host is not capable of GICv2 emulation,\na write to any of the ICC_*SGI*_EL1 registers is trapped to EL2.\n\nWe therefore try to emulate the SGI access, only to hit a NULL\npointer as no private interrupt is allocated (no GIC, remember?).\n\nThe obvious fix is to give the guest what it deserves, in the\nshape of a UNDEF exception." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:24.022Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/15818af2f7aa55eff375333cb7689df15d3f24ef" }, { "url": "https://git.kernel.org/stable/c/96b076e8ee5bc3a1126848c8add0f74bd30dc9d1" }, { "url": "https://git.kernel.org/stable/c/94d4fbad01b19ec5eab3d6b50aaec4f9db8b2d8d" }, { "url": "https://git.kernel.org/stable/c/9d7629bec5c3f80bd0e3bf8103c06a2f7046bd92" }, { "url": "https://git.kernel.org/stable/c/2073132f6ed3079369e857a8deb33d11bdd983bc" }, { "url": "https://git.kernel.org/stable/c/3e6245ebe7ef341639e9a7e402b3ade8ad45a19f" } ], "title": "KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46707", "datePublished": "2024-09-13T06:27:33.709Z", "dateReserved": "2024-09-11T15:12:18.252Z", "dateUpdated": "2024-12-19T09:21:24.022Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46678
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
bonding: change ipsec_lock from spin lock to mutex
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46678", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:12:41.184590Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:12:56.353Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/net/bonding/bond_main.c", "include/net/bonding.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "6b598069164ac1bb60996d6ff94e7f9169dbd2d3", "status": "affected", "version": "9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334", "versionType": "git" }, { "lessThan": "56354b0a2c24a7828eeed7de4b4dc9652d9affa3", "status": "affected", "version": "9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334", "versionType": "git" }, { "lessThan": "2aeeef906d5a526dc60cf4af92eda69836c39b1f", "status": "affected", "version": "9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/net/bonding/bond_main.c", "include/net/bonding.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "5.14" }, { "lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: change ipsec_lock from spin lock to mutex\n\nIn the cited commit, bond-\u003eipsec_lock is added to protect ipsec_list,\nhence xdo_dev_state_add and xdo_dev_state_delete are called inside\nthis lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep,\n\"scheduling while atomic\" will be triggered when changing bond\u0027s\nactive slave.\n\n[ 101.055189] BUG: scheduling while atomic: bash/902/0x00000200\n[ 101.055726] Modules linked in:\n[ 101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1\n[ 101.058760] Hardware name:\n[ 101.059434] Call Trace:\n[ 101.059436] \u003cTASK\u003e\n[ 101.060873] dump_stack_lvl+0x51/0x60\n[ 101.061275] __schedule_bug+0x4e/0x60\n[ 101.061682] __schedule+0x612/0x7c0\n[ 101.062078] ? __mod_timer+0x25c/0x370\n[ 101.062486] schedule+0x25/0xd0\n[ 101.062845] schedule_timeout+0x77/0xf0\n[ 101.063265] ? asm_common_interrupt+0x22/0x40\n[ 101.063724] ? __bpf_trace_itimer_state+0x10/0x10\n[ 101.064215] __wait_for_common+0x87/0x190\n[ 101.064648] ? usleep_range_state+0x90/0x90\n[ 101.065091] cmd_exec+0x437/0xb20 [mlx5_core]\n[ 101.065569] mlx5_cmd_do+0x1e/0x40 [mlx5_core]\n[ 101.066051] mlx5_cmd_exec+0x18/0x30 [mlx5_core]\n[ 101.066552] mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core]\n[ 101.067163] ? bonding_sysfs_store_option+0x4d/0x80 [bonding]\n[ 101.067738] ? kmalloc_trace+0x4d/0x350\n[ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core]\n[ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core]\n[ 101.069312] bond_change_active_slave+0x392/0x900 [bonding]\n[ 101.069868] bond_option_active_slave_set+0x1c2/0x240 [bonding]\n[ 101.070454] __bond_opt_set+0xa6/0x430 [bonding]\n[ 101.070935] __bond_opt_set_notify+0x2f/0x90 [bonding]\n[ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [bonding]\n[ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [bonding]\n[ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0\n[ 101.073033] vfs_write+0x2d8/0x400\n[ 101.073416] ? alloc_fd+0x48/0x180\n[ 101.073798] ksys_write+0x5f/0xe0\n[ 101.074175] do_syscall_64+0x52/0x110\n[ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nAs bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called\nfrom bond_change_active_slave, which requires holding the RTNL lock.\nAnd bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state\nxdo_dev_state_add and xdo_dev_state_delete APIs, which are in user\ncontext. So ipsec_lock doesn\u0027t have to be spin lock, change it to\nmutex, and thus the above issue can be resolved." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:47.712Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/6b598069164ac1bb60996d6ff94e7f9169dbd2d3" }, { "url": "https://git.kernel.org/stable/c/56354b0a2c24a7828eeed7de4b4dc9652d9affa3" }, { "url": "https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f" } ], "title": "bonding: change ipsec_lock from spin lock to mutex", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46678", "datePublished": "2024-09-13T05:29:12.835Z", "dateReserved": "2024-09-11T15:12:18.248Z", "dateUpdated": "2024-12-19T09:20:47.712Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46696
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
nfsd: fix potential UAF in nfsd4_cb_getattr_release
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46696", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:05:32.048367Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:05:46.361Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/nfsd/nfs4state.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "e0b66698a5ae41078f7490e8b3527013f5fccd6c", "status": "affected", "version": "c5967721e1063648b0506481585ba7e2e49a075e", "versionType": "git" }, { "lessThan": "1116e0e372eb16dd907ec571ce5d4af325c55c10", "status": "affected", "version": "c5967721e1063648b0506481585ba7e2e49a075e", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/nfsd/nfs4state.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.9" }, { "lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix potential UAF in nfsd4_cb_getattr_release\n\nOnce we drop the delegation reference, the fields embedded in it are no\nlonger safe to access. Do that last." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:10.507Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/e0b66698a5ae41078f7490e8b3527013f5fccd6c" }, { "url": "https://git.kernel.org/stable/c/1116e0e372eb16dd907ec571ce5d4af325c55c10" } ], "title": "nfsd: fix potential UAF in nfsd4_cb_getattr_release", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46696", "datePublished": "2024-09-13T05:29:24.123Z", "dateReserved": "2024-09-11T15:12:18.250Z", "dateUpdated": "2024-12-19T09:21:10.507Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46688
