Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38278 State: PUBLISHED Published: 2024-07-09T12:05:07.958Z Last Updated: 2025-08-27T20:42:54.768Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416PNCv2 V5.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GNC(32M) V5.X, RUGGEDCOM RS900NC(32M) V5.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100NC(32M) V5.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PNC (32M) V5.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300 V5.X, RUGG
M) V5.X, RUGGEDCOM RSG2100PNC (32M) V5.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300NC V5.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PNC V5.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSG920PNC V5.X, RUGGEDCOM RSL910, RUGGEDCOM RSL910NC, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P Problem Types: CWE-266 Description: A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGGEDCOM RS416NCv2 V5.X (All versions < V5
X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416v2 V5.X (All versions < V5.9.0), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900GNC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900NC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100NC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100PNC (32M) V5.X (All versions < V
ions < V5.9.0), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100PNC (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2288 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2288NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300P V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300PNC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2488 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2488NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG907R (All versions < V5.9.0), RUGGEDCOM RSG908C (All versions < V5.9.0), RUGGEDCOM RSG909R (All versions < V5.9.0), RUGGEDCOM RSG910C (All versions < V5.9.0), RUGGED
8C (All versions < V5.9.0), RUGGEDCOM RSG909R (All versions < V5.9.0), RUGGEDCOM RSG910C (All versions < V5.9.0), RUGGEDCOM RSG920P V5.X (All versions < V5.9.0), RUGGEDCOM RSG920PNC V5.X (All versions < V5.9.0), RUGGEDCOM RSL910 (All versions < V5.9.0), RUGGEDCOM RSL910NC (All versions < V5.9.0), RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0), RUGGEDCOM RST916C (All versions < V5.9.0), RUGGEDCOM RST916P (All versions < V5.9.0). The affected products with IP forwarding enabled wrongly make available certain remote services in non-managed VLANs, even if these services are not intentionally activated. An attacker could leverage this vulnerability to create
d VLANs, even if these services are not intentionally activated. An attacker could leverage this vulnerability to create a remote shell to the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-170375.html
CVE ID: CVE-2024-38279 State: PUBLISHED Published: 2024-06-13T17:00:20.515Z Last Updated: 2024-08-02T04:04:25.096Z Vendors: Motorola Solutions Products: Vigilant Fixed LPR Coms Box (BCAV1F2-C600) Problem Types: CWE-288 Description: The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19
CVE ID: CVE-2024-38280 State: PUBLISHED Published: 2024-06-13T17:05:58.531Z Last Updated: 2024-08-02T04:04:25.205Z Vendors: Motorola Solutions Products: Vigilant Fixed LPR Coms Box (BCAV1F2-C600) Problem Types: CWE-313 Description: An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19
CVE ID: CVE-2024-38281 State: PUBLISHED Published: 2024-06-13T17:10:36.156Z Last Updated: 2024-08-02T04:04:25.256Z Vendors: Motorola Solutions Products: Vigilant Fixed LPR Coms Box (BCAV1F2-C600) Problem Types: CWE-798 Description: An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19
CVE ID: CVE-2024-38282 State: PUBLISHED Published: 2024-06-13T17:13:39.781Z Last Updated: 2024-08-02T04:04:25.270Z Vendors: Motorola Solutions Products: Vigilant Fixed LPR Coms Box (BCAV1F2-C600) Problem Types: CWE-522 Description: Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the operations or shutdown the camera requiring a physical reboot of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19
CVE ID: CVE-2024-38283 State: PUBLISHED Published: 2024-06-13T17:17:43.694Z Last Updated: 2024-08-02T04:04:25.192Z Vendors: Motorola Solutions Products: Vigilant Fixed LPR Coms Box (BCAV1F2-C600) Problem Types: CWE-311 Description: Sensitive customer information is stored in the device without encryption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19
CVE ID: CVE-2024-38284 State: PUBLISHED Published: 2024-06-13T17:22:10.318Z Last Updated: 2024-08-02T04:04:25.197Z Vendors: Motorola Solutions Products: Vigilant Fixed LPR Coms Box (BCAV1F2-C600) Problem Types: CWE-294 Description: Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19
CVE ID: CVE-2024-38285 State: PUBLISHED Published: 2024-06-13T17:26:46.091Z Last Updated: 2024-08-02T04:04:25.101Z Vendors: Motorola Solutions Products: Vigilant Fixed LPR Coms Box (BCAV1F2-C600) Problem Types: CWE-522 Description: Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19
CVE ID: CVE-2024-38286 State: PUBLISHED Published: 2024-11-07T07:37:32.224Z Last Updated: 2025-11-03T20:38:04.247Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected. Users are recommen
affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
