In the Linux kernel, the following vulnerability has been resolved:
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
The TPM event log table is a Linux specific construct, where the data
produced by the GetEventLog() boot service is cached in memory, and
passed on to the OS u...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: set the cipher for secured NDP ranging
The cipher pointer is not set, but is derefereced trying to set its
content, which leads to a NULL pointer dereference.
Fix it by pointing to the cipher parameter before d...
AFFECTED_PRODUCTS:
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
x86/sgx: Fix deadlock in SGX NUMA node search
When the current node doesn't have an EPC section configured by firmware
and all other EPC sections are used up, CPU can get stuck inside the
while loop that looks for an available EPC...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
nbd: fix race between timeout and normal completion
If request timetout is handled by nbd_requeue_cmd(), normal completion
has to be stopped for avoiding to complete this requeued request, other
use-after-free can be triggered.
F...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
In the Linux kernel, the following vulnerability has been resolved:
block, bfq: fix uaf for accessing waker_bfqq after splitting
After commit 42c306ed7233 ("block, bfq: don't break merge chain in
bfq_split_bfqq()"), if the current procress is the last holder of bfqq,
the bfqq can be freed after bf...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+2)
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Fix double free in OPTEE transport
Channels can be shared between protocols, avoid freeing the same channel
descriptors twice when unloading the stack.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
The kref_put() function will call nport->release if the refcount drops to
zero. The nport->release release function is _efc_nport_free() which frees
"nport"...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+2)
In the Linux kernel, the following vulnerability has been resolved:
tpm: Clean up TPM space after command failure
tpm_dev_transmit prepares the TPM space before attempting command
transmission. However if the command fails no rollback of this
preparation is done. This can result in transient handl...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
In case of malformed relocation record of kind BPF_CORE_TYPE_ID_LOCAL
referencing a non-existing BTF type, function bpf_core_calc_relo_insn
would cause a null pointer de...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential oob read in nilfs_btree_check_delete()
The function nilfs_btree_check_delete(), which checks whether degeneration
to direct mapping occurs before deleting a b-tree entry, causes memory
access outside the bloc...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
In the Linux kernel, the following vulnerability has been resolved:
PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
This code accidentally uses && where || was intended. It potentially
results in a NULL dereference.
Thus, fix the if-statement expression to use the correct condition...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+4)
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
In the Linux kernel, the following vulnerability has been resolved:
media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning
Fix a smatch static checker warning on vdec_h264_req_multi_if.c.
Which leads to a kernel crash when fb is NULL.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
Fix a smatch static checker warning on vdec_vp8_req_if.c.
Which leads to a kernel crash when fb is NULL.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
media: mediatek: vcodec: Fix H264 stateless decoder smatch warning
Fix a smatch static checker warning on vdec_h264_req_if.c.
Which leads to a kernel crash when fb is NULL.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
Within kirin_pcie_parse_port(), the pcie->num_slots is compared to
pcie->gpio_id_reset size (MAX_PCI_SLOTS) which is correct and would lead
to an overflow.
Thus, fix cond...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
Currently rsv_qp is freed before ib_unregister_device() is called
on HIP08. During the time interval, users can still dereg MR and
rsv_qp will be used in this process, leading to a U...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cxgb4: Added NULL check for lookup_atid
The lookup_atid() function can return NULL if the ATID is
invalid or does not exist in the identifier table, which
could lead to dereferencing a null pointer without a
check in the `act...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
In the Linux kernel, the following vulnerability has been resolved:
vhost_vdpa: assign irq bypass producer token correctly
We used to call irq_bypass_unregister_producer() in
vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the
token pointer is still valid or not.
Actually, we u...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
In the ether3_probe function, a timer is initialized with a callback
function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is
started,...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
In the Linux kernel, the following vulnerability has been resolved:
fuse: use exclusive lock when FUSE_I_CACHE_IO_MODE is set
This may be a typo. The comment has said shared locks are
not allowed when this bit is set. If using shared lock, the
wait in `fuse_file_cached_io_open` may be forever.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
mm: call the security_mmap_file() LSM hook in remap_file_pages()
The remap_file_pages syscall handler calls do_mmap() directly, which
doesn't contain the LSM security check. And if the process has called
personality(READ_IMPLIES_E...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9,
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support,
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
In the Linux kernel, the following vulnerability has been resolved:
KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock
Use a dedicated mutex to guard kvm_usage_count to fix a potential deadlock
on x86 due to a chain of locks and SRCU synchronizations. Translating the
below lock...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
KEYS: prevent NULL pointer dereference in find_asymmetric_key()
In find_asymmetric_key(), if all NULLs are passed in the id_{0,1,2}
arguments, the kernel will first emit WARN but then have an oops
because id_2 gets dereferenced an...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
firmware_loader: Block path traversal
Most firmware names are hardcoded strings, or are constructed from fairly
constrained format strings where the dynamic parts are just some hex
numbers or such.