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46688", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:07:39.843089Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:07:54.585Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/erofs/zutil.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "49c0e081998008cde0c872c0ff9affa1ece4b878", "status": "affected", "version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b", "versionType": "git" }, { "lessThan": "0005e01e1e875c5e27130c5e2ed0189749d1e08a", "status": "affected", "version": "d6db47e571dcaecaeaafa8840d00ae849ae3907b", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/erofs/zutil.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails\n\nIf z_erofs_gbuf_growsize() partially fails on a global buffer due to\nmemory allocation failure or fault injection (as reported by syzbot [1]),\nnew pages need to be freed by comparing to the existing pages to avoid\nmemory leaks.\n\nHowever, the old gbuf-\u003epages[] array may not be large enough, which can\nlead to null-ptr-deref or out-of-bound access.\n\nFix this by checking against gbuf-\u003enrpages in advance.\n\n[1] https://lore.kernel.org/r/000000000000f7b96e062018c6e3@google.com" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:59.998Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/49c0e081998008cde0c872c0ff9affa1ece4b878" }, { "url": "https://git.kernel.org/stable/c/0005e01e1e875c5e27130c5e2ed0189749d1e08a" } ], "title": "erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46688", "datePublished": "2024-09-13T05:29:19.031Z", "dateReserved": "2024-09-11T15:12:18.249Z", "dateUpdated": "2024-12-19T09:20:59.998Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46697
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
nfsd: ensure that nfsd4_fattr_args.context is zeroed out
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46697", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:05:16.231611Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:05:30.417Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "fs/nfsd/nfs4xdr.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "dd65b324174a64558a16ebbf4c3266e5701185d0", "status": "affected", "version": "f59388a579c6a395de8f7372b267d3abecd8d6bf", "versionType": "git" }, { "lessThan": "f58bab6fd4063913bd8321e99874b8239e9ba726", "status": "affected", "version": "f59388a579c6a395de8f7372b267d3abecd8d6bf", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "fs/nfsd/nfs4xdr.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.7" }, { "lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: ensure that nfsd4_fattr_args.context is zeroed out\n\nIf nfsd4_encode_fattr4 ends up doing a \"goto out\" before we get to\nchecking for the security label, then args.context will be set to\nuninitialized junk on the stack, which we\u0027ll then try to free.\nInitialize it early." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:11.823Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/dd65b324174a64558a16ebbf4c3266e5701185d0" }, { "url": "https://git.kernel.org/stable/c/f58bab6fd4063913bd8321e99874b8239e9ba726" } ], "title": "nfsd: ensure that nfsd4_fattr_args.context is zeroed out", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46697", "datePublished": "2024-09-13T05:29:24.787Z", "dateReserved": "2024-09-11T15:12:18.250Z", "dateUpdated": "2024-12-19T09:21:11.823Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46702
Vulnerability from cvelistv5
Published
2024-09-13 06:27
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
thunderbolt: Mark XDomain as unplugged when router is removed
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46702", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:03:56.451430Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:04:10.145Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/thunderbolt/switch.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "747bc154577de6e6af4bc99abfa859b8419bb4d8", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "23ce6ba3b95488a2b9e9f6d43b340da0c15395dc", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "80ac8d194831eca0c2f4fd862f7925532fda320c", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "18b3ad2a3cc877dd4b16f48d84aa27b78d53bf1d", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "7ca24cf9163c112bb6b580c6fb57c04a1f8b76e1", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "e2006140ad2e01a02ed0aff49cc2ae3ceeb11f8d", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/thunderbolt/switch.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.107", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.48", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Mark XDomain as unplugged when router is removed\n\nI noticed that when we do discrete host router NVM upgrade and it gets\nhot-removed from the PCIe side as a result of NVM firmware authentication,\nif there is another host connected with enabled paths we hang in tearing\nthem down. This is due to fact that the Thunderbolt networking driver\nalso tries to cleanup the paths and ends up blocking in\ntb_disconnect_xdomain_paths() waiting for the domain lock.\n\nHowever, at this point we already cleaned the paths in tb_stop() so\nthere is really no need for tb_disconnect_xdomain_paths() to do that\nanymore. Furthermore it already checks if the XDomain is unplugged and\nbails out early so take advantage of that and mark the XDomain as\nunplugged when we remove the parent router." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:18.183Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/747bc154577de6e6af4bc99abfa859b8419bb4d8" }, { "url": "https://git.kernel.org/stable/c/23ce6ba3b95488a2b9e9f6d43b340da0c15395dc" }, { "url": "https://git.kernel.org/stable/c/80ac8d194831eca0c2f4fd862f7925532fda320c" }, { "url": "https://git.kernel.org/stable/c/18b3ad2a3cc877dd4b16f48d84aa27b78d53bf1d" }, { "url": "https://git.kernel.org/stable/c/7ca24cf9163c112bb6b580c6fb57c04a1f8b76e1" }, { "url": "https://git.kernel.org/stable/c/e2006140ad2e01a02ed0aff49cc2ae3ceeb11f8d" } ], "title": "thunderbolt: Mark XDomain as unplugged when router is removed", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46702", "datePublished": "2024-09-13T06:27:30.550Z", "dateReserved": "2024-09-11T15:12:18.251Z", "dateUpdated": "2024-12-19T09:21:18.183Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46679
