Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creati
ut considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022 - https://git.kernel.org/stable/c/1bf4fe14e97cda621522eb2f28b0a4e87c5b0745 - https://git.kernel.org/stable/c/001a3f59d8c914ef8273461d4bf495df384cc5f8 - https://git.kernel.org/stable/c/d8ac2537763b54d278b80b2b080e1652523c7d4c - https://git.kernel.org/stable/c/5389407bba1eab1266c6d83e226fb0840cb98dd5 - https://git.kernel.org/stable/c/cfd7
3c7d4c - https://git.kernel.org/stable/c/5389407bba1eab1266c6d83e226fb0840cb98dd5 - https://git.kernel.org/stable/c/cfd7c9d260dc0a3baaea05a122a19ab91e193c65 - https://git.kernel.org/stable/c/b36aaa64d58aaa2f2cbc8275e89bae76a2b6c3dc - https://git.kernel.org/stable/c/a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6
CVE ID: CVE-2023-52450 State: PUBLISHED Published: 2024-02-22T16:21:41.661Z Last Updated: 2025-05-04T07:36:47.924Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() Get logical socket id instead of physical id in discover_upi_topology() to avoid out-of-bound access on 'upi = &type->topology[nid][idx];' line that leads to NULL pointer dereference in upi_fill_topology() Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/bf1bf09e6b599758851457f3999779622a48d015 - https://git.kernel.or
richment: References: - https://git.kernel.org/stable/c/bf1bf09e6b599758851457f3999779622a48d015 - https://git.kernel.org/stable/c/3d6f4a78b104c65e4256c3776c9949f49a1b459e - https://git.kernel.org/stable/c/1692cf434ba13ee212495b5af795b6a07e986ce4
CVE ID: CVE-2023-52451 State: PUBLISHED Published: 2024-02-22T16:21:42.295Z Last Updated: 2025-05-04T07:36:49.045Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with the given DRC index. When the search fails, the cursor is left pointing to &drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the last valid entry in the array. The debug message at the end of the function then dereferences this pointer: pr_debug("Failed to hot-remov
in the array. The debug message at the end of the function then dereferences this pointer: pr_debug("Failed to hot-remove memory at %llx\n", lmb->base_addr); This was found by inspection and confirmed with KASAN: pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234 ================================================================== BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658 Read of size 8 at addr c000000364e97fd0 by task bash/949 dump_stack_lvl+0xa4/0xfc (unreliable) print_report+0x214/0x63c kasan_report+0x140/0x2e0 __asan_load8+0xa8/0xe0 dlpar_memory+0x298/0x1658 handle_dlpar_errorlog+0x130/0x1d0 dlpar_store+0x18c/0x3e0 kobj_attr_store+0x68/0xa0 sysfs_kf_write+0
memory+0x298/0x1658 handle_dlpar_errorlog+0x130/0x1d0 dlpar_store+0x18c/0x3e0 kobj_attr_store+0x68/0xa0 sysfs_kf_write+0xc4/0x110 kernfs_fop_write_iter+0x26c/0x390 vfs_write+0x2d4/0x4e0 ksys_write+0xac/0x1a0 system_call_exception+0x268/0x530 system_call_vectored_common+0x15c/0x2ec Allocated by task 1: kasan_save_stack+0x48/0x80 kasan_set_track+0x34/0x50 kasan_save_alloc_info+0x34/0x50 __kasan_kmalloc+0xd0/0x120 __kmalloc+0x8c/0x320 kmalloc_array.constprop.0+0x48/0x5c drmem_init+0x2a0/0x41c do_one_initcall+0xe0/0x5c0 kernel_init_freeable+0x4ec/0x5a0 kernel_init+0x30/0x1e0 ret_from_kernel_user_thread+0x14/0x1c The buggy address belongs to the object at c000000364e80000 which belongs to the cac
t_from_kernel_user_thread+0x14/0x1c The buggy address belongs to the object at c000000364e80000 which belongs to the cache kmalloc-128k of size 131072 The buggy address is located 0 bytes to the right of allocated 98256-byte region [c000000364e80000, c000000364e97fd0) ================================================================== pseries-hotplug-mem: Failed to hot-remove memory at 0 Log failed lookups with a separate message and dereference the cursor only when it points to a valid entry. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/bb79613a9a704469ddb8d6c6029d532a5cea384c - https://git.kernel.org/stable/c/9b5f0
