Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38556 State: PUBLISHED Published: 2024-06-19T13:35:26.753Z Last Updated: 2025-05-04T12:56:45.684Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Add a timeout to acquire the command queue semaphore Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely for the sem, blocking flow now waits for index to be allocated or a sem acquisition timeout before beginning the timer for FW completion. Kernel log example: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CRE
W completion. Kernel log example: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6 - https://git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319 - https://git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918 - https://git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b - https://git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7
CVE ID: CVE-2024-38557 State: PUBLISHED Published: 2024-06-19T13:35:27.426Z Last Updated: 2025-05-04T09:14:03.057Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Reload only IB representors upon lag disable/enable On lag disable, the bond IB device along with all of its representors are destroyed, and then the slaves' representors get reloaded. In case the slave IB representor load fails, the eswitch error flow unloads all representors, including ethernet representors, where the netdevs get detached and removed from lag bond. Such flow is inaccurate as the lag driver is not responsible for loading/unloading ethernet r
and removed from lag bond. Such flow is inaccurate as the lag driver is not responsible for loading/unloading ethernet representors. Furthermore, the flow described above begins by holding lag lock to prevent bond changes during disable flow. However, when reaching the ethernet representors detachment from lag, the lag lock is required again, triggering the following deadlock: Call trace: __switch_to+0xf4/0x148 __schedule+0x2c8/0x7d0 schedule+0x50/0xe0 schedule_preempt_disabled+0x18/0x28 __mutex_lock.isra.13+0x2b8/0x570 __mutex_lock_slowpath+0x1c/0x28 mutex_lock+0x4c/0x68 mlx5_lag_remove_netdev+0x3c/0x1a0 [mlx5_core] mlx5e_uplink_rep_disable+0x70/0xa0 [mlx5_core] mlx5e_detach_netdev+0x6c/0xb
lx5_lag_remove_netdev+0x3c/0x1a0 [mlx5_core] mlx5e_uplink_rep_disable+0x70/0xa0 [mlx5_core] mlx5e_detach_netdev+0x6c/0xb0 [mlx5_core] mlx5e_netdev_change_profile+0x44/0x138 [mlx5_core] mlx5e_netdev_attach_nic_profile+0x28/0x38 [mlx5_core] mlx5e_vport_rep_unload+0x184/0x1b8 [mlx5_core] mlx5_esw_offloads_rep_load+0xd8/0xe0 [mlx5_core] mlx5_eswitch_reload_reps+0x74/0xd0 [mlx5_core] mlx5_disable_lag+0x130/0x138 [mlx5_core] mlx5_lag_disable_change+0x6c/0x70 [mlx5_core] // hold ldev->lock mlx5_devlink_eswitch_mode_set+0xc0/0x410 [mlx5_core] devlink_nl_cmd_eswitch_set_doit+0xdc/0x180 genl_family_rcv_msg_doit.isra.17+0xe8/0x138 genl_rcv_msg+0xe4/0x220 netlink_rcv_skb+0x44/0x108 genl_rcv+0x40/0x58 ne
180 genl_family_rcv_msg_doit.isra.17+0xe8/0x138 genl_rcv_msg+0xe4/0x220 netlink_rcv_skb+0x44/0x108 genl_rcv+0x40/0x58 netlink_unicast+0x198/0x268 netlink_sendmsg+0x1d4/0x418 sock_sendmsg+0x54/0x60 __sys_sendto+0xf4/0x120 __arm64_sys_sendto+0x30/0x40 el0_svc_common+0x8c/0x120 do_el0_svc+0x30/0xa0 el0_svc+0x20/0x30 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 Thus, upon lag enable/disable, load and unload only the IB representors of the slaves preventing the deadlock mentioned above. While at it, refactor the mlx5_esw_offloads_rep_load() function to have a static helper method for its internal logic, in symmetry with the representor unload design. Additional Analyst Notes: - CISA ADP Vulnri
thod for its internal logic, in symmetry with the representor unload design. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e93fc8d959e56092e2eca1e5511c2d2f0ad6807a - https://git.kernel.org/stable/c/f03c714a0fdd1f93101a929d0e727c28a66383fc - https://git.kernel.org/stable/c/0f320f28f54b1b269a755be2e3fb3695e0b80b07 - https://git.kernel.org/stable/c/0f06228d4a2dcc1fca5b3ddb0eefa09c05b102c4
CVE ID: CVE-2024-38558 State: PUBLISHED Published: 2024-06-19T13:35:28.226Z Last Updated: 2025-11-04T17:21:25.696Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVS_PACKET_CMD_EXECUTE has 3 main attributes: - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format. - OVS_PACKET_ATTR_PACKET - Binary packet content. - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet. OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure with the metadata like conntrack state, input port, recirculation id, etc. Then the packet itself gets parsed to populate