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
ethtool: check device is present when getting link settings
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46679", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:10:05.131175Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:10:19.475Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/core/net-sysfs.c", "net/ethtool/ioctl.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "ec7b4f7f644018ac293cb1b02528a40a32917e62", "status": "affected", "version": "d519e17e2d01a0ee9abe083019532061b4438065", "versionType": "git" }, { "lessThan": "842a40c7273ba1c1cb30dda50405b328de1d860e", "status": "affected", "version": "d519e17e2d01a0ee9abe083019532061b4438065", "versionType": "git" }, { "lessThan": "7a8d98b6d6484d3ad358510366022da080c37cbc", "status": "affected", "version": "d519e17e2d01a0ee9abe083019532061b4438065", "versionType": "git" }, { "lessThan": "9bba5955eed160102114d4cc00c3d399be9bdae4", "status": "affected", "version": "d519e17e2d01a0ee9abe083019532061b4438065", "versionType": "git" }, { "lessThan": "94ab317024ba373d37340893d1c0358638935fbb", "status": "affected", "version": "d519e17e2d01a0ee9abe083019532061b4438065", "versionType": "git" }, { "lessThan": "1d6d9b5b1b95bfeccb84386a51b7e6c510ec13b2", "status": "affected", "version": "d519e17e2d01a0ee9abe083019532061b4438065", "versionType": "git" }, { "lessThan": "a699781c79ecf6cfe67fb00a0331b4088c7c8466", "status": "affected", "version": "d519e17e2d01a0ee9abe083019532061b4438065", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/core/net-sysfs.c", "net/ethtool/ioctl.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "2.6.33" }, { "lessThan": "2.6.33", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.283", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: check device is present when getting link settings\n\nA sysfs reader can race with a device reset or removal, attempting to\nread device state when the device is not actually present. eg:\n\n [exception RIP: qed_get_current_link+17]\n #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede]\n #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3\n #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4\n #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300\n #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c\n #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b\n #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3\n #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1\n #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f\n #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb\n\n crash\u003e struct net_device.state ffff9a9d21336000\n state = 5,\n\nstate 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100).\nThe device is not present, note lack of __LINK_STATE_PRESENT (0b10).\n\nThis is the same sort of panic as observed in commit 4224cfd7fb65\n(\"net-sysfs: add check for netdevice being present to speed_show\").\n\nThere are many other callers of __ethtool_get_link_ksettings() which\ndon\u0027t have a device presence check.\n\nMove this check into ethtool to protect all callers." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:48.865Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/ec7b4f7f644018ac293cb1b02528a40a32917e62" }, { "url": "https://git.kernel.org/stable/c/842a40c7273ba1c1cb30dda50405b328de1d860e" }, { "url": "https://git.kernel.org/stable/c/7a8d98b6d6484d3ad358510366022da080c37cbc" }, { "url": "https://git.kernel.org/stable/c/9bba5955eed160102114d4cc00c3d399be9bdae4" }, { "url": "https://git.kernel.org/stable/c/94ab317024ba373d37340893d1c0358638935fbb" }, { "url": "https://git.kernel.org/stable/c/1d6d9b5b1b95bfeccb84386a51b7e6c510ec13b2" }, { "url": "https://git.kernel.org/stable/c/a699781c79ecf6cfe67fb00a0331b4088c7c8466" } ], "title": "ethtool: check device is present when getting link settings", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46679", "datePublished": "2024-09-13T05:29:13.450Z", "dateReserved": "2024-09-11T15:12:18.248Z", "dateUpdated": "2024-12-19T09:20:48.865Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46675
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
usb: dwc3: core: Prevent USB core invalid event buffer address access
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46675", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:44:29.981385Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:44:43.856Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/usb/dwc3/core.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "eca3f543f817da87c00d1a5697b473efb548204f", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "d2afc2bffec77316b90d530b07695e3f534df914", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "b72da4d89b97da71e056cc4d1429b2bc426a9c2f", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "111277b881def3153335acfe0d1f43e6cd83ac93", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "2189fd13c577d7881f94affc09c950a795064c4b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "7bb11a75dd4d3612378b90e2a4aa49bdccea28ab", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "e23f6ad8d110bf632f7471482e10b43dc174fb72", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" }, { "lessThan": "14e497183df28c006603cc67fd3797a537eef7b9", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/usb/dwc3/core.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.321", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.283", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: core: Prevent USB core invalid event buffer address access\n\nThis commit addresses an issue where the USB core could access an\ninvalid event buffer address during runtime suspend, potentially causing\nSMMU faults and other memory issues in Exynos platforms. The problem\narises from the following sequence.\n 1. In dwc3_gadget_suspend, there is a chance of a timeout when\n moving the USB core to the halt state after clearing the\n run/stop bit by software.\n 2. In dwc3_core_exit, the event buffer is cleared regardless of\n the USB core\u0027s status, which may lead to an SMMU faults and\n other memory issues. if the USB core tries to access the event\n buffer address.\n\nTo prevent this hardware quirk on Exynos platforms, this commit ensures\nthat the event buffer address is not cleared by software when the USB\ncore is active during runtime suspend by checking its status before\nclearing the buffer address." