Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-46888 State: PUBLISHED Published: 2023-05-21T00:00:00 Last Updated: 2025-01-21T16:56:19.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/simonmichael/hledger/issues/1525 - https://github.com/simonmichael/hledger/pull/1663 - https://github.com/simonmichael/hledger/releases/tag/1.23 - htt
25 - https://github.com/simonmichael/hledger/pull/1663 - https://github.com/simonmichael/hledger/releases/tag/1.23 - https://www.youtube.com/watch?v=QnRO-VkfIic
CVE ID: CVE-2021-46889 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2024-08-04T05:17:42.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/162227/WordPress-Photo-Gallery-1.5.69-Cross-Site-Scripting.html
CVE ID: CVE-2021-46890 State: PUBLISHED Published: 2023-07-05T11:52:24.005Z Last Updated: 2024-11-20T21:21:26.356Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Business Logic Errors Description: Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858
CVE ID: CVE-2021-46891 State: PUBLISHED Published: 2023-07-05T12:15:51.878Z Last Updated: 2024-11-20T21:20:57.345Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-200 Description: Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858
CVE ID: CVE-2021-46892 State: PUBLISHED Published: 2023-07-06T12:41:21.742Z Last Updated: 2024-11-19T18:54:36.635Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-701 Description: Encryption bypass vulnerability in Maintenance mode. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858
CVE ID: CVE-2021-46893 State: PUBLISHED Published: 2023-07-05T12:17:19.514Z Last Updated: 2024-11-20T21:17:52.091Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: unstrict data verification and parameter check Description: Vulnerability of unstrict data verification and parameter check. Successful exploitation of this vulnerability may affect integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858
CVE ID: CVE-2021-46894 State: PUBLISHED Published: 2023-07-06T12:23:59.118Z Last Updated: 2024-11-19T18:55:13.946Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-269 Description: Use After Free (UAF) vulnerability in the uinput module.Successful exploitation of this vulnerability may lead to kernel privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858
CVE ID: CVE-2021-46895 State: PUBLISHED Published: 2023-08-13T12:45:33.542Z Last Updated: 2024-10-09T16:21:45.687Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-701 Description: Vulnerability of defects introduced in the design process in the Multi-Device Task Center. Successful exploitation of this vulnerability will cause the hopped app to bypass the app lock and reset the device that initiates the hop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/8/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-0000001667644725
CVE ID: CVE-2021-46896 State: PUBLISHED Published: 2023-07-06T00:00:00 Last Updated: 2024-11-20T20:08:00.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in PX4-Autopilot allows attackers to cause a denial of service via handler function handling msgid 332. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PX4/PX4-Autopilot/issues/18369
CVE ID: CVE-2021-46897 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-16T13:11:55.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/coderedcorp/coderedcms/issues/448 - https://github.com/coderedcorp/coderedcms/pull/450 - https://github.com/coderedcorp/coderedcms/compare/v0.22.2...v0.22.3
CVE ID: CVE-2021-46898 State: PUBLISHED Published: 2023-10-22T00:00:00 Last Updated: 2024-09-16T13:11:11.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sehmaschine/django-grappelli/issues/975 - https://github.com/sehmaschine/django-grappelli/pull/976 - https://github.com/sehmaschine/django-grappelli/commit/4ca94bcda0fa2720594506853d85e00c8212968f - https:/
lli/pull/976 - https://github.com/sehmaschine/django-grappelli/commit/4ca94bcda0fa2720594506853d85e00c8212968f - https://github.com/sehmaschine/django-grappelli/compare/2.15.1...2.15.2
CVE ID: CVE-2021-46899 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-08-04T05:17:42.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/canton7/SyncTrayzor/issues/666 - https://github.com/canton7/SyncTrayzor/releases
CVE ID: CVE-2021-46900 State: PUBLISHED Published: 2023-12-31T00:00:00.000Z Last Updated: 2025-04-17T19:53:17.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sympa.community/security/2021-001.html - https://github.com/sympa-community/sympa-community.github.io/blob/master/security/2021-001.md - https://github.com/sym
- https://github.com/sympa-community/sympa-community.github.io/blob/master/security/2021-001.md - https://github.com/sympa-community/sympa/issues/1091