nces: - https://git.kernel.org/stable/c/bb79613a9a704469ddb8d6c6029d532a5cea384c - https://git.kernel.org/stable/c/9b5f03500bc5b083c0df696d7dd169d7ef3dd0c7 - https://git.kernel.org/stable/c/b582aa1f66411d4adcc1aa55b8c575683fb4687e - https://git.kernel.org/stable/c/999a27b3ce9a69d54ccd5db000ec3a447bc43e6d - https://git.kernel.org/stable/c/026fd977dc50ff4a5e09bfb0603557f104d3f3a0 - https://git.kernel.org/stable/c/df16afba2378d985359812c865a15c05c70a967e - https://git.kernel.org/stable/c/708a4b59baad96c4718dc0bd3a3427d3ab22fedc - https://git.kernel.org/stable/c/bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5
CVE ID: CVE-2023-52452 State: PUBLISHED Published: 2024-02-22T16:21:43.094Z Last Updated: 2025-05-04T12:49:02.146Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to read uninitialized stack memory (ever since 6715df8d5) but, before this patch, these accesses were permitted inconsistently. In particular, accesses were permitted above state->allocated_stack, but not below it. In other words, if the stack was already "large enough", the access was permitted, but otherwise the access was rejected instead of being allowed to "grow the stack". This un
", the access was permitted, but otherwise the access was rejected instead of being allowed to "grow the stack". This undesired rejection was happening in two places: - in check_stack_slot_within_bounds() - in check_stack_range_initialized() This patch arranges for these accesses to be permitted. A bunch of tests that were relying on the old rejection had to change; all of them were changed to add also run unprivileged, in which case the old behavior persists. One tests couldn't be updated - global_func16 - because it can't run unprivileged for other reasons. This patch also fixes the tracking of the stack size for variable-offset reads. This second fix is bundled in the same commit as the f
o fixes the tracking of the stack size for variable-offset reads. This second fix is bundled in the same commit as the first one because they're inter-related. Before this patch, writes to the stack using registers containing a variable offset (as opposed to registers with fixed, known values) were not properly contributing to the function's needed stack size. As a result, it was possible for a program to verify, but then to attempt to read out-of-bounds data at runtime because a too small stack had been allocated for it. Each function tracks the size of the stack it needs in bpf_subprog_info.stack_depth, which is maintained by update_stack_depth(). For regular memory accesses, check_mem_acc
in bpf_subprog_info.stack_depth, which is maintained by update_stack_depth(). For regular memory accesses, check_mem_access() was calling update_state_depth() but it was passing in only the fixed part of the offset register, ignoring the variable offset. This was incorrect; the minimum possible value of that register should be used instead. This tracking is now fixed by centralizing the tracking of stack size in grow_stack_state(), and by lifting the calls to grow_stack_state() to check_stack_access_within_bounds() as suggested by Andrii. The code is now simpler and more convincingly tracks the correct maximum stack size. check_stack_range_initialized() can now rely on enough stack having be
nvincingly tracks the correct maximum stack size. check_stack_range_initialized() can now rely on enough stack having been allocated for the access; this helps with the fix for the first issue. A few tests were changed to also check the stack depth computation. The one that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0954982db8283016bf38e9db2da5adf47a102e19 - https://git.kernel.org/stable/c/fbcf372c8eda2290470268e0afb5ab5d5f5d5fde - https://git.kernel.org/stable/c/6b4a64bafd107e521c01eec3453ce94a3fb38529