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:44.070Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/eca3f543f817da87c00d1a5697b473efb548204f" }, { "url": "https://git.kernel.org/stable/c/d2afc2bffec77316b90d530b07695e3f534df914" }, { "url": "https://git.kernel.org/stable/c/b72da4d89b97da71e056cc4d1429b2bc426a9c2f" }, { "url": "https://git.kernel.org/stable/c/111277b881def3153335acfe0d1f43e6cd83ac93" }, { "url": "https://git.kernel.org/stable/c/2189fd13c577d7881f94affc09c950a795064c4b" }, { "url": "https://git.kernel.org/stable/c/7bb11a75dd4d3612378b90e2a4aa49bdccea28ab" }, { "url": "https://git.kernel.org/stable/c/e23f6ad8d110bf632f7471482e10b43dc174fb72" }, { "url": "https://git.kernel.org/stable/c/14e497183df28c006603cc67fd3797a537eef7b9" } ], "title": "usb: dwc3: core: Prevent USB core invalid event buffer address access", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46675", "datePublished": "2024-09-13T05:29:10.987Z", "dateReserved": "2024-09-11T15:12:18.247Z", "dateUpdated": "2024-12-19T09:20:44.070Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46703
Vulnerability from cvelistv5
Published
2024-09-13 06:27
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
Revert "serial: 8250_omap: Set the console genpd always on if no console suspend"
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46703", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:03:39.883013Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:03:54.641Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/tty/serial/8250/8250_omap.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "321aecb079e9ca8b1af90778068a6fb40f2bf22d", "status": "affected", "version": "68e6939ea9ec3d6579eadeab16060339cdeaf940", "versionType": "git" }, { "lessThan": "0863bffda1131fd2fa9c05b653ad9ee3d8db127e", "status": "affected", "version": "68e6939ea9ec3d6579eadeab16060339cdeaf940", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/tty/serial/8250/8250_omap.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.7" }, { "lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"serial: 8250_omap: Set the console genpd always on if no console suspend\"\n\nThis reverts commit 68e6939ea9ec3d6579eadeab16060339cdeaf940.\n\nKevin reported that this causes a crash during suspend on platforms that\ndont use PM domains." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:19.386Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/321aecb079e9ca8b1af90778068a6fb40f2bf22d" }, { "url": "https://git.kernel.org/stable/c/0863bffda1131fd2fa9c05b653ad9ee3d8db127e" } ], "title": "Revert \"serial: 8250_omap: Set the console genpd always on if no console suspend\"", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46703", "datePublished": "2024-09-13T06:27:31.178Z", "dateReserved": "2024-09-11T15:12:18.251Z", "dateUpdated": "2024-12-19T09:21:19.386Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46674
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
usb: dwc3: st: fix probed platform device ref count on probe error path
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46674", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:44:46.031544Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:45:00.520Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/usb/dwc3/dwc3-st.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "b0979a885b9d4df2a25b88e9d444ccaa5f9f495c", "status": "affected", "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "versionType": "git" }, { "lessThan": "f3498650df0805c75b4e1c94d07423c46cbf4ce1", "status": "affected", "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "versionType": "git" }, { "lessThan": "6aee4c5635d81f4809c3b9f0c198a65adfbb2ada", "status": "affected", "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "versionType": "git" }, { "lessThan": "060f41243ad7f6f5249fa7290dda0c01f723d12d", "status": "affected", "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "versionType": "git" }, { "lessThan": "4c6735299540f3c82a5033d35be76a5c42e0fb18", "status": "affected", "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "versionType": "git" }, { "lessThan": "e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49", "status": "affected", "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "versionType": "git" }, { "lessThan": "1de989668708ce5875efc9d669d227212aeb9a90", "status": "affected", "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "versionType": "git" }, { "lessThan": "ddfcfeba891064b88bb844208b43bef2ef970f0c", "status": "affected", "version": "f83fca0707c66e36f14efef7f68702cb12de70b7", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/usb/dwc3/dwc3-st.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "3.18" }, { "lessThan": "3.18", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.321", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.283", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: st: fix probed platform device ref count on probe error path\n\nThe probe function never performs any paltform device allocation, thus\nerror path \"undo_platform_dev_alloc\" is entirely bogus. It drops the\nreference count from the platform device being probed. If error path is\ntriggered, this will lead to unbalanced device reference counts and\npremature release of device resources, thus possible use-after-free when\nreleasing remaining devm-managed resources." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:42.909Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/b0979a885b9d4df2a25b88e9d444ccaa5f9f495c" }, { "url": "https://git.kernel.org/stable/c/f3498650df0805c75b4e1c94d07423c46cbf4ce1" }, { "url": "https://git.kernel.org/stable/c/6aee4c5635d81f4809c3b9f0c198a65adfbb2ada" }, { "url": "https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d" }, { "url": "https://git.kernel.org/stable/c/4c6735299540f3c82a5033d35be76a5c42e0fb18" }, { "url": "https://git.kernel.org/stable/c/e1e5e8ea2731150d5ba7c707f9e02fafebcfeb49" }, { "url": "https://git.kernel.org/stable/c/1de989668708ce5875efc9d669d227212aeb9a90" }, { "url": "https://git.kernel.org/stable/c/ddfcfeba891064b88bb844208b43bef2ef970f0c" } ], "title": "usb: dwc3: st: fix probed platform device ref count on probe error path", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46674", "datePublished": "2024-09-13T05:29:10.381Z", "dateReserved": "2024-09-11T15:12:18.247Z", "dateUpdated": "2024-12-19T09:20:42.909Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46709
Vulnerability from cvelistv5
Published
2024-09-13 06:33
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
drm/vmwgfx: Fix prime with external buffers
