Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-37335 State: PUBLISHED Published: 2024-09-10T16:53:37.267Z Last Updated: 2024-12-31T23:02:30.505Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2019 (CU 28), Microsoft SQL Server 2022 for (CU 14) Problem Types: CWE-122 Description: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37335
CVE ID: CVE-2024-37336 State: PUBLISHED Published: 2024-07-09T17:02:56.556Z Last Updated: 2025-10-14T22:13:39.180Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 for (CU 13), Microsoft SQL Server 2019 for x64-based Systems (CU 27) Problem Types: CWE-190 Description: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability Additional A
em Types: CWE-190 Description: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37336
CVE ID: CVE-2024-37337 State: PUBLISHED Published: 2024-09-10T16:53:39.088Z Last Updated: 2024-12-31T23:02:38.609Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 for (CU 14), Microsoft SQL Server 2019 (CU 28) Problem Types: CWE-197 Description: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37337
CVE ID: CVE-2024-37338 State: PUBLISHED Published: 2024-09-10T16:53:35.477Z Last Updated: 2024-12-31T23:02:28.929Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2019 (CU 28), Microsoft SQL Server 2022 for (CU 14) Problem Types: CWE-125 Description: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37338
CVE ID: CVE-2024-37339 State: PUBLISHED Published: 2024-09-10T16:53:38.546Z Last Updated: 2024-12-31T23:02:37.918Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 for (CU 14), Microsoft SQL Server 2019 (CU 28) Problem Types: CWE-822 Description: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37339
CVE ID: CVE-2024-37340 State: PUBLISHED Published: 2024-09-10T16:53:37.939Z Last Updated: 2024-12-31T23:02:31.190Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 for (CU 14), Microsoft SQL Server 2019 (CU 28) Problem Types: CWE-822 Description: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37340
CVE ID: CVE-2024-37341 State: PUBLISHED Published: 2024-09-10T16:53:54.263Z Last Updated: 2024-12-31T23:03:01.646Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 for (CU 15), Microsoft SQL Server 2019 (CU 28) Problem Types: CWE-284 Description: Microsoft SQL Server Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ription: Microsoft SQL Server Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37341
CVE ID: CVE-2024-37342 State: PUBLISHED Published: 2024-09-10T16:53:39.717Z Last Updated: 2024-12-31T23:02:40.376Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2019 (CU 28), Microsoft SQL Server 2022 for (CU 14), Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2022 (GDR) Problem Types: CWE-125 Description: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37342
CVE ID: CVE-2024-37343 State: PUBLISHED Published: 2024-06-20T16:30:21.053Z Last Updated: 2024-08-02T03:50:55.892Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: Absolute Software Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.06. Attackers with valid tunnel credentials can pass a limited-length script to the administrative console which is then temporarily stored where an administrator using a non-default configuration could click on it while the attacker has a valid tunnel session with the server. The scope is
non-default configuration could click on it while the attacker has a valid tunnel session with the server. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37343/
CVE ID: CVE-2024-37344 State: PUBLISHED Published: 2024-06-20T16:38:26.256Z Last Updated: 2024-08-02T03:50:56.114Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: Absolute Software Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the Policy management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with another system administrator’s use of the policy management UI when the administrators are editing the same policy object. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to sy
object. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37344/
CVE ID: CVE-2024-37345 State: PUBLISHED Published: 2024-06-20T16:45:51.929Z Last Updated: 2024-08-02T03:50:56.264Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Absolute Software Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to version 13.06. Attackers can pass a limited-length script to the administrative UI which is then stored where an administrator can access it. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high Additional Analyst Notes: - C
confidentiality. Impact to system availability is none, impact to system integrity is high Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37345/
CVE ID: CVE-2024-37346 State: PUBLISHED Published: 2024-06-20T16:51:37.265Z Last Updated: 2024-08-02T03:50:55.993Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Absolute Software Products: Secure Access Problem Types: CWE-20 Description: There is an insufficient input validation vulnerability in the Warehouse component of Absolute Secure Access prior to 13.06. Attackers with system administrator permissions can impair the availability of certain elements of the Secure Access administrative UI by writing invalid data to the warehouse over the network. There is no loss of warehouse integrity or confidentiality, the security scope is unchanged. Loss of availa