ith the metadata like conntrack state, input port, recirculation id, etc. Then the packet itself gets parsed to populate the rest of the keys from the packet headers. Whenever the packet parsing code starts parsing the ICMPv6 header, it first zeroes out fields in the key corresponding to Neighbor Discovery information even if it is not an ND packet. It is an 'ipv6.nd' field. However, the 'ipv6' is a union that shares the space between 'nd' and 'ct_orig' that holds the original tuple conntrack metadata parsed from the OVS_PACKET_ATTR_KEY. ND packets should not normally have conntrack state, so it's fine to share the space, but normal ICMPv6 Echo packets or maybe other types of ICMPv6 can have
conntrack state, so it's fine to share the space, but normal ICMPv6 Echo packets or maybe other types of ICMPv6 can have the state attached and it should not be overwritten. The issue results in all but the last 4 bytes of the destination address being wiped from the original conntrack tuple leading to incorrect packet matching and potentially executing wrong actions in case this packet recirculates within the datapath or goes back to userspace. ND fields should not be accessed in non-ND packets, so not clearing them should be fine. Executing memset() only for actual ND packets to avoid the issue. Initializing the whole thing before parsing is needed because ND packet may not contain all the
kets to avoid the issue. Initializing the whole thing before parsing is needed because ND packet may not contain all the options. The issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't affect packets entering OVS datapath from network interfaces, because in this case CT metadata is populated from skb after the packet is already parsed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6a51ac92bf35d34b4996d6eb67e2fe469f573b11 - https://git.kernel.org/stable/c/0b532f59437f688563e9c58bdc1436fefa46e3b5 - https://git.kernel.org/stable/c/5ab6aecbede080b44b8e34720ab72050bf1e6982 - https://git.kernel.org/stable/c/483
a46e3b5 - https://git.kernel.org/stable/c/5ab6aecbede080b44b8e34720ab72050bf1e6982 - https://git.kernel.org/stable/c/483eb70f441e2df66ade78aa7217e6e4caadfef3 - https://git.kernel.org/stable/c/9ec8b0ccadb908d92f7ee211a4eff05fd932f3f6 - https://git.kernel.org/stable/c/78741b4caae1e880368cb2f5110635f3ce45ecfd - https://git.kernel.org/stable/c/431e9215576d7b728f3f53a704d237a520092120 - https://git.kernel.org/stable/c/d73fb8bddf89503c9fae7c42e50d44c89909aad6 - https://git.kernel.org/stable/c/7c988176b6c16c516474f6fceebe0f055af5eb56
CVE ID: CVE-2024-38559 State: PUBLISHED Published: 2024-06-19T13:35:28.888Z Last Updated: 2025-11-04T17:21:27.087Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Ensure the copied buf is NUL terminated Currently, we allocate a count-sized kernel buffer and copy count from userspace to that buffer. Later, we use kstrtouint on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using kstrtouint. Fix this issue by using memdup_user_nul instead of memdup_user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.
d of memdup_user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1f84a2744ad813be23fc4be99fb74bfb24aadb95 - https://git.kernel.org/stable/c/a75001678e1d38aa607d5b898ec7ff8ed0700d59 - https://git.kernel.org/stable/c/769b9fd2af02c069451fe9108dba73355d9a021c - https://git.kernel.org/stable/c/dccd97b39ab2f2b1b9a47a1394647a4d65815255 - https://git.kernel.org/stable/c/d93318f19d1e1a6d5f04f5d965eaa9055bb7c613 - https://git.kernel.org/stable/c/563e609275927c0b75fbfd0d90441543aa7b5e0d - https://git.kernel.org/stable/c/4907f5ad246fa9b51093ed7dfc7da9ebbd3f20b8 - https://git.kernel.org/stable/c/177f43c6892e6055de6541fe9391a8a3d1f
/stable/c/4907f5ad246fa9b51093ed7dfc7da9ebbd3f20b8 - https://git.kernel.org/stable/c/177f43c6892e6055de6541fe9391a8a3d1f95fc9 - https://git.kernel.org/stable/c/d0184a375ee797eb657d74861ba0935b6e405c62
CVE ID: CVE-2024-38560 State: PUBLISHED Published: 2024-06-19T13:35:29.555Z Last Updated: 2025-11-04T17:21:28.431Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Ensure the copied buf is NUL terminated Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.