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46709", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:00:04.048988Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:00:18.143Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/vmwgfx/vmwgfx_blit.c", "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h", "drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4", "status": "affected", "version": "65674218b43f2dd54587ab2b06560e17c30d8b41", "versionType": "git" }, { "lessThan": "5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854", "status": "affected", "version": "b32233accefff1338806f064fb9b62cf5bc0609f", "versionType": "git" }, { "lessThan": "50f1199250912568606b3778dc56646c10cb7b04", "status": "affected", "version": "b32233accefff1338806f064fb9b62cf5bc0609f", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/vmwgfx/vmwgfx_blit.c", "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h", "drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.9" }, { "lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix prime with external buffers\n\nMake sure that for external buffers mapping goes through the dma_buf\ninterface instead of trying to access pages directly.\n\nExternal buffers might not provide direct access to readable/writable\npages so to make sure the bo\u0027s created from external dma_bufs can be\nread dma_buf interface has to be used.\n\nFixes crashes in IGT\u0027s kms_prime with vgem. Regular desktop usage won\u0027t\ntrigger this due to the fact that virtual machines will not have\nmultiple GPUs but it enables better test coverage in IGT." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:26.671Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4" }, { "url": "https://git.kernel.org/stable/c/5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854" }, { "url": "https://git.kernel.org/stable/c/50f1199250912568606b3778dc56646c10cb7b04" } ], "title": "drm/vmwgfx: Fix prime with external buffers", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46709", "datePublished": "2024-09-13T06:33:41.392Z", "dateReserved": "2024-09-11T15:12:18.252Z", "dateUpdated": "2024-12-19T09:21:26.671Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46705
Vulnerability from cvelistv5
Published
2024-09-13 06:27
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
drm/xe: reset mmio mappings with devm
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46705", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:03:07.858976Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:03:22.407Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/xe/xe_device.c", "drivers/gpu/drm/xe/xe_mmio.c", "drivers/gpu/drm/xe/xe_mmio.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "b1c9fbed3884d3883021d699c7cdf5253a65543a", "status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "versionType": "git" }, { "lessThan": "c7117419784f612d59ee565145f722e8b5541fe6", "status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/xe/xe_device.c", "drivers/gpu/drm/xe/xe_mmio.c", "drivers/gpu/drm/xe/xe_mmio.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.8" }, { "lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.7", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: reset mmio mappings with devm\n\nSet our various mmio mappings to NULL. This should make it easier to\ncatch something rogue trying to mess with mmio after device removal. For\nexample, we might unmap everything and then start hitting some mmio\naddress which has already been unmamped by us and then remapped by\nsomething else, causing all kinds of carnage." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:21.676Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/b1c9fbed3884d3883021d699c7cdf5253a65543a" }, { "url": "https://git.kernel.org/stable/c/c7117419784f612d59ee565145f722e8b5541fe6" } ], "title": "drm/xe: reset mmio mappings with devm", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46705", "datePublished": "2024-09-13T06:27:32.455Z", "dateReserved": "2024-09-11T15:12:18.251Z", "dateUpdated": "2024-12-19T09:21:21.676Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46691
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
usb: typec: ucsi: Move unregister out of atomic section
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46691", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:06:52.719050Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:07:06.973Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/soc/qcom/pmic_glink.c", "drivers/usb/typec/ucsi/ucsi_glink.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "095b0001aefddcd9361097c971b7debc84e72714", "status": "affected", "version": "9329933699b32d467a99befa20415c4b2172389a", "versionType": "git" }, { "lessThan": "11bb2ffb679399f99041540cf662409905179e3a", "status": "affected", "version": "9329933699b32d467a99befa20415c4b2172389a", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/soc/qcom/pmic_glink.c", "drivers/usb/typec/ucsi/ucsi_glink.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.10" }, { "lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Move unregister out of atomic section\n\nCommit \u00279329933699b3 (\"soc: qcom: pmic_glink: Make client-lock\nnon-sleeping\")\u0027 moved the pmic_glink client list under a spinlock, as it\nis accessed by the rpmsg/glink callback, which in turn is invoked from\nIRQ context.\n\nThis means that ucsi_unregister() is now called from atomic context,\nwhich isn\u0027t feasible as it\u0027s expecting a sleepable context. An effort is\nunder way to get GLINK to invoke its callbacks in a sleepable context,\nbut until then lets schedule the unregistration.\n\nA side effect of this is that ucsi_unregister() can now happen\nafter the remote processor, and thereby the communication link with it, is\ngone. pmic_glink_send() is amended with a check to avoid the resulting NULL\npointer dereference.\nThis does however result in the user being informed about this error by\nthe following entry in the kernel log:\n\n ucsi_glink.pmic_glink_ucsi pmic_glink.ucsi.0: failed to send UCSI write request: -5" } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:04.182Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/095b0001aefddcd9361097c971b7debc84e72714" }, { "url": "https://git.kernel.org/stable/c/11bb2ffb679399f99041540cf662409905179e3a" } ], "title": "usb: typec: ucsi: Move unregister out of atomic section", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46691", "datePublished": "2024-09-13T05:29:20.991Z", "dateReserved": "2024-09-11T15:12:18.249Z", "dateUpdated": "2024-12-19T09:21:04.182Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46685
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:20
Severity ?