the network. There is no loss of warehouse integrity or confidentiality, the security scope is unchanged. Loss of availability is high. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37346/
CVE ID: CVE-2024-37347 State: PUBLISHED Published: 2024-06-20T16:56:50.468Z Last Updated: 2024-08-02T03:50:55.946Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: Absolute Software Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the pool configuration component of the management UI of Absolute Secure Access prior to 13.06. Attackers with system administrator permissions can pass a limited length script to be run by another administrator. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none. Additional Analyst Notes: -
confidentiality. Impact to system integrity is high, impact to system availability is none. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37347/
CVE ID: CVE-2024-37348 State: PUBLISHED Published: 2024-06-20T17:05:04.866Z Last Updated: 2024-08-02T03:50:56.211Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: Absolute Software Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with another system administrator’s use of the management UI when the second administrator later edits the same management object. This vulnerability is distinct from CVE-2024-37349 and CVE-2024-37351. The scope is unchanged, there is no loss of c
ct. This vulnerability is distinct from CVE-2024-37349 and CVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37348/
CVE ID: CVE-2024-37349 State: PUBLISHED Published: 2024-06-20T17:11:52.447Z Last Updated: 2024-08-02T03:50:55.914Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: Absolute Software Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with other system administrator’s use of the management UI when the victim administrator edits the same management object. This vulnerability is distinct from CVE-2024-37348 and CVE-2024-37351. The scope is unchanged, there is no loss of confident
vulnerability is distinct from CVE-2024-37348 and CVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37349/
CVE ID: CVE-2024-37350 State: PUBLISHED Published: 2024-06-20T17:18:33.952Z Last Updated: 2024-08-02T03:50:56.219Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Absolute Software Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can interfere with a system administrator’s use of the policy management UI when the attacker convinces the victim administrator to follow a crafted link to the vulnerable component while the attacking administrator is authenticated to the console. The scope is unchanged, there is no loss of
component while the attacking administrator is authenticated to the console. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/
CVE ID: CVE-2024-37351 State: PUBLISHED Published: 2024-06-20T17:25:09.306Z Last Updated: 2024-08-02T03:50:56.092Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: Absolute Software Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with other system administrator’s use of the management UI when the second administrator later edits the same management object. This vulnerability is distinct from CVE-2024-37348 and CVE-2024-37349. The scope is unchanged, there is no loss of con
. This vulnerability is distinct from CVE-2024-37348 and CVE-2024-37349. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37351/
CVE ID: CVE-2024-37352 State: PUBLISHED Published: 2024-06-20T17:28:47.745Z Last Updated: 2024-08-02T03:50:56.158Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: Absolute Software Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06 that allows attackers with system administrator permissions to interfere with other system administrators’ use of the management UI when the second administrator accesses the vulnerable page. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system avai
. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37352/
CVE ID: CVE-2024-37353 State: REJECTED Published: 2024-06-21T10:18:10.995Z Last Updated: 2024-08-21T23:54:07.622Z Description: No description available.
CVE ID: CVE-2024-37354 State: PUBLISHED Published: 2024-06-25T14:22:36.228Z Last Updated: 2025-05-04T09:13:20.964Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc We have been seeing crashes on duplicate keys in btrfs_set_item_key_safe(): BTRFS critical (device vdb): slot 4 key (450 108 8192) new key (450 108 8192) ------------[ cut here ]------------ kernel BUG at fs/btrfs/ctree.c:2620! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 3139 Comm: xfs_io Kdump: loaded Not tainted 6.9.0 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3
3139 Comm: xfs_io Kdump: loaded Not tainted 6.9.0 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:btrfs_set_item_key_safe+0x11f/0x290 [btrfs] With the following stack trace: #0 btrfs_set_item_key_safe (fs/btrfs/ctree.c:2620:4) #1 btrfs_drop_extents (fs/btrfs/file.c:411:4) #2 log_one_extent (fs/btrfs/tree-log.c:4732:9) #3 btrfs_log_changed_extents (fs/btrfs/tree-log.c:4955:9) #4 btrfs_log_inode (fs/btrfs/tree-log.c:6626:9) #5 btrfs_log_inode_parent (fs/btrfs/tree-log.c:7070:8) #6 btrfs_log_dentry_safe (fs/btrfs/tree-log.c:7171:8) #7 btrfs_sync_file (fs/btrfs/file.c:1933:8) #8 vfs_fsync_range (fs/sync.c:188:9) #9 vfs_fsync (fs/sync.c:202:9) #1