CVE ID: CVE-2024-38287 State: PUBLISHED Published: 2024-07-25T00:00:00 Last Updated: 2024-08-02T04:04:25.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the application into resetting the administrator's password to a random insecure 8-digit value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rhubcom.com/v5/manuals.html - https://github.com/google/security-research/security/advisories/GHSA-c84v-4pjw-4mh2
CVE ID: CVE-2024-38288 State: PUBLISHED Published: 2024-07-25T00:00:00 Last Updated: 2024-08-02T04:04:25.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attackers with administrator privileges to execute arbitrary commands on the underlying server as root. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rhubcom.com/v5/manuals.html - https://github.com/google/security-research/security/advisories/GHSA-gx6g-8mvx-3q5c
CVE ID: CVE-2024-38289 State: PUBLISHED Published: 2024-07-25T00:00:00 Last Updated: 2024-08-02T04:04:25.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rhubcom.com/v5/manuals.html - https://github.com/google/security-research/security/advisories/GHSA-vx5j-8pgx-v42v
CVE ID: CVE-2024-38290 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T17:21:40.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2024-106-xiq-se-unauthorized-access-to-user-account/ba-p/116364
CVE ID: CVE-2024-38291 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T17:19:49.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2024-105-xiq-se-unauthorized-access-to-user-credentials-cve/ba-p/116363
CVE ID: CVE-2024-38292 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-03-14T01:48:31.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2024-104-xiq-se-path-traversal-privilege-escalation-cve-2024/ba-p/116362
CVE ID: CVE-2024-38293 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-02T04:04:25.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://adullact.net/frs/download.php/file/8930/CHANGELOG.md - https://alcasar.net/download
CVE ID: CVE-2024-38294 State: PUBLISHED Published: 2024-06-13T00:00:00.000Z Last Updated: 2025-03-13T18:20:28.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: ALCASAR before 3.6.1 allows email_registration_back.php remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://adullact.net/frs/download.php/file/8930/CHANGELOG.md - https://alcasar.net/download
CVE ID: CVE-2024-38295 State: PUBLISHED Published: 2024-06-13T00:00:00.000Z Last Updated: 2025-03-13T18:25:16.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: ALCASAR before 3.6.1 allows still_connected.php remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://adullact.net/frs/download.php/file/8930/CHANGELOG.md - https://alcasar.net/download
CVE ID: CVE-2024-38296 State: PUBLISHED Published: 2024-11-22T02:58:27.660Z Last Updated: 2024-12-09T15:03:06.924Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Edge Gateway 5200 Problem Types: CWE-1421 Description: Dell Edge Gateway 3200, versions prior to 15.40.30.2879, and Edge Gateway 5200, versions prior to 12.0.94.2380, contain an Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
s vulnerability, leading to information exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000250949/dsa-2024-345-security-update-for-dell-networking-edge-gateway-5200-vulnerability
CVE ID: CVE-2024-38301 State: PUBLISHED Published: 2024-07-10T02:12:54.987Z Last Updated: 2024-08-02T04:04:25.288Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Alienware Command Center (AWCC) Problem Types: CWE-1107 Description: Dell Alienware Command Center, version 5.7.3.0 and prior, contains an improper access control vulnerability. A low privileged attacker could potentially exploit this vulnerability, leading to denial of service on the local system and information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000225774/dsa-2024-258
CVE ID: CVE-2024-38302 State: PUBLISHED Published: 2024-07-18T15:51:54.140Z Last Updated: 2024-08-02T04:04:25.240Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: Dell Data Lakehouse Problem Types: CWE-311 Description: Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000227053/dsa-2024-303-security-upd
ent: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000227053/dsa-2024-303-security-update-for-dell-data-lakehouse-system-software-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-38303 State: PUBLISHED Published: 2024-08-29T04:34:53.178Z Last Updated: 2024-08-29T13:49:36.661Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: PowerEdge Platform Problem Types: CWE-20 Description: Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000228135/dsa-2024-309-security-update-for-dell-poweredge-server-for-improper-inp
tps://www.dell.com/support/kbdoc/en-us/000228135/dsa-2024-309-security-update-for-dell-poweredge-server-for-improper-input-validation-vulnerability
CVE ID: CVE-2024-38304 State: PUBLISHED Published: 2024-08-29T08:03:40.261Z Last Updated: 2024-08-29T13:28:35.429Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Dell Products: PowerEdge Platform Problem Types: CWE-788 Description: Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000228137/dsa-2024-310-security-update-for-dell-poweredge-server
References: - https://www.dell.com/support/kbdoc/en-us/000228137/dsa-2024-310-security-update-for-dell-poweredge-server-for-access-of-memory-location-after-end-of-buffer-vulnerability