EPSS score ?
Summary
pinctrl: single: fix potential NULL dereference in pcs_get_function()
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46685", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:08:28.059052Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:08:41.786Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/pinctrl/pinctrl-single.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "0a2bab5ed161318f57134716accba0a30f3af191", "status": "affected", "version": "571aec4df5b72a80f80d1e524da8fbd7ff525c98", "versionType": "git" }, { "lessThan": "2cea369a5c2e85ab14ae716da1d1cc6d25c85e11", "status": "affected", "version": "571aec4df5b72a80f80d1e524da8fbd7ff525c98", "versionType": "git" }, { "lessThan": "4e9436375fcc9bd2a60ee96aba6ed53f7a377d10", "status": "affected", "version": "571aec4df5b72a80f80d1e524da8fbd7ff525c98", "versionType": "git" }, { "lessThan": "6341c2856785dca7006820b127278058a180c075", "status": "affected", "version": "571aec4df5b72a80f80d1e524da8fbd7ff525c98", "versionType": "git" }, { "lessThan": "8f0bd526921b6867c2f10a83cd4fd14139adcd92", "status": "affected", "version": "571aec4df5b72a80f80d1e524da8fbd7ff525c98", "versionType": "git" }, { "lessThan": "4ed45fe99ec9e3c9478bd634624cd05a57d002f7", "status": "affected", "version": "571aec4df5b72a80f80d1e524da8fbd7ff525c98", "versionType": "git" }, { "lessThan": "292151af6add3e5ab11b2e9916cffa5f52859a1f", "status": "affected", "version": "571aec4df5b72a80f80d1e524da8fbd7ff525c98", "versionType": "git" }, { "lessThan": "1c38a62f15e595346a1106025722869e87ffe044", "status": "affected", "version": "571aec4df5b72a80f80d1e524da8fbd7ff525c98", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/pinctrl/pinctrl-single.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.11" }, { "lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.321", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.283", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: single: fix potential NULL dereference in pcs_get_function()\n\npinmux_generic_get_function() can return NULL and the pointer \u0027function\u0027\nwas dereferenced without checking against NULL. Add checking of pointer\n\u0027function\u0027 in pcs_get_function().\n\nFound by code review." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:20:56.286Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/0a2bab5ed161318f57134716accba0a30f3af191" }, { "url": "https://git.kernel.org/stable/c/2cea369a5c2e85ab14ae716da1d1cc6d25c85e11" }, { "url": "https://git.kernel.org/stable/c/4e9436375fcc9bd2a60ee96aba6ed53f7a377d10" }, { "url": "https://git.kernel.org/stable/c/6341c2856785dca7006820b127278058a180c075" }, { "url": "https://git.kernel.org/stable/c/8f0bd526921b6867c2f10a83cd4fd14139adcd92" }, { "url": "https://git.kernel.org/stable/c/4ed45fe99ec9e3c9478bd634624cd05a57d002f7" }, { "url": "https://git.kernel.org/stable/c/292151af6add3e5ab11b2e9916cffa5f52859a1f" }, { "url": "https://git.kernel.org/stable/c/1c38a62f15e595346a1106025722869e87ffe044" } ], "title": "pinctrl: single: fix potential NULL dereference in pcs_get_function()", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46685", "datePublished": "2024-09-13T05:29:17.201Z", "dateReserved": "2024-09-11T15:12:18.248Z", "dateUpdated": "2024-12-19T09:20:56.286Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46689
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
soc: qcom: cmd-db: Map shared memory as WC, not WB
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46689", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:07:23.732311Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:07:38.504Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/soc/qcom/cmd-db.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "0ee9594c974368a17e85a431e9fe1c14fb65c278", "status": "affected", "version": "312416d9171a1460b7ed8d182b5b540c910ce80d", "versionType": "git" }, { "lessThan": "f5a5a5a0e95f36e2792d48e6e4b64e665eb01374", "status": "affected", "version": "312416d9171a1460b7ed8d182b5b540c910ce80d", "versionType": "git" }, { "lessThan": "eaff392c1e34fb77cc61505a31b0191e5e46e271", "status": "affected", "version": "312416d9171a1460b7ed8d182b5b540c910ce80d", "versionType": "git" }, { "lessThan": "d9d48d70e922b272875cda60d2ada89291c840cf", "status": "affected", "version": "312416d9171a1460b7ed8d182b5b540c910ce80d", "versionType": "git" }, { "lessThan": "ef80520be0ff78ae5ed44cb6eee1525e65bebe70", "status": "affected", "version": "312416d9171a1460b7ed8d182b5b540c910ce80d", "versionType": "git" }, { "lessThan": "62c2d63605ca25b5db78a347ed303c0a0a77d5b4", "status": "affected", "version": "312416d9171a1460b7ed8d182b5b540c910ce80d", "versionType": "git" }, { "lessThan": "f9bb896eab221618927ae6a2f1d566567999839d", "status": "affected", "version": "312416d9171a1460b7ed8d182b5b540c910ce80d", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/soc/qcom/cmd-db.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "4.18" }, { "lessThan": "4.18", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.283", "versionType": "semver" }, { "lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.225", "versionType": "semver" }, { "lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.166", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.108", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: cmd-db: Map shared memory as WC, not WB\n\nLinux does not write into cmd-db region. This region of memory is write\nprotected by XPU. XPU may sometime falsely detect clean cache eviction\nas \"write\" into the write protected region leading to secure interrupt\nwhich causes an endless loop somewhere in Trust Zone.\n\nThe only reason it is working right now is because Qualcomm Hypervisor\nmaps the same region as Non-Cacheable memory in Stage 2 translation\ntables. The issue manifests if we want to use another hypervisor (like\nXen or KVM), which does not know anything about those specific mappings.\n\nChanging the mapping of cmd-db memory from MEMREMAP_WB to MEMREMAP_WT/WC\nremoves dependency on correct mappings in Stage 2 tables. This patch\nfixes the issue by updating the mapping to MEMREMAP_WC.