Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
les, we must hold all three of them. retract_page_tables() bails out if an ->anon_vma is attached, but does this check before holding the mmap lock (as the comment above the check explains). If we racily merged an existing ->anon_vma (shared with a child process) from a neighboring VMA, subsequent rmap traversals on pages belonging to the child will be able to see the page tables that we are concurrently removing while assuming that nothing else can access them. Repeat the ->anon_vma check once we hold the mmap lock to ensure that there really is no concurrent page table access. Hitting this bug causes a lockdep warning in collapse_and_free_pmd(), in the line "lockdep_assert_held_write(&vma-
cess. Hitting this bug causes a lockdep warning in collapse_and_free_pmd(), in the line "lockdep_assert_held_write(&vma->anon_vma->root->rwsem)". It can also lead to use-after-free access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/352fbf61ce776fef18dca6a68680a6cd943dac95 - https://git.kernel.org/stable/c/cee956ab1efbd858b4ca61c8b474af5aa24b29a6 - https://git.kernel.org/stable/c/abdf3c33918185c3e8ffeb09ed3e334b3d7df47c - https://git.kernel.org/stable/c/acb08187b5a83cdb9ac4112fae9e18cf983b0128 - https://git.kernel.org/stable/c/023f47a8250c6bdb4aebe744db4bf7f73414028b
CVE ID: CVE-2023-52936 State: PUBLISHED Published: 2025-03-27T16:37:16.130Z Last Updated: 2025-10-01T19:26:36.289Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/066ecbf1a53eb0b92b10c8df7808666be6ea5681 - https://git.kernel.org/stable/c/cf1c917bf
: - https://git.kernel.org/stable/c/066ecbf1a53eb0b92b10c8df7808666be6ea5681 - https://git.kernel.org/stable/c/cf1c917bf1c761a557b26410024e90057646c049 - https://git.kernel.org/stable/c/d83d7ed260283560700d4034a80baad46620481b
CVE ID: CVE-2023-52937 State: PUBLISHED Published: 2025-03-27T16:37:16.742Z Last Updated: 2025-10-01T19:26:36.155Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HV: hv_balloon: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0b570a059cf42ad6e2eb632f47c23813d58d8303 - https://git.kernel.org/stable/c/6dfb0771429a63db8
s://git.kernel.org/stable/c/0b570a059cf42ad6e2eb632f47c23813d58d8303 - https://git.kernel.org/stable/c/6dfb0771429a63db8561d44147f2bb76f93e1c86
CVE ID: CVE-2023-52938 State: PUBLISHED Published: 2025-03-27T16:37:17.372Z Last Updated: 2025-10-01T19:26:36.025Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Don't attempt to resume the ports before they exist This will fix null pointer dereference that was caused by the driver attempting to resume ports that were not yet registered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/fdd11d7136fd070b3a74d6d8799d9eac28a57fc5 - https://git.kernel.org/stable/c/f82060da749c611ed427523b6d1605d87338aac1
CVE ID: CVE-2023-52939 State: PUBLISHED Published: 2025-03-27T16:37:18.026Z Last Updated: 2025-10-01T17:37:10.025Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() As commit 18365225f044 ("hwpoison, memcg: forcibly uncharge LRU pages"), hwpoison will forcibly uncharg a LRU hwpoisoned page, the folio_memcg could be NULl, then, mem_cgroup_track_foreign_dirty_slowpath() could occurs a NULL pointer dereference, let's do not record the foreign writebacks for folio memcg is null in mem_cgroup_track_foreign_dirty() to fix it. Additional Analyst Notes: - CISA ADP Vu
ritebacks for folio memcg is null in mem_cgroup_track_foreign_dirty() to fix it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b79ba5953f6fdc5559389ad415620bffc24f024b - https://git.kernel.org/stable/c/ac86f547ca1002aec2ef66b9e64d03f45bbbfbb9
CVE ID: CVE-2023-52940 State: PUBLISHED Published: 2025-03-27T16:37:18.691Z Last Updated: 2025-05-04T07:46:26.824Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm: multi-gen LRU: fix crash during cgroup migration lru_gen_migrate_mm() assumes lru_gen_add_mm() runs prior to itself. This isn't true for the following scenario: CPU 1 CPU 2 clone() cgroup_can_fork() cgroup_procs_write() cgroup_post_fork() task_lock() lru_gen_migrate_mm() task_unlock() task_lock() lru_gen_add_mm() task_unlock() And when the above happens, kernel crashes because of linked list corruption (mm_struct->lru_gen.list). References: - https://git.kernel.org