CVE ID: CVE-2024-38305 State: PUBLISHED Published: 2024-08-21T01:54:46.614Z Last Updated: 2024-08-21T13:41:13.029Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: SupportAssist for Home PCs Problem Types: CWE-426 Description: Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executables on the operating system with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/00022
vileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000227899/dsa-2024-312-security-update-for-dell-supportassist-for-home-pcs-installer-file-local-privilege-escalation-vulnerability
CVE ID: CVE-2024-38306 State: PUBLISHED Published: 2024-06-25T14:22:36.903Z Last Updated: 2025-05-04T09:13:23.654Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: protect folio::private when attaching extent buffer folios [BUG] Since v6.8 there are rare kernel crashes reported by various people, the common factor is bad page status error messages like this: BUG: Bad page state in process kswapd0 pfn:d6e840 page: refcount:0 mapcount:0 mapping:000000007512f4f2 index:0x2796c2c7c pfn:0xd6e840 aops:btree_aops ino:1 flags: 0x17ffffe0000008(uptodate|node=0|zone=2|lastcpupid=0x3fffff) page_type: 0xffffffff() raw: 0017ffffe0000008
ino:1 flags: 0x17ffffe0000008(uptodate|node=0|zone=2|lastcpupid=0x3fffff) page_type: 0xffffffff() raw: 0017ffffe0000008 dead000000000100 dead000000000122 ffff88826d0be4c0 raw: 00000002796c2c7c 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: non-NULL mapping [CAUSE] Commit 09e6cef19c9f ("btrfs: refactor alloc_extent_buffer() to allocate-then-attach method") changes the sequence when allocating a new extent buffer. Previously we always called grab_extent_buffer() under mapping->i_private_lock, to ensure the safety on modification on folio::private (which is a pointer to extent buffer for regular sectorsize). This can lead to the following race: Thread A is trying to al
ich is a pointer to extent buffer for regular sectorsize). This can lead to the following race: Thread A is trying to allocate an extent buffer at bytenr X, with 4 4K pages, meanwhile thread B is trying to release the page at X + 4K (the second page of the extent buffer at X). Thread A | Thread B -----------------------------------+------------------------------------- | btree_release_folio() | | This is for the page at X + 4K, | | Not page X. | | alloc_extent_buffer() | |- release_extent_buffer() |- filemap_add_folio() for the | | |- atomic_dec_and_test(eb->refs) | page at bytenr X (the first | | | | page). | | | | Which returned -EEXIST. | | | | | | | |- filemap_lock_folio() | | | | Return
bytenr X (the first | | | | page). | | | | Which returned -EEXIST. | | | | | | | |- filemap_lock_folio() | | | | Returned the first page locked. | | | | | | | |- grab_extent_buffer() | | | | |- atomic_inc_not_zero() | | | | | Returned false | | | | |- folio_detach_private() | | |- folio_detach_private() for X | |- folio_test_private() | | |- folio_test_private() | Returned true | | | Returned true |- folio_put() | |- folio_put() Now there are two puts on the same folio at folio X, leading to refcount underflow of the folio X, and eventually causing the BUG_ON() on the page->mapping. The condition is not that easy to hit: - The release must be triggered for the middle page of an eb If the re
->mapping. The condition is not that easy to hit: - The release must be triggered for the middle page of an eb If the release is on the same first page of an eb, page lock would kick in and prevent the race. - folio_detach_private() has a very small race window It's only between folio_test_private() and folio_clear_private(). That's exactly when mapping->i_private_lock is used to prevent such race, and commit 09e6cef19c9f ("btrfs: refactor alloc_extent_buffer() to allocate-then-attach method") screwed that up. At that time, I thought the page lock would kick in as filemap_release_folio() also requires the page to be locked, but forgot the filemap_release_folio() only locks one page, not all
elease_folio() also requires the page to be locked, but forgot the filemap_release_folio() only locks one page, not all pages of an extent buffer. [FIX] Move all the code requiring i_private_lock into attach_eb_folio_to_filemap(), so that everything is done with proper lock protection. Furthermore to prevent future problems, add an extra lockdep_assert_locked() to ensure we're holding the proper lock. To reproducer that is able to hit the race (takes a few minutes with instrumented code inserting delays to alloc_extent_buffer()): #!/bin/sh drop_caches () { while(true); do echo 3 > /proc/sys/vm/drop_caches echo 1 > /proc/sys/vm/compact_memory done } run_tar () { while(true); do for x in `seq
cho 3 > /proc/sys/vm/drop_caches echo 1 > /proc/sys/vm/compact_memory done } run_tar () { while(true); do for x in `seq 1 80` ; do tar cf /dev/zero /mnt > /dev/null & done wait done } mkfs.btrfs -f -d single -m single ---truncated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/952f048eb901881a7cc6f7c1368b53cd386ead7b - https://git.kernel.org/stable/c/f3a5367c679d31473d3fbb391675055b4792c309
CVE ID: CVE-2024-38307 State: PUBLISHED Published: 2025-02-12T21:19:19.293Z Last Updated: 2025-02-13T20:22:31.230Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) AMT and Intel(R) Standard Manageability Problem Types: Denial of Service, CWE-20 Description: Improper input validation in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow an authenticated user to potentially enable denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01152.html