71:8) #7 btrfs_sync_file (fs/btrfs/file.c:1933:8) #8 vfs_fsync_range (fs/sync.c:188:9) #9 vfs_fsync (fs/sync.c:202:9) #10 do_fsync (fs/sync.c:212:9) #11 __do_sys_fdatasync (fs/sync.c:225:9) #12 __se_sys_fdatasync (fs/sync.c:223:1) #13 __x64_sys_fdatasync (fs/sync.c:223:1) #14 do_syscall_x64 (arch/x86/entry/common.c:52:14) #15 do_syscall_64 (arch/x86/entry/common.c:83:7) #16 entry_SYSCALL_64+0xaf/0x14c (arch/x86/entry/entry_64.S:121) So we're logging a changed extent from fsync, which is splitting an extent in the log tree. But this split part already exists in the tree, triggering the BUG(). This is the state of the log tree at the time of the crash, dumped with drgn (https://github.com/osan
ggering the BUG(). This is the state of the log tree at the time of the crash, dumped with drgn (https://github.com/osandov/drgn/blob/main/contrib/btrfs_tree.py) to get more details than btrfs_print_leaf() gives us: >>> print_extent_buffer(prog.crashed_thread().stack_trace()[0]["eb"]) leaf 33439744 level 0 items 72 generation 9 owner 18446744073709551610 leaf 33439744 flags 0x100000000000000 fs uuid e5bd3946-400c-4223-8923-190ef1f18677 chunk uuid d58cb17e-6d02-494a-829a-18b7d8a399da item 0 key (450 INODE_ITEM 0) itemoff 16123 itemsize 160 generation 7 transid 9 size 8192 nbytes 8473563889606862198 block group 0 mode 100600 links 1 uid 0 gid 0 rdev 0 sequence 204 flags 0x10(PREALLOC) atime 17
ytes 8473563889606862198 block group 0 mode 100600 links 1 uid 0 gid 0 rdev 0 sequence 204 flags 0x10(PREALLOC) atime 1716417703.220000000 (2024-05-22 15:41:43) ctime 1716417704.983333333 (2024-05-22 15:41:44) mtime 1716417704.983333333 (2024-05-22 15:41:44) otime 17592186044416.000000000 (559444-03-08 01:40:16) item 1 key (450 INODE_REF 256) itemoff 16110 itemsize 13 index 195 namelen 3 name: 193 item 2 key (450 XATTR_ITEM 1640047104) itemoff 16073 itemsize 37 location key (0 UNKNOWN.0 0) type XATTR transid 7 data_len 1 name_len 6 name: user.a data a item 3 key (450 EXTENT_DATA 0) itemoff 16020 itemsize 53 generation 9 type 1 (regular) extent data disk byte 303144960 nr 12288 extent data of
_DATA 0) itemoff 16020 itemsize 53 generation 9 type 1 (regular) extent data disk byte 303144960 nr 12288 extent data offset 0 nr 4096 ram 12288 extent compression 0 (none) item 4 key (450 EXTENT_DATA 4096) itemoff 15967 itemsize 53 generation 9 type 2 (prealloc) prealloc data disk byte 303144960 nr 12288 prealloc data offset 4096 nr 8192 item 5 key (450 EXTENT_DATA 8192) itemoff 15914 itemsize 53 generation 9 type 2 (prealloc) prealloc data disk byte 303144960 nr 12288 prealloc data offset 8192 nr 4096 ... So the real problem happened earlier: notice that items 4 (4k-12k) and 5 (8k-12k) overlap. Both are prealloc extents. Item 4 straddles i_size and item 5 starts at i_size. Here is the stat
and 5 (8k-12k) overlap. Both are prealloc extents. Item 4 straddles i_size and item 5 starts at i_size. Here is the state of ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1ff2bd566fbcefcb892be85c493bdb92b911c428 - https://git.kernel.org/stable/c/3d08c52ba1887a1ff9c179d4b6a18b427bcb2097 - https://git.kernel.org/stable/c/f4e5ed974876c14d3623e04dc43d3e3281bc6011 - https://git.kernel.org/stable/c/9d274c19a71b3a276949933859610721a453946b
CVE ID: CVE-2024-37355 State: PUBLISHED Published: 2025-02-12T21:18:47.198Z Last Updated: 2025-02-26T04:55:34.979Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Graphics software Problem Types: Escalation of Privilege, CWE-284 Description: Improper access control in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01235.html
CVE ID: CVE-2024-37356 State: PUBLISHED Published: 2024-06-21T10:18:11.642Z Last Updated: 2025-11-04T17:21:20.246Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). In dctcp_update_alpha(), we use a module parameter dctcp_shift_g as follows: alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g); ... delivered_ce <<= (10 - dctcp_shift_g); It seems syzkaller started fuzzing module parameters and triggered shift-out-of-bounds [0] by setting 100 to dctcp_shift_g: memcpy((void*)0x20000080, "/sys/module/tcp_dctcp/parameters/dctcp_shift_g\000", 47); res = syscall(__NR_openat, /*fd=*/0x
emcpy((void*)0x20000080, "/sys/module/tcp_dctcp/parameters/dctcp_shift_g\000", 47); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul, /*flags=*/2ul, /*mode=*/0ul); memcpy((void*)0x20000000, "100\000", 4); syscall(__NR_write, /*fd=*/r[0], /*val=*/0x20000000ul, /*len=*/4ul); Let's limit the max value of dctcp_shift_g by param_set_uint_minmax(). With this patch: # echo 10 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g # cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g 10 # echo 11 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g -bash: echo: write error: Invalid argument [0]: UBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12 shift exponent 100 is too lar
ite error: Invalid argument [0]: UBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12 shift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x201/0x300 lib/dump_stack.c:114 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x346/0x3a0 lib/ubsan.c:468 dctcp_update_alpha+0x540/0x570 net/ipv4/tcp_dctcp.c:143 tcp_in_ack_event net/ipv4/tcp_input.c:3802 [inline] tcp_ack+0x17b1/0x3bc0 net/ipv4/tcp_input.c:39