CVE ID: CVE-2023-52453 State: PUBLISHED Published: 2024-02-23T14:46:17.082Z Last Updated: 2025-10-01T19:12:14.044Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hisi_acc_vfio_pci: Update migration data pointer correctly on saving/resume When the optional PRE_COPY support was added to speed up the device compatibility check, it failed to update the saving/resuming data pointers based on the fd offset. This results in migration data corruption and when the device gets started on the destination the following error is reported in some cases, [ 478.907684] arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received: [ 478.913691] arm-smmu
ror is reported in some cases, [ 478.907684] arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received: [ 478.913691] arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000310200000010 [ 478.919603] arm-smmu-v3 arm-smmu-v3.2.auto: 0x000002088000007f [ 478.925515] arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000 [ 478.931425] arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000 [ 478.947552] hisi_zip 0000:31:00.0: qm_axi_rresp [error status=0x1] found [ 478.955930] hisi_zip 0000:31:00.0: qm_db_timeout [error status=0x400] found [ 478.955944] hisi_zip 0000:31:00.0: qm sq doorbell timeout in function 2 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/st
on 2 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/45f80b2f230df10600e6fa1b83b28bf1c334185e - https://git.kernel.org/stable/c/6bda81e24a35a856f58e6a5786de579b07371603 - https://git.kernel.org/stable/c/be12ad45e15b5ee0e2526a50266ba1d295d26a88
CVE ID: CVE-2023-52454 State: PUBLISHED Published: 2024-02-23T14:46:17.827Z Last Updated: 2025-05-04T07:36:52.616Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length If the host sends an H2CData command with an invalid DATAL, the kernel may crash in nvmet_tcp_build_pdu_iovec(). Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp] Call trace: process_one_work+0x174/0x3c8 worker_thread+0x2d0/0x3e8 kthread+0x104/0x110 Fix the bug by raising a fatal error if DATAL isn't coherent with the
x3c8 worker_thread+0x2d0/0x3e8 kthread+0x104/0x110 Fix the bug by raising a fatal error if DATAL isn't coherent with the packet size. Also, the PDU length should never exceed the MAXH2CDATA parameter which has been communicated to the host in nvmet_tcp_handle_icreq(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ee5e7632e981673f42a50ade25e71e612e543d9d - https://git.kernel.org/stable/c/f775f2621c2ac5cc3a0b3a64665dad4fb146e510 - https://git.kernel.org/stable/c/4cb3cf7177ae3666be7fb27d4ad4d72a295fb02d - https://git.kernel.org/stable/c/2871aa407007f6f531fae181ad252486e022df42 - https://git.kernel.org/stable/c/24e057601
d - https://git.kernel.org/stable/c/2871aa407007f6f531fae181ad252486e022df42 - https://git.kernel.org/stable/c/24e05760186dc070d3db190ca61efdbce23afc88 - https://git.kernel.org/stable/c/70154e8d015c9b4fb56c1a2ef1fc8b83d45c7f68 - https://git.kernel.org/stable/c/efa56305908ba20de2104f1b8508c6a7401833be
CVE ID: CVE-2023-52455 State: PUBLISHED Published: 2024-02-23T14:46:18.495Z Last Updated: 2025-05-04T07:36:54.302Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu: Don't reserve 0-length IOVA region When the bootloader/firmware doesn't setup the framebuffers, their address and size are 0 in "iommu-addresses" property. If IOVA region is reserved with 0 length, then it ends up corrupting the IOVA rbtree with an entry which has pfn_hi < pfn_lo. If we intend to use display driver in kernel without framebuffer then it's causing the display IOMMU mappings to fail as entire valid IOVA space is reserved when address and length are
then it's causing the display IOMMU mappings to fail as entire valid IOVA space is reserved when address and length are passed as 0. An ideal solution would be firmware removing the "iommu-addresses" property and corresponding "memory-region" if display is not present. But the kernel should be able to handle this by checking for size of IOVA region and skipping the IOVA reservation if size is 0. Also, add a warning if firmware is requesting 0-length IOVA region reservation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/98b8a550da83cc392a14298c4b3eaaf0332ae6ad - https://git.kernel.org/stable/c/5e23e283910c9f30248732a