mdup_user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/481fc0c8617304a67649027c4a44723a139a0462 - https://git.kernel.org/stable/c/595a6b98deec01b6dbb20139f71edcd5fb760ec2 - https://git.kernel.org/stable/c/00b425ff0891283207d7bad607a2412225274d7a - https://git.kernel.org/stable/c/1708e3cf2488788cba5489e4f913d227de757baf - https://git.kernel.org/stable/c/7d3e694c4fe30f3aba9cd5ae86fb947a54c3db5c - https://git.kernel.org/stable/c/204714e68015d6946279719fd464ecaf57240f35 - https://git.kernel.org/stable/c/7510fab46b1cbd1680e2a096e779aec3334b4143 - https://git.kernel.org/stable/c/ecb76200f5557a2886888aaa53702da1ab9e6cdf -
/c/7510fab46b1cbd1680e2a096e779aec3334b4143 - https://git.kernel.org/stable/c/ecb76200f5557a2886888aaa53702da1ab9e6cdf - https://git.kernel.org/stable/c/13d0cecb4626fae67c00c84d3c7851f6b62f7df3
CVE ID: CVE-2024-38561 State: PUBLISHED Published: 2024-06-19T13:35:30.227Z Last Updated: 2025-05-04T09:14:08.727Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: kunit: Fix kthread reference There is a race condition when a kthread finishes after the deadline and before the call to kthread_stop(), which may lead to use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1f2ebd3758e1cef6a1f998a1f7ea73310dcb1699 - https://git.kernel.org/stable/c/1ec7ccb4cd4b6f72c2998b07880fa7aaf8dfe1d4 - https://git.kernel.org/stable/c/8f5c841a559ccb700c8d27a3ca645b
l.org/stable/c/1ec7ccb4cd4b6f72c2998b07880fa7aaf8dfe1d4 - https://git.kernel.org/stable/c/8f5c841a559ccb700c8d27a3ca645b7a5f59b4f5 - https://git.kernel.org/stable/c/b0b755cb5a5e0d7168c3ab1b3814b0d3cad9f017 - https://git.kernel.org/stable/c/f8aa1b98ce40184521ed95ec26cc115a255183b2
CVE ID: CVE-2024-38562 State: PUBLISHED Published: 2024-06-19T13:35:30.893Z Last Updated: 2025-05-04T09:14:09.844Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: Avoid address calculations via out of bounds array indexing Before request->channels[] can be used, request->n_channels must be set. Additionally, address calculations for memory after the "channels" array need to be calculated from the allocation base ("request") rather than via the first "out of bounds" index of "channels", otherwise run-time bounds checking will throw a warning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Containe
run-time bounds checking will throw a warning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ed74398642fcb19f6ff385c35a7d512c6663e17b - https://git.kernel.org/stable/c/4e2a5566462b53db7d4c4722da86eedf0b8f546c - https://git.kernel.org/stable/c/8fa4d56564ee7cc2ee348258d88efe191d70dd7f - https://git.kernel.org/stable/c/838c7b8f1f278404d9d684c34a8cb26dc41aaaa1
CVE ID: CVE-2024-38563 State: PUBLISHED Published: 2024-06-19T13:35:31.551Z Last Updated: 2025-05-04T09:14:11.135Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix potential memory leakage when reading chip temperature Without this commit, reading chip temperature will cause memory leakage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/84e81f9b4818b8efe89beb12a246d5d510631939 - https://git.kernel.org/stable/c/ef46dbb93fc9279fb7de883aac22abffe214e6b5 - https://git.kernel.org/stable/c/474b9412f33be87076b40a49756662594598a85e
CVE ID: CVE-2024-38564 State: PUBLISHED Published: 2024-06-19T13:35:32.222Z Last Updated: 2025-05-04T09:14:12.296Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses bpf_prog_get and relies on bpf_prog_attach_check_attach_type to properly verify prog_type <> attach_type association. Add missing attach_type enforcement for the link_create case. Otherwise, it's currently possible to attach cgroup_skb prog types to other cgroup hooks. Add
for the link_create case. Otherwise, it's currently possible to attach cgroup_skb prog types to other cgroup hooks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6675c541f540a29487a802d3135280b69b9f568d - https://git.kernel.org/stable/c/67929e973f5a347f05fef064fea4ae79e7cdb5fd - https://git.kernel.org/stable/c/b34bbc76651065a5eafad8ddff1eb8d1f8473172 - https://git.kernel.org/stable/c/543576ec15b17c0c93301ac8297333c7b6e84ac7