appens, kernel crashes because of linked list corruption (mm_struct->lru_gen.list). References: - https://git.kernel.org/stable/c/04448022311cebd30969d3aebdde765f1258b360 - https://git.kernel.org/stable/c/de08eaa6156405f2e9369f06ba5afae0e4ab3b62
CVE ID: CVE-2023-52941 State: PUBLISHED Published: 2025-03-27T16:37:19.469Z Last Updated: 2025-05-04T12:49:55.905Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: can: isotp: split tx timer into transmission and timeout The timer for the transmission of isotp PDUs formerly had two functions: 1. send two consecutive frames with a given time gap 2. monitor the timeouts for flow control frames and the echo frames This led to larger txstate checks and potentially to a problem discovered by syzbot which enabled the panic_on_warn feature while testing. The former 'txtimer' function is split into 'txfrtimer' and 'txtimer' to handle the
panic_on_warn feature while testing. The former 'txtimer' function is split into 'txfrtimer' and 'txtimer' to handle the two above functionalities with separate timer callbacks. The two simplified timers now run in one-shot mode and make the state transitions (especially with isotp_rcv_echo) better understandable. References: - https://git.kernel.org/stable/c/cae4c9bc35f72af5d4a079bb9d9fd62c4088a411 - https://git.kernel.org/stable/c/4f027cba8216f42a18b544842efab134f8b1f9f4
CVE ID: CVE-2023-52942 State: PUBLISHED Published: 2025-03-27T16:37:20.155Z Last Updated: 2025-05-04T07:46:34.623Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() It was found that the check to see if a partition could use up all the cpus from the parent cpuset in update_parent_subparts_cpumask() was incorrect. As a result, it is possible to leave parent with no effective cpu left even if there are tasks in the parent cpuset. This can lead to system panic as reported in [1]. Fix this probem by updating the check to fail the enabling the partition if parent's effe
stem panic as reported in [1]. Fix this probem by updating the check to fail the enabling the partition if parent's effective_cpus is a subset of the child's cpus_allowed. Also record the error code when an error happens in update_prstate() and add a test case where parent partition and child have the same cpu list and parent has task. Enabling partition in the child will fail in this case. [1] https://www.spinics.net/lists/cgroups/msg36254.html References: - https://git.kernel.org/stable/c/a2ab7f2cf5ef8f0c6212a246e681d1fe358cec1f - https://git.kernel.org/stable/c/e5ae8803847b80fe9d744a3174abe2b7bfed222a
CVE ID: CVE-2023-52943 State: PUBLISHED Published: 2024-12-04T07:04:36.932Z Last Updated: 2024-12-04T14:09:11.579Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Synology Products: Surveillance Station Problem Types: CWE-863 Description: Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to to perform limited actions on the alerting function via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_04
CVE ID: CVE-2023-52944 State: PUBLISHED Published: 2024-12-04T07:05:32.103Z Last Updated: 2024-12-04T14:09:11.434Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Synology Products: Surveillance Station Problem Types: CWE-863 Description: Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to perform limited actions on the set action rules function via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_04
CVE ID: CVE-2023-52946 State: PUBLISHED Published: 2024-09-26T03:31:38.479Z Last Updated: 2024-09-26T14:53:50.864Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Synology Products: Synology Drive Client Problem Types: CWE-120 Description: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in vss service component in Synology Drive Client before 3.5.0-16084 allows remote attackers to overwrite trivial buffers and crash the client via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_10
CVE ID: CVE-2023-52947 State: PUBLISHED Published: 2024-09-26T03:41:03.462Z Last Updated: 2024-09-26T14:38:53.499Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Synology Products: Synology Active Backup for Business Agent Problem Types: CWE-306 Description: Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality will continue to operate and will not be affected by the logout. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/securit