\n\nI tested this on SA8155P with Xen." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:01.651Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/0ee9594c974368a17e85a431e9fe1c14fb65c278" }, { "url": "https://git.kernel.org/stable/c/f5a5a5a0e95f36e2792d48e6e4b64e665eb01374" }, { "url": "https://git.kernel.org/stable/c/eaff392c1e34fb77cc61505a31b0191e5e46e271" }, { "url": "https://git.kernel.org/stable/c/d9d48d70e922b272875cda60d2ada89291c840cf" }, { "url": "https://git.kernel.org/stable/c/ef80520be0ff78ae5ed44cb6eee1525e65bebe70" }, { "url": "https://git.kernel.org/stable/c/62c2d63605ca25b5db78a347ed303c0a0a77d5b4" }, { "url": "https://git.kernel.org/stable/c/f9bb896eab221618927ae6a2f1d566567999839d" } ], "title": "soc: qcom: cmd-db: Map shared memory as WC, not WB", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46689", "datePublished": "2024-09-13T05:29:19.713Z", "dateReserved": "2024-09-11T15:12:18.249Z", "dateUpdated": "2024-12-19T09:21:01.651Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46711
Vulnerability from cvelistv5
Published
2024-09-13 06:33
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
mptcp: pm: fix ID 0 endp usage after multiple re-creations
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46711", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T14:59:30.987140Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T14:59:46.450Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "net/mptcp/pm_netlink.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c9c744666f7308a4daba520191e29d395260bcfe", "status": "affected", "version": "3ad14f54bd7448384458e69f0183843f683ecce8", "versionType": "git" }, { "lessThan": "53e2173172d26c0617b29dd83618b71664bed1fb", "status": "affected", "version": "3ad14f54bd7448384458e69f0183843f683ecce8", "versionType": "git" }, { "lessThan": "119806ae4e46cf239db8e6ad92bc2fd3daae86dc", "status": "affected", "version": "3ad14f54bd7448384458e69f0183843f683ecce8", "versionType": "git" }, { "lessThan": "9366922adc6a71378ca01f898c41be295309f044", "status": "affected", "version": "3ad14f54bd7448384458e69f0183843f683ecce8", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "net/mptcp/pm_netlink.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.0" }, { "lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.109", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: fix ID 0 endp usage after multiple re-creations\n\n\u0027local_addr_used\u0027 and \u0027add_addr_accepted\u0027 are decremented for addresses\nnot related to the initial subflow (ID0), because the source and\ndestination addresses of the initial subflows are known from the\nbeginning: they don\u0027t count as \"additional local address being used\" or\n\"ADD_ADDR being accepted\".\n\nIt is then required not to increment them when the entrypoint used by\nthe initial subflow is removed and re-added during a connection. Without\nthis modification, this entrypoint cannot be removed and re-added more\nthan once." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:29.306Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c9c744666f7308a4daba520191e29d395260bcfe" }, { "url": "https://git.kernel.org/stable/c/53e2173172d26c0617b29dd83618b71664bed1fb" }, { "url": "https://git.kernel.org/stable/c/119806ae4e46cf239db8e6ad92bc2fd3daae86dc" }, { "url": "https://git.kernel.org/stable/c/9366922adc6a71378ca01f898c41be295309f044" } ], "title": "mptcp: pm: fix ID 0 endp usage after multiple re-creations", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46711", "datePublished": "2024-09-13T06:33:42.956Z", "dateReserved": "2024-09-11T15:12:18.252Z", "dateUpdated": "2024-12-19T09:21:29.306Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46712
Vulnerability from cvelistv5
Published
2024-09-13 06:44
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
drm/vmwgfx: Disable coherent dumb buffers without 3d
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46712", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T14:59:14.613769Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T14:59:29.584Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/vmwgfx/vmwgfx_surface.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "c45558414b8f2e0b9dc34eb8f9d4e8359b887681", "status": "affected", "version": "af6441e6f3d41e95bfc5bfc11960c259bb4f0f11", "versionType": "git" }, { "lessThan": "e9fd436bb8fb9b9d31fdf07bbcdba6d30290c5e4", "status": "affected", "version": "d6667f0ddf46c671d379cd5fe66ce0a54d2a743a", "versionType": "git" } ] }, { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/gpu/drm/vmwgfx/vmwgfx_surface.c" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "6.10.8", "status": "affected", "version": "6.10.4", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Disable coherent dumb buffers without 3d\n\nCoherent surfaces make only sense if the host renders to them using\naccelerated apis. Without 3d the entire content of dumb buffers stays\nin the guest making all of the extra work they\u0027re doing to synchronize\nbetween guest and host useless.\n\nConfigurations without 3d also tend to run with very low graphics\nmemory limits. The pinned console fb, mob cursors and graphical login\nmanager tend to run out of 16MB graphics memory that those guests use.\n\nFix it by making sure the coherent dumb buffers are only used on\nconfigs with 3d enabled." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:30.460Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/c45558414b8f2e0b9dc34eb8f9d4e8359b887681" }, { "url": "https://git.kernel.org/stable/c/e9fd436bb8fb9b9d31fdf07bbcdba6d30290c5e4" } ], "title": "drm/vmwgfx: Disable coherent dumb buffers without 3d", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46712", "datePublished": "2024-09-13T06:44:59.746Z", "dateReserved": "2024-09-11T15:12:18.254Z", "dateUpdated": "2024-12-19T09:21:30.460Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-46693
Vulnerability from cvelistv5
Published
2024-09-13 05:29
Modified
2024-12-19 09:21
Severity ?