CVE ID: CVE-2024-38565 State: PUBLISHED Published: 2024-06-19T13:35:32.920Z Last Updated: 2025-11-04T17:21:29.789Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: enable proper endpoint verification Syzkaller reports [1] hitting a warning about an endpoint in use not having an expected type to it. Fix the issue by checking for the existence of all proper endpoints with their according types intact. Sadly, this patch has not been tested on real hardware. [1] Syzkaller report: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 3643 at drivers/usb/core/urb.c:504 usb_sub
]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 3643 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace: <TASK> ar5523_cmd+0x41b/0x780 drivers/net/wireless/ath/ar5523/ar5523.c:275 ar5523_cmd_read drivers/net/wireless/ath/ar5523/ar5523.c:302 [inline] ar5523_host_available drivers/net/wireless/ath/ar5523/ar5523.c:1376 [inline] ar5523_probe+0x14b0/0x1d10 drivers/net/wireless/ath/ar5523/ar5523.c:1655 usb_probe_interface+0x30f/0x7f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xb90 drivers/base/dd.c:639 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 driver_
[inline] really_probe+0x249/0xb90 drivers/base/dd.c:639 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427 __device_attach+0x1e4/0x530 drivers/base/dd.c:1008 bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487 device_add+0xbd9/0x1e90 drivers/base/core.c:3517 usb_set_configuration+0x101d/0x1900 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0xbe/0x100 drivers/usb/core/generic.c:238 usb_probe_device+0xd8/0x2c0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xb90 driver
xd8/0x2c0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xb90 drivers/base/dd.c:639 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427 __device_attach+0x1e4/0x530 drivers/base/dd.c:1008 bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487 device_add+0xbd9/0x1e90 drivers/base/core.c:3517 usb_new_device.cold+0x685/0x10ad drivers/usb/core/hub.c:2573 hub_port_connect drivers/usb/core/hub.c:5353 [inline] hub_port_connect_change drivers/usb/core/hub.c:5497 [inline] port_event drivers
ect drivers/usb/core/hub.c:5353 [inline] hub_port_connect_change drivers/usb/core/hub.c:5497 [inline] port_event drivers/usb/core/hub.c:5653 [inline] hub_event+0x26cb/0x45d0 drivers/usb/core/hub.c:5735 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/79ddf5f2020fd593d50f1363bb5131283d74f78f - https://git.kernel.org/stable/c/68a5a00c5d38978a3f8460c6f182f7beec8688ff - https://git.kernel.org/stable/c/ee25389df80138907b
://git.kernel.org/stable/c/68a5a00c5d38978a3f8460c6f182f7beec8688ff - https://git.kernel.org/stable/c/ee25389df80138907bc9dcdf4a2be2067cde9a81 - https://git.kernel.org/stable/c/b4c24de37a6bb383394a6fef2b85a6db41d426f5 - https://git.kernel.org/stable/c/34f7ebff1b9699e0b89fa58b693bc098c2f5ec72 - https://git.kernel.org/stable/c/b33a81e4ecfb022b028cae37d1c1ce28ac1b359d - https://git.kernel.org/stable/c/beeed260b92af158592f5e8d2dab65dae45c6f70 - https://git.kernel.org/stable/c/7bbf76c9bb2c58375e183074e44f9712483f0603 - https://git.kernel.org/stable/c/e120b6388d7d88635d67dcae6483f39c37111850
CVE ID: CVE-2024-38566 State: PUBLISHED Published: 2024-06-19T13:35:33.587Z Last Updated: 2025-05-04T09:14:15.091Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix verifier assumptions about socket->sk The verifier assumes that 'sk' field in 'struct socket' is valid and non-NULL when 'socket' pointer itself is trusted and non-NULL. That may not be the case when socket was just created and passed to LSM socket_accept hook. Fix this verifier assumption and adjust tests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/39f8a29330f433000e716eefc4b9abda0