CVE ID: CVE-2021-46901 State: PUBLISHED Published: 2023-12-31T00:00:00 Last Updated: 2024-08-04T05:17:42.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: examples/6lbr/apps/6lbr-webserver/httpd.c in CETIC-6LBR (aka 6lbr) 1.5.0 has a strcat stack-based buffer overflow via a request for a long URL over a 6LoWPAN network. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cetic/6lbr/issues/414 - https://github.com/cetic/6lbr/blob/c3092a1ccc6b6b0e668f33f6f4b2d6967975d664/examples/6lbr/apps/6lbr-webserver/httpd.c#L119
CVE ID: CVE-2021-46902 State: PUBLISHED Published: 2024-02-04T00:00:00.000Z Last Updated: 2025-06-17T17:20:25.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. Path validation is mishandled, and thus an admin can read or delete files in violation of expected access controls. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2021-03-meinberg-lantime-firmware-v7-04-008-und-v6-24-029.htm
CVE ID: CVE-2021-46903 State: PUBLISHED Published: 2024-02-04T00:00:00.000Z Last Updated: 2025-06-17T17:19:24.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. An admin can delete required user accounts (in violation of expected access control). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2021-03-meinberg-lantime-firmware-v7-04-008-und-v6-24-029.htm
CVE ID: CVE-2021-46904 State: PUBLISHED Published: 2024-02-25T14:03:40.319Z Last Updated: 2025-05-04T06:59:59.657Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hso: fix null-ptr-deref during tty device unregistration Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref. The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return th
The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number. Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modify it to free up the minor number of the given hso_serial. Every obtain_minor() should have corresponding release_minor() call. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449 - https://git.kernel.org/stabl
r: References: - https://git.kernel.org/stable/c/a462067d7c8e6953a733bf5ade8db947b1bb5449 - https://git.kernel.org/stable/c/145c89c441d27696961752bf51b323f347601bee - https://git.kernel.org/stable/c/caf5ac93b3b5d5fac032fc11fbea680e115421b4 - https://git.kernel.org/stable/c/92028d7a31e55d53e41cff679156b9432cffcb36 - https://git.kernel.org/stable/c/4a2933c88399c0ebc738db39bbce3ae89786d723 - https://git.kernel.org/stable/c/dc195928d7e4ec7b5cfc6cd10dc4c8d87a7c72ac - https://git.kernel.org/stable/c/388d05f70f1ee0cac4a2068fd295072f1a44152a - https://git.kernel.org/stable/c/8a12f8836145ffe37e9c8733dce18c22fb668b66
CVE ID: CVE-2021-46905 State: PUBLISHED Published: 2024-02-25T14:03:40.944Z Last Updated: 2025-05-04T07:00:01.486Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hso: fix NULL-deref on disconnect regression Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration") fixed the racy minor allocation reported by syzbot, but introduced an unconditional NULL-pointer dereference on every disconnect instead. Specifically, the serial device table must no longer be accessed after the minor has been released by hso_serial_tty_unregister(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
r has been released by hso_serial_tty_unregister(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5871761c5f0f20d6e98bf3b6bd7486d857589554 - https://git.kernel.org/stable/c/0c71d4c89559f72cec2592d078681a843bce570e - https://git.kernel.org/stable/c/24b699bea7553fc0b98dad9d864befb6005ac7f1 - https://git.kernel.org/stable/c/5c17cfe155d21954b4c7e2a78fa771cebcd86725 - https://git.kernel.org/stable/c/d7fad2ce15bdbbd0fec3ebe999fd7cab2267f53e - https://git.kernel.org/stable/c/90642ee9eb581a13569b1c0bd57e85d962215273 - https://git.kernel.org/stable/c/0f000005da31f6947f843ce6b3e3a960540c6e00 - https://git.kernel.org/stable/c/4
962215273 - https://git.kernel.org/stable/c/0f000005da31f6947f843ce6b3e3a960540c6e00 - https://git.kernel.org/stable/c/41c44e1f3112d7265dae522c026399b2a42d19ef - https://git.kernel.org/stable/c/2ad5692db72874f02b9ad551d26345437ea4f7f3
CVE ID: CVE-2021-46906 State: PUBLISHED Published: 2024-02-26T17:20:22.144Z Last Updated: 2025-05-04T07:00:07.051Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hid_submit_ctrl In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by us
s an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c5d3c142f2d57d40c55e65d5622d319125a45366 - https://git.kernel.org/stable/c/41b1e71a2c57366b08dcca1a28b0d45ca69429ce - https://git.kernel.org/stable/c/8c064eece9a51856f3f275104520c7e3017fc5c0 - https://git.kernel.org/stable/c/0e280502be1b003c3483ae03fc60dea554fcfa82 - https://git.kernel.org/stable/c/7f5a4b24cdbd7372770a02f23e347d7d9a9ac8f1 - https://git.kernel.org/stable/c/b1e3596416
- https://git.kernel.org/stable/c/7f5a4b24cdbd7372770a02f23e347d7d9a9ac8f1 - https://git.kernel.org/stable/c/b1e3596416d74ce95cc0b7b38472329a3818f8a9 - https://git.kernel.org/stable/c/21883bff0fd854e07429a773ff18f1e9658f50e8 - https://git.kernel.org/stable/c/6be388f4a35d2ce5ef7dbf635a8964a5da7f799f
CVE ID: CVE-2021-46907 State: REJECTED Published: 2024-02-27T06:53:48.879Z Last Updated: 2024-03-19T13:12:47.853Z Description: No description available.