t.kernel.org/stable/c/98b8a550da83cc392a14298c4b3eaaf0332ae6ad - https://git.kernel.org/stable/c/5e23e283910c9f30248732ae0770bcb0c9438abf - https://git.kernel.org/stable/c/bb57f6705960bebeb832142ce9abf43220c3eab1
CVE ID: CVE-2023-52456 State: PUBLISHED Published: 2024-02-23T14:46:19.139Z Last Updated: 2025-05-04T07:36:55.750Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine deadlock When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for instance during userland application crash), imx_uart_shutdown disables the interface and disables the Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be retriggered by the TC in
sion Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is properly set to WAIT_AFTER_SEND. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6e04a9d30509fb53ba6df5d655ed61d607a7cfda
ichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6e04a9d30509fb53ba6df5d655ed61d607a7cfda - https://git.kernel.org/stable/c/ff168d4fdb0e1ba35fb413a749b3d6cce918ec19 - https://git.kernel.org/stable/c/63ee7be01a3f7d28b1ea8b8d7944f12bb7b0ed06 - https://git.kernel.org/stable/c/763cd68746317b5d746dc2649a3295c1efb41181 - https://git.kernel.org/stable/c/9a662d06c22ddfa371958c2071dc350436be802b - https://git.kernel.org/stable/c/78d60dae9a0c9f09aa3d6477c94047df2fe6f7b0
CVE ID: CVE-2023-52457 State: PUBLISHED Published: 2024-02-23T14:46:19.772Z Last Updated: 2025-05-04T12:49:03.340Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed Returning an error code from .remove() makes the driver core emit the little helpful error message: remove callback returned a non-zero value. This will be ignored. and then remove the device anyhow. So all resources that were not freed are leaked in this case. Skipping serial8250_unregister_port() has the potential to keep enough of the UART around to trigger a use-after-free. So rep
ing serial8250_unregister_port() has the potential to keep enough of the UART around to trigger a use-after-free. So replace the error return (and with it the little helpful error message) by a more useful error message and continue to cleanup. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b502fb43f7fb55aaf07f6092ab44657595214b93 - https://git.kernel.org/stable/c/bc57f3ef8a9eb0180606696f586a6dcfaa175ed0 - https://git.kernel.org/stable/c/828cd829483f0cda920710997aed79130b0af690 - https://git.kernel.org/stable/c/d74173bda29aba58f822175d983d07c8ed335494 - https://git.kernel.org/stable/c/887a558d0298d36297daea039954c3994
rg/stable/c/d74173bda29aba58f822175d983d07c8ed335494 - https://git.kernel.org/stable/c/887a558d0298d36297daea039954c39940228d9b - https://git.kernel.org/stable/c/95e4e0031effad9837af557ecbfd4294a4d8aeee - https://git.kernel.org/stable/c/ad90d0358bd3b4554f243a425168fc7cebe7d04e
CVE ID: CVE-2023-52458 State: PUBLISHED Published: 2024-02-23T14:46:20.397Z Last Updated: 2025-05-04T07:37:03.432Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block: add check that partition length needs to be aligned with block size Before calling add partition or resize partition, there is no check on whether the length is aligned with the logical block size. If the logical block size of the disk is larger than 512 bytes, then the partition size maybe not the multiple of the logical block size, and when the last sector is read, bio_truncate() will adjust the bio size, resulting in an IO error if the size of the read comman