EPSS score ?
Summary
soc: qcom: pmic_glink: Fix race during initialization
References
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-46693", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-29T15:06:19.795403Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-29T15:06:34.586Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Linux", "programFiles": [ "drivers/power/supply/qcom_battmgr.c", "drivers/soc/qcom/pmic_glink.c", "drivers/soc/qcom/pmic_glink_altmode.c", "drivers/usb/typec/ucsi/ucsi_glink.c", "include/linux/soc/qcom/pmic_glink.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "lessThan": "1efdbf5323c9360e05066049b97414405e94e087", "status": "affected", "version": "58ef4ece1e41ac525db3e79529909683325d85df", "versionType": "git" }, { "lessThan": "943b0e7cc646a624bb20a68080f8f1a4a55df41c", "status": "affected", "version": "58ef4ece1e41ac525db3e79529909683325d85df", "versionType": "git" }, { "lessThan": "3568affcddd68743e25aa3ec1647d9b82797757b", "status": "affected", "version": "58ef4ece1e41ac525db3e79529909683325d85df", "versionType": "git" } ] }, { "defaultStatus": "affected", "product": "Linux", "programFiles": [ "drivers/power/supply/qcom_battmgr.c", "drivers/soc/qcom/pmic_glink.c", "drivers/soc/qcom/pmic_glink_altmode.c", "drivers/usb/typec/ucsi/ucsi_glink.c", "include/linux/soc/qcom/pmic_glink.h" ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [ { "status": "affected", "version": "6.3" }, { "lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver" }, { "lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.49", "versionType": "semver" }, { "lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.8", "versionType": "semver" }, { "lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix" } ] } ], "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: pmic_glink: Fix race during initialization\n\nAs pointed out by Stephen Boyd it is possible that during initialization\nof the pmic_glink child drivers, the protection-domain notifiers fires,\nand the associated work is scheduled, before the client registration\nreturns and as a result the local \"client\" pointer has been initialized.\n\nThe outcome of this is a NULL pointer dereference as the \"client\"\npointer is blindly dereferenced.\n\nTimeline provided by Stephen:\n CPU0 CPU1\n ---- ----\n ucsi-\u003eclient = NULL;\n devm_pmic_glink_register_client()\n client-\u003epdr_notify(client-\u003epriv, pg-\u003eclient_state)\n pmic_glink_ucsi_pdr_notify()\n schedule_work(\u0026ucsi-\u003eregister_work)\n \u003cschedule away\u003e\n pmic_glink_ucsi_register()\n ucsi_register()\n pmic_glink_ucsi_read_version()\n pmic_glink_ucsi_read()\n pmic_glink_ucsi_read()\n pmic_glink_send(ucsi-\u003eclient)\n \u003cclient is NULL BAD\u003e\n ucsi-\u003eclient = client // Too late!\n\nThis code is identical across the altmode, battery manager and usci\nchild drivers.\n\nResolve this by splitting the allocation of the \"client\" object and the\nregistration thereof into two operations.\n\nThis only happens if the protection domain registry is populated at the\ntime of registration, which by the introduction of commit \u00271ebcde047c54\n(\"soc: qcom: add pd-mapper implementation\")\u0027 became much more likely." } ], "providerMetadata": { "dateUpdated": "2024-12-19T09:21:06.763Z", "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux" }, "references": [ { "url": "https://git.kernel.org/stable/c/1efdbf5323c9360e05066049b97414405e94e087" }, { "url": "https://git.kernel.org/stable/c/943b0e7cc646a624bb20a68080f8f1a4a55df41c" }, { "url": "https://git.kernel.org/stable/c/3568affcddd68743e25aa3ec1647d9b82797757b" } ], "title": "soc: qcom: pmic_glink: Fix race during initialization", "x_generator": { "engine": "bippy-5f407fcff5a0" } } }, "cveMetadata": { "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "assignerShortName": "Linux", "cveId": "CVE-2024-46693", "datePublished": "2024-09-13T05:29:22.260Z", "dateReserved": "2024-09-11T15:12:18.249Z", "dateUpdated": "2024-12-19T09:21:06.763Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.