CVE ID: CVE-2021-46908 State: PUBLISHED Published: 2024-02-27T06:53:49.541Z Last Updated: 2025-05-04T07:00:08.446Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Use correct permission flag for mixed signed bounds arithmetic We forbid adding unknown scalars with mixed signed bounds due to the spectre v1 masking mitigation. Hence this also needs bypass_spec_v1 flag instead of allow_ptr_leaks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6 - https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b
able/c/4f3ff11204eac0ee23acf64deecb3bad7b0db0c6 - https://git.kernel.org/stable/c/4ccdc6c6cae38b91c871293fb0ed8c6845a61b51 - https://git.kernel.org/stable/c/9601148392520e2e134936e76788fc2a6371e7be
CVE ID: CVE-2021-46909 State: PUBLISHED Published: 2024-02-27T06:53:50.181Z Last Updated: 2025-05-04T07:00:09.654Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ARM: footbridge: fix PCI interrupt mapping Since commit 30fdfb929e82 ("PCI: Add a call to pci_assign_irq() in pci_device_probe()"), the PCI code will call the IRQ mapping function whenever a PCI driver is probed. If these are marked as __init, this causes an oops if a PCI driver is loaded or bound after the kernel has initialised. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/532747fd5c7aaa17ee
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/532747fd5c7aaa17ee5cf79f3e947c31eb0e35cf - https://git.kernel.org/stable/c/2643da6aa57920d9159a1a579fb04f89a2b0d29a - https://git.kernel.org/stable/c/871b569a3e67f570df9f5ba195444dc7c621293b - https://git.kernel.org/stable/c/1fc087fdb98d556b416c82ed6e3964a30885f47a - https://git.kernel.org/stable/c/c3efce8cc9807339633ee30e39882f4c8626ee1d - https://git.kernel.org/stable/c/30e3b4f256b4e366a61658c294f6a21b8626dda7
CVE ID: CVE-2021-46910 State: PUBLISHED Published: 2024-02-27T06:53:50.828Z Last Updated: 2025-05-04T07:00:10.734Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled The debugging code for kmap_local() doubles the number of per-CPU fixmap slots allocated for kmap_local(), in order to use half of them as guard regions. This causes the fixmap region to grow downwards beyond the start of its reserved window if the supported number of CPUs is large, and collide with the newly added virtual DT mapping right below it, which is obviously not good. One manifestat
s large, and collide with the newly added virtual DT mapping right below it, which is obviously not good. One manifestation of this is EFI boot on a kernel built with NR_CPUS=32 and CONFIG_DEBUG_KMAP_LOCAL=y, which may pass the FDT in highmem, resulting in block entries below the fixmap region that the fixmap code misidentifies as fixmap table entries, and subsequently tries to dereference using a phys-to-virt translation that is only valid for lowmem. This results in a cryptic splat such as the one below. ftrace: allocating 45548 entries in 89 pages 8<--- cut here --- Unable to handle kernel paging request at virtual address fc6006f0 pgd = (ptrval) [fc6006f0] *pgd=80000040207003, *pmd=00000
le to handle kernel paging request at virtual address fc6006f0 pgd = (ptrval) [fc6006f0] *pgd=80000040207003, *pmd=00000000 Internal error: Oops: a06 [#1] SMP ARM Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.11.0+ #382 Hardware name: Generic DT based system PC is at cpu_ca15_set_pte_ext+0x24/0x30 LR is at __set_fixmap+0xe4/0x118 pc : [<c041ac9c>] lr : [<c04189d8>] psr: 400000d3 sp : c1601ed8 ip : 00400000 fp : 00800000 r10: 0000071f r9 : 00421000 r8 : 00c00000 r7 : 00c00000 r6 : 0000071f r5 : ffade000 r4 : 4040171f r3 : 00c00000 r2 : 4040171f r1 : c041ac78 r0 : fc6006f0 Flags: nZcv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 40203000 DAC: 00000