he last sector is read, bio_truncate() will adjust the bio size, resulting in an IO error if the size of the read command is smaller than the logical block size.If integrity data is supported, this will also result in a null pointer dereference when calling bio_integrity_free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8f6dfa1f1efe6dcca2d43e575491d8fcbe922f62 - https://git.kernel.org/stable/c/5010c27120962c85d2f421d2cf211791c9603503 - https://git.kernel.org/stable/c/ef31cc87794731ffcb578a195a2c47d744e25fb8 - https://git.kernel.org/stable/c/cb16cc1abda18a9514106d2ac8c8d7abc0be5ed8 - https://git.kernel.org/stable/c/
d744e25fb8 - https://git.kernel.org/stable/c/cb16cc1abda18a9514106d2ac8c8d7abc0be5ed8 - https://git.kernel.org/stable/c/bcdc288e7bc008daf38ef0401b53e4a8bb61bbe5 - https://git.kernel.org/stable/c/6f64f866aa1ae6975c95d805ed51d7e9433a0016
CVE ID: CVE-2023-52459 State: PUBLISHED Published: 2024-02-23T14:46:21.006Z Last Updated: 2025-05-04T07:37:04.629Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Fix duplicated list deletion The list deletion call dropped here is already called from the helper function in the line before. Having a second list_del() call results in either a warning (with CONFIG_DEBUG_LIST=y): list_del corruption, c46c8198->next is LIST_POISON1 (00000100) If CONFIG_DEBUG_LIST is disabled the operation results in a kernel error due to NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Cont
in a kernel error due to NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b7062628caeaec90e8f691ebab2d70f31b7b6b91 - https://git.kernel.org/stable/c/49d82811428469566667f22749610b8c132cdb3e - https://git.kernel.org/stable/c/3de6ee94aae701fa949cd3b5df6b6a440ddfb8f2
CVE ID: CVE-2023-52460 State: PUBLISHED Published: 2024-02-23T14:46:21.642Z Last Updated: 2025-05-04T07:37:05.677Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference at hibernate During hibernate sequence the source context might not have a clk_mgr. So don't use it to look for DML2 support. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6b80326efff093d037e0971831dca6ebddba9b45 - https://git.kernel.org/stable/c/b719a9c15d52d4f56bdea8241a5d90fd9197ce99
CVE ID: CVE-2023-52461 State: PUBLISHED Published: 2024-02-23T14:46:22.280Z Last Updated: 2025-05-04T07:37:06.814Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix bounds limiting when given a malformed entity If we're given a malformed entity in drm_sched_entity_init()--shouldn't happen, but we verify--with out-of-bounds priority value, we set it to an allowed value. Fix the expression which sets this limit. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1470d173925d697b497656b93f7c5bddae2e64b2 - https://git.kernel.org/stable/c/2bbe6ab2be53
https://git.kernel.org/stable/c/1470d173925d697b497656b93f7c5bddae2e64b2 - https://git.kernel.org/stable/c/2bbe6ab2be53858507f11f99f856846d04765ae3
CVE ID: CVE-2023-52462 State: PUBLISHED Published: 2024-02-23T14:46:22.900Z Last Updated: 2025-05-04T07:37:08.112Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: fix check for attempt to corrupt spilled pointer When register is spilled onto a stack as a 1/2/4-byte register, we set slot_type[BPF_REG_SIZE - 1] (plus potentially few more below it, depending on actual spill size). So to check if some stack slot has spilled register we need to consult slot_type[7], not slot_type[0]. To avoid the need to remember and double-check this in the future, just use is_spilled_reg() helper. Additional Analyst Notes: - CISA ADP Vulnrichm
er and double-check this in the future, just use is_spilled_reg() helper. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2757f17972d87773b3677777f5682510f13c66ef - https://git.kernel.org/stable/c/67e6707f07354ed1acb4e65552e97c60cf9d69cf - https://git.kernel.org/stable/c/fc3e3c50a0a4cac1463967c110686189e4a59104 - https://git.kernel.org/stable/c/8dc15b0670594543c356567a1a45b0182ec63174 - https://git.kernel.org/stable/c/40617d45ea05535105e202a8a819e388a2b1f036 - https://git.kernel.org/stable/c/ab125ed3ec1c10ccc36bc98c7a4256ad114a3dae
CVE ID: CVE-2023-52463 State: PUBLISHED Published: 2024-02-23T14:46:23.537Z Last Updated: 2025-05-04T12:49:04.560Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166]