gram Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/39f8a29330f433000e716eefc4b9abda05b71a82 - https://git.kernel.org/stable/c/6f5ae91172a93abac9720ba94edf3ec8f4d7f24f - https://git.kernel.org/stable/c/c58ccdd2483a1d990748cdaf94206b5d5986a001 - https://git.kernel.org/stable/c/0db63c0b86e981a1e97d2596d64ceceba1a5470e
CVE ID: CVE-2024-38567 State: PUBLISHED Published: 2024-06-19T13:35:34.254Z Last Updated: 2025-11-04T17:21:31.173Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: add a proper sanity check for endpoints Syzkaller reports [1] hitting a warning which is caused by presence of a wrong endpoint type at the URB sumbitting stage. While there was a check for a specific 4th endpoint, since it can switch types between bulk and interrupt, other endpoints are trusted implicitly. Similar warning is triggered in a couple of other syzbot issues [2]. Fix the issue by doing a comprehensive check of all endpoints taking into accou
in a couple of other syzbot issues [2]. Fix the issue by doing a comprehensive check of all endpoints taking into account difference between high- and full-speed configuration. [1] Syzkaller report: ... WARNING: CPU: 0 PID: 4721 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace: <TASK> carl9170_usb_send_rx_irq_urb+0x273/0x340 drivers/net/wireless/ath/carl9170/usb.c:504 carl9170_usb_init_device drivers/net/wireless/ath/carl9170/usb.c:939 [inline] carl9170_usb_firmware_finish drivers/net/wireless/ath/carl9170/usb.c:999 [inline] carl9170_usb_firmware_step2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028 request_firmware_work_func+0x130
e] carl9170_usb_firmware_step2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028 request_firmware_work_func+0x130/0x240 drivers/base/firmware_loader/main.c:1107 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 </TASK> [2] Related syzkaller crashes: Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/eb0f2fc3ff5806cc572cd9055ce7c52a01e97645 - https://git.kernel.org/stable/c/ac3ed46a8741d464bc70ebdf7433c1d786cf329d - https://git.kernel.org/stable/c/8650725bb0a48b206d5a8
git.kernel.org/stable/c/ac3ed46a8741d464bc70ebdf7433c1d786cf329d - https://git.kernel.org/stable/c/8650725bb0a48b206d5a8ddad3a7488f9a5985b7 - https://git.kernel.org/stable/c/6a9892bf24c906b4d6b587f8759ca38bff672582 - https://git.kernel.org/stable/c/265c3cda471c26e0f25d0c755da94e1eb15d7a0c - https://git.kernel.org/stable/c/62eb07923f3693d55b0c2d9a5a4f1ad72cb6b8fd - https://git.kernel.org/stable/c/03ddc74bdfd71b84a55c9f2185d8787f258422cd - https://git.kernel.org/stable/c/0fa08a55201ab9be72bacb8ea93cf752d338184f - https://git.kernel.org/stable/c/b6dd09b3dac89b45d1ea3e3bd035a3859c0369a0
CVE ID: CVE-2024-38568 State: PUBLISHED Published: 2024-06-19T13:35:34.925Z Last Updated: 2025-05-04T09:14:17.865Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group The perf tool allows users to create event groups through following cmd [1], but the driver does not check whether the array index is out of bounds when writing data to the event_group array. If the number of events in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the memory write overflow of event_group array occurs. Add array index check to fix the possible array out of bounds violation
mory write overflow of event_group array occurs. Add array index check to fix the possible array out of bounds violation, and return directly when write new events are written to array bounds. There are 9 different events in an event_group. [1] perf stat -e '{pmu/event1/, ... ,pmu/event9/} Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3669baf308308385a2ab391324abdde5682af5aa - https://git.kernel.org/stable/c/be1fa711e59c874d049f592aef1d4685bdd22bdf - https://git.kernel.org/stable/c/b5120d322763c15c978bc47beb3b6dff45624304 - https://git.kernel.org/stable/c/aa2d3d678895c8eedd003f1473f87d3f06fe6ec7 - https://git.kernel.