0 : fc6006f0 Flags: nZcv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 40203000 DAC: 00000001 Process swapper (pid: 0, stack limit = 0x(ptrval)) So let's limit CONFIG_NR_CPUS to 16 when CONFIG_DEBUG_KMAP_LOCAL=y. Also, fix the BUILD_BUG_ON() check that was supposed to catch this, by checking whether the region grows below the start address rather than above the end address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5965ac11b1d5fcb38464728931649cd9df79c7c9 - https://git.kernel.org/stable/c/d624833f5984d484c5e3196f34b926f9e71dafee
CVE ID: CVE-2021-46911 State: PUBLISHED Published: 2024-02-27T06:53:51.486Z Last Updated: 2025-05-04T07:00:11.808Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ch_ktls: Fix kernel panic Taking page refcount is not ideal and causes kernel panic sometimes. It's better to take tx_ctx lock for the complete skb transmit, to avoid page cleanup if ACK received in middle. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8d5a9dbd2116a852f8f0f91f6fbc42a0afe1091f - https://git.kernel.org/stable/c/8348665d4181c68b0ca1205b48e1753d78bc810f - https://git.kernel.org/sta
6fbc42a0afe1091f - https://git.kernel.org/stable/c/8348665d4181c68b0ca1205b48e1753d78bc810f - https://git.kernel.org/stable/c/1a73e427b824133940c2dd95ebe26b6dce1cbf10
CVE ID: CVE-2021-46912 State: PUBLISHED Published: 2024-02-27T06:53:52.135Z Last Updated: 2025-05-04T07:00:12.927Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: Make tcp_allowed_congestion_control readonly in non-init netns Currently, tcp_allowed_congestion_control is global and writable; writing to it in any net namespace will leak into all other net namespaces. tcp_available_congestion_control and tcp_allowed_congestion_control are the only sysctls in ipv4_net_table (the per-netns sysctl table) with a NULL data pointer; their handlers (proc_tcp_available_congestion_control and proc_allowed_congestion_control) have no ot
NULL data pointer; their handlers (proc_tcp_available_congestion_control and proc_allowed_congestion_control) have no other way of referencing a struct net. Thus, they operate globally. Because ipv4_net_table does not use designated initializers, there is no easy way to fix up this one "bad" table entry. However, the data pointer updating logic shouldn't be applied to NULL pointers anyway, so we instead force these entries to be read-only. These sysctls used to exist in ipv4_table (init-net only), but they were moved to the per-net ipv4_net_table, presumably without realizing that tcp_allowed_congestion_control was writable and thus introduced a leak. Because the intent of that commit was on
ng that tcp_allowed_congestion_control was writable and thus introduced a leak. Because the intent of that commit was only to know (i.e. read) "which congestion algorithms are available or allowed", this read-only solution should be sufficient. The logic added in recent commit 31c4d2f160eb: ("net: Ensure net namespace isolation of sysctls") does not and cannot check for NULL data pointers, because other table entries (e.g. /proc/sys/net/netfilter/nf_log/) have .data=NULL but use other methods (.extra2) to access the struct net. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/35d7491e2f77ce480097cabcaf93ed409e916e12 - h
ent: - CVE Program Container: References: - https://git.kernel.org/stable/c/35d7491e2f77ce480097cabcaf93ed409e916e12 - https://git.kernel.org/stable/c/1ccdf1bed140820240e383ba0accc474ffc7f006 - https://git.kernel.org/stable/c/97684f0970f6e112926de631fdd98d9693c7e5c1