However, there are a couple cod...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race setting file private on concurrent lseek using same fd
When doing concurrent lseek(2) system calls against the same file
descriptor, using multiple threads belonging to the same process, we have
a short time window...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
f2fs: Require FMODE_WRITE for atomic write ioctls
The F2FS ioctls for starting and committing atomic writes check for
inode_owner_or_capable(), but this does not give LSMs like SELinux or
Landlock an opportunity to deny the write...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
In the Linux kernel, the following vulnerability has been resolved:
padata: use integer wrap around to prevent deadlock on seq_nr overflow
When submitting more than 2^32 padata objects to padata_do_serial, the
current sorting implementation incorrectly sorts padata objects with
overflowed seq_nr,...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't use rate mask for offchannel TX either
Like the commit ab9177d83c04 ("wifi: mac80211: don't use rate mask for
scanning"), ignore incorrect settings to avoid no supported rate warning
reported by syzbot.
The...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
nfsd: call cache_put if xdr_reserve_space returns NULL
If not enough buffer space available, but idmap_lookup has triggered
lookup_fn which calls cache_get and returns successfully. Then we
missed to call cache_put here which pair...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
In the Linux kernel, the following vulnerability has been resolved:
erofs: handle overlapped pclusters out of crafted images properly
syzbot reported a task hang issue due to a deadlock case where it is
waiting for the folio lock of a cached folio that will be used for
cache I/Os.
After looking i...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
Fix missuse of spin_lock_irq()/spin_unlock_irq() when
spin_lock_irqsave()/spin_lock_irqrestore() was hold.
This was discovered through the lock debugging, and the co...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
In the Linux kernel, the following vulnerability has been resolved:
bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
syzbot reported a WARNING in bond_xdp_get_xmit_slave. To reproduce
this[1], one bond device (bond1) has xdpdrv, which increases
bpf_master_redirect_enabled_...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+2)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Delete subtree of 'fs/netfs' when netfs module exits
In netfs_init() or fscache_proc_init(), we create dentry under 'fs/netfs',
but in netfs_exit(), we only delete the proc entry of 'fs/netfs' without
deleting its subtree....
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
crypto: iaa - Fix potential use after free bug
The free_device_compression_mode(iaa_device, device_mode) function frees
"device_mode" but it iss passed to iaa_compression_modes[i]->free() a few
lines later resulting in a use after...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
The alibaba_uncore_pmu driver forgot to clear all interrupt status
in the interrupt processing function. After the PMU counter overflow
interrupt occurred, an interrup...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
crypto: hisilicon/qm - inject error before stopping queue
The master ooo cannot be completely closed when the
accelerator core reports memory error. Therefore, the driver
needs to inject the qm error to close the master ooo. Curre...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Use reserved copy engine for user binds on faulting devices
User binds map to engines with can fault, faults depend on user binds
completion, thus we can deadlock. Avoid this by using reserved copy
engine for user binds on...
AFFECTED_PRODUCTS:
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
For all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input
arguments, zero the value for the case of an error as otherwise it could leak
memory. For t...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
x86/tdx: Fix "in-kernel MMIO" check
TDX only supports kernel-initiated MMIO operations. The handle_mmio()
function checks if the #VE exception occurred in the kernel and rejects
the operation if it did not.
However, userspace can...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+1)
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to wait dio completion
It should wait all existing dio write IOs before block removal,
otherwise, previous direct write IO may overwrite data in the
block which may be reused by other inode.
AFFECTED_PRODUCTS:
Linux Linux Kernel
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: use work queue to process beacon tx event
Commit 3a415daa3e8b ("wifi: ath11k: add P2P IE in beacon template")
from Feb 28, 2024 (linux-next), leads to the following Smatch static
checker warning:
drivers/net/wireles...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel
In the Linux kernel, the following vulnerability has been resolved:
jfs: fix out-of-bounds in dbNextAG() and diAlloc()
In dbNextAG() , there is no check for the case where bmp->db_numag is
greater or same than MAXAG due to a polluted image, which causes an
out-of-bounds. Therefore, a bounds check...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+3)
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9
Missing Authorization vulnerability in Colorlib Simple Custom Post Order allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Custom Post Order: from n/a through 2.5.7.
AFFECTED_PRODUCTS:
Colorlib Simple Custom Post Order
Missing Authorization vulnerability in Rextheme WP VR allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 8.5.4.
AFFECTED_PRODUCTS:
Rextheme Wp Vr
Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid.This issue affects ProfileGrid: from n/a through 5.9.3.
AFFECTED_PRODUCTS:
Metagauss Profilegrid
Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.
AFFECTED_PRODUCTS:
Funadmin Funadmin