the logout. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_11
CVE ID: CVE-2023-52948 State: PUBLISHED Published: 2024-09-26T03:41:55.659Z Last Updated: 2024-11-15T17:34:45.374Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Synology Products: Synology Active Backup for Business Agent Problem Types: CWE-311 Description: Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_11
CVE ID: CVE-2023-52949 State: PUBLISHED Published: 2024-09-26T03:42:35.862Z Last Updated: 2024-11-15T17:34:20.288Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Synology Products: Synology Active Backup for Business Agent Problem Types: CWE-306 Description: Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_11
CVE ID: CVE-2023-52950 State: PUBLISHED Published: 2024-09-26T03:40:25.753Z Last Updated: 2024-11-15T17:34:23.550Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Synology Products: Synology Active Backup for Business Agent Problem Types: CWE-311 Description: Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_11
CVE ID: CVE-2023-52952 State: PUBLISHED Published: 2024-10-08T08:40:09.943Z Last Updated: 2024-10-08T14:07:06.614Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: HiMed Cockpit 12 pro, HiMed Cockpit 14 pro+, HiMed Cockpit 18 pro, HiMed Cockpit 18 pro+ Problem Types: CWE-424 Description: A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro+ (J31032-K2017-H435) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro (J31032-K2017-H260) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro+ (J31032-K2017-H436) (All versions >= V11.5.1 < V11.6
17-H260) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 18 pro+ (J31032-K2017-H436) (All versions >= V11.5.1 < V11.6.2). The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to escape the restricted environment and gain access to the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-540493.html
CVE ID: CVE-2023-52953 State: PUBLISHED Published: 2025-01-08T01:48:23.333Z Last Updated: 2025-01-08T15:30:01.163Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-22 Description: Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2023-52954 State: PUBLISHED Published: 2025-01-08T01:51:55.588Z Last Updated: 2025-01-08T15:29:35.308Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-701 Description: Vulnerability of improper permission control in the Gallery module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2023-52955 State: PUBLISHED Published: 2025-01-08T02:00:17.658Z Last Updated: 2025-01-08T15:31:08.178Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-264 Description: Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/1/
CVE ID: CVE-2023-52968 State: PUBLISHED Published: 2025-03-08T00:00:00.000Z Last Updated: 2025-03-10T15:59:46.152Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: MariaDB Products: MariaDB Problem Types: CWE-696 Description: MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mariadb.org/browse/MDEV-32082
CVE ID: CVE-2023-52969 State: PUBLISHED Published: 2025-03-08T00:00:00.000Z Last Updated: 2025-11-03T19:28:53.463Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: MariaDB Products: MariaDB Problem Types: CWE-1038 Description: MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes crash with an empty backtrace log. This may be related to make_aggr_tables_info and optimize_stage2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-32083
CVE ID: CVE-2023-52970 State: PUBLISHED Published: 2025-03-08T00:00:00.000Z Last Updated: 2025-11-03T19:28:54.835Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: MariaDB Products: MariaDB Problem Types: CWE-1038 Description: MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_direct_view_ref::derived_field_transformer_for_where. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-32086
CVE ID: CVE-2023-52971 State: PUBLISHED Published: 2025-03-08T00:00:00.000Z Last Updated: 2025-05-12T15:31:11.074Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: MariaDB Products: MariaDB Problem Types: CWE-1038 Description: MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mariadb.org/browse/MDEV-32084
CVE ID: CVE-2023-52972 State: PUBLISHED Published: 2025-03-26T06:39:03.010Z Last Updated: 2025-03-26T14:34:13.305Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: YutuFZ-5651S1 Problem Types: CWE-284 Description: Huawei PCs have a vulnerability that allows low-privilege users to bypass SDDL permission checks . Successful exploitation this vulnerability could lead to termination of some system processes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/2025/huawei-sa-20250325-01-pc-en
CVE ID: CVE-2023-52973 State: PUBLISHED Published: 2025-03-27T16:43:12.756Z Last Updated: 2025-05-04T07:46:35.811Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, the struct vc_data pointer load must be done at the top of while loop in vcs_read() to avoid a UAF when vcs_size() is called. Syzkaller reported a UAF in vcs_size(). BUG: KASAN: use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8881137479a8 by ta
). BUG: KASAN: use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8881137479a8 by task 4a005ed81e27e65/1537 CPU: 0 PID: 1537 Comm: 4a005ed81e27e65 Not tainted 6.2.0-rc5 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module Call Trace: <TASK> __asan_report_load4_noabort (mm/kasan/report_generic.c:350) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_read (drivers/tty/vt/vc_screen.c:415) vfs_read (fs/read_write.c:468 fs/read_write.c:450) ... </TASK> Allocated by task 1191: ... kmalloc_trace (mm/slab_common.c:1069) vc_allocate (./include/linux/slab.h:580 ./include/linux/slab.h:720 drivers/tty/vt/vt.c:1128 drivers/tty/vt/vt.c:1108) con_install (drivers/tty/vt/vt.c:
ab.h:580 ./include/linux/slab.h:720 drivers/tty/vt/vt.c:1128 drivers/tty/vt/vt.c:1108) con_install (drivers/tty/vt/vt.c:3383) tty_init_dev (drivers/tty/tty_io.c:1301 drivers/tty/tty_io.c:1413 drivers/tty/tty_io.c:1390) tty_open (drivers/tty/tty_io.c:2080 drivers/tty/tty_io.c:2126) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:883) vfs_open (fs/open.c:1014) ... Freed by task 1548: ... kfree (mm/slab_common.c:1021) vc_port_destruct (drivers/tty/vt/vt.c:1094) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty
ll (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2776) ... The buggy address belongs to the object at ffff888113747800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of 1024-byte region [ffff888113747800, ffff888113747c00) The buggy address belongs to the physical page: page:00000000b3fe6c7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113740 head:00000000b3fe6c7c order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 anon flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0010200 ffff888100042dc0 0000000
anon flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0010200 ffff888100042dc0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888113747880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888113747900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888113747980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888113747a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888113747a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ===========================================================
88113747a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/af79ea9a2443016f64d8fd8d72020cc874f0e066 - https://git.kernel.org/stable/c/6332f52f44b9776568bf3c0b714ddfb0bb175e78 - https://git.kernel.org/stable/c/d0332cbf53dad06a22189cc341391237f4ea6d9f - https://git.kernel.org/stable/c/55515d7d8743b71b80bfe68e89eb9d92630626ab - https://git.kernel.org/stable/c/fc9e27f3ba083534b8bbf72ab0f5c810ffdc7d18 - https://git.kernel.org/stable/c/8506f16aae9daf354e3732bcfd447e2a97f023df - https://git.
083534b8bbf72ab0f5c810ffdc7d18 - https://git.kernel.org/stable/c/8506f16aae9daf354e3732bcfd447e2a97f023df - https://git.kernel.org/stable/c/226fae124b2dac217ea5436060d623ff3385bc34
CVE ID: CVE-2023-52974 State: PUBLISHED Published: 2025-03-27T16:43:13.792Z Last Updated: 2025-05-04T07:46:36.953Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsi_session_teardown() while userspace is still accessing the session we will hit a use after free bug. Set the tcp_sw_host->session after we have completed session creation and can no longer fail. Additional Analyst Notes: - CISA ADP Vu