Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e1d1f79b1929dce470a5dc9281c574cd58e8c6c0 - https://git.kernel.org/stable/c/88984ec4792766df5a9de7a2ff2b5f281f94c7d4 - https://git.kernel.org/stable/c/d2af4ef80601224b90630c1ddc7cd2c7c8ab4dd8 - https://git.kernel.org/stable/c/8bbe784c2ff28d56ca0c548aaf3e584edc77052d - https://git.kernel.org/stable/c/b39f2d10b86d0af353ea339e5815820026bca48f
CVE ID: CVE-2023-52812 State: PUBLISHED Published: 2024-05-21T15:31:20.940Z Last Updated: 2025-11-03T21:50:26.333Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd: check num of link levels when update pcie param In SR-IOV environment, the value of pcie_table->num_of_link_levels will be 0, and num_of_levels - 1 will cause array index out of bounds Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2f2d48b6247ae3001f83c98730b3cce475cb2927 - https://git.kernel.org/stable/c/5b4574b663d0a1a0a62d5232429b7db9ae6d0670 - https://git.kernel.org/stable/c/09f6172
927 - https://git.kernel.org/stable/c/5b4574b663d0a1a0a62d5232429b7db9ae6d0670 - https://git.kernel.org/stable/c/09f617219fe9ccd8d7b65dc3e879b5889f663b5a - https://git.kernel.org/stable/c/406e8845356d18bdf3d3a23b347faf67706472ec
CVE ID: CVE-2023-52813 State: PUBLISHED Published: 2024-05-21T15:31:21.604Z Last Updated: 2025-07-15T15:43:50.801Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix hungtask for PADATA_RESET We found a hungtask bug in test_aead_vec_cfg as follows: INFO: task cryptomgr_test:391009 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Call trace: __switch_to+0x98/0xe0 __schedule+0x6c4/0xf40 schedule+0xd8/0x1b4 schedule_timeout+0x474/0x560 wait_for_common+0x368/0x4e0 wait_for_completion+0x20/0x30 wait_for_completion+0x20/0x30 test_aead_vec_cfg+0xab4/0xd50 tes
ait_for_common+0x368/0x4e0 wait_for_completion+0x20/0x30 wait_for_completion+0x20/0x30 test_aead_vec_cfg+0xab4/0xd50 test_aead+0x144/0x1f0 alg_test_aead+0xd8/0x1e0 alg_test+0x634/0x890 cryptomgr_test+0x40/0x70 kthread+0x1e0/0x220 ret_from_fork+0x10/0x18 Kernel panic - not syncing: hung_task: blocked tasks For padata_do_parallel, when the return err is 0 or -EBUSY, it will call wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal case, aead_request_complete() will be called in pcrypt_aead_serial and the return err is 0 for padata_do_parallel. But, when pinst->flags is PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it won't call aead_request_complete(). Th
t->flags is PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it won't call aead_request_complete(). Therefore, test_aead_vec_cfg will hung at wait_for_completion(&wait->completion), which will cause hungtask. The problem comes as following: (padata_do_parallel) | rcu_read_lock_bh(); | err = -EINVAL; | (padata_replace) | pinst->flags |= PADATA_RESET; err = -EBUSY | if (pinst->flags & PADATA_RESET) | rcu_read_unlock_bh() | return err In order to resolve the problem, we replace the return err -EBUSY with -EAGAIN, which means parallel_data is changing, and the caller should call it again. v3: remove retry and just change the return err. v2: introduce padata_try_do_parallel() in
caller should call it again. v3: remove retry and just change the return err. v2: introduce padata_try_do_parallel() in pcrypt_aead_encrypt and pcrypt_aead_decrypt to solve the hungtask. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fb2d3a50a8f29a3c66682bb426144f40e32ab818 - https://git.kernel.org/stable/c/039fec48e062504f14845124a1a25eb199b2ddc0 - https://git.kernel.org/stable/c/c9c1334697301c10e6918d747ed38abfbc0c96e7 - https://git.kernel.org/stable/c/e97bf4ada7dddacd184c3e196bd063b0dc71b41d - https://git.kernel.org/stable/c/546c1796ad1ed0d87dab3c4b5156d75819be2316 - https://git.kernel.org/stable/c/c55fc098fd9d2dc
tps://git.kernel.org/stable/c/546c1796ad1ed0d87dab3c4b5156d75819be2316 - https://git.kernel.org/stable/c/c55fc098fd9d2dca475b82d00ffbcaf97879d77e - https://git.kernel.org/stable/c/e134f3aba98e6c801a693f540912c2d493718ddf - https://git.kernel.org/stable/c/372636debe852913529b1716f44addd94fff2d28 - https://git.kernel.org/stable/c/8f4f68e788c3a7a696546291258bfa5fdb215523
CVE ID: CVE-2023-52814 State: PUBLISHED Published: 2024-05-21T15:31:22.263Z Last Updated: 2025-09-16T13:52:56.279Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential null pointer derefernce The amdgpu_ras_get_context may return NULL if device not support ras feature, so add check before using. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b93a25de28af153312f0fc979b0663fc4bd3442b - https://git.kernel.org/stable/c/c11cf5e117f50f5a767054600885acd981449afe - https://git.kernel.org/stable/c/9b70fc7d70e8ef7c4a65034c9487f58609e708a1 - htt
11cf5e117f50f5a767054600885acd981449afe - https://git.kernel.org/stable/c/9b70fc7d70e8ef7c4a65034c9487f58609e708a1 - https://git.kernel.org/stable/c/b0702ee4d811708251cdf54d4a1d3e888d365111 - https://git.kernel.org/stable/c/da46e63482fdc5e35c008865c22ac64027f6f0c2 - https://git.kernel.org/stable/c/80285ae1ec8717b597b20de38866c29d84d321a1
CVE ID: CVE-2023-52815 State: PUBLISHED Published: 2024-05-21T15:31:22.918Z Last Updated: 2025-09-16T08:02:13.767Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vkms: fix a possible null pointer dereference In amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_cvt_mode(). Add a check to avoid null pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/eaa03ea366c85ae3cb69c8d4bbc67c8bc2167a27 - https://git.kernel.org/stable/c/33fb1a5
es: - https://git.kernel.org/stable/c/eaa03ea366c85ae3cb69c8d4bbc67c8bc2167a27 - https://git.kernel.org/stable/c/33fb1a555354bd593f785935ddcb5d9dd4d3847f - https://git.kernel.org/stable/c/8c6c85a073768df68c1a3fea143d013a38c66d34 - https://git.kernel.org/stable/c/70f831f21155c692bb336c434936fd6f24f3f81a - https://git.kernel.org/stable/c/cd90511557fdfb394bb4ac4c3b539b007383914c
CVE ID: CVE-2023-52816 State: PUBLISHED Published: 2024-05-21T15:31:23.567Z Last Updated: 2025-05-04T07:43:44.087Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix shift out-of-bounds issue [ 567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned int' [ 567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G OE 6.2.0-34-generic #34~22.04.1-Ubuntu [ 567.614502] Hardware name: AMD Splinter/Splinter-RPL, BIOS WS43927N_871 09/25/2023 [ 567.614504] Workqueue: events send_exception_work_handler [amdgpu] [ 567.614748] Call Trace: [ 567.614750] <TASK> [ 567.614753] dump_stack_lvl+0x48/0x70 [ 567.61476
_work_handler [amdgpu] [ 567.614748] Call Trace: [ 567.614750] <TASK> [ 567.614753] dump_stack_lvl+0x48/0x70 [ 567.614761] dump_stack+0x10/0x20 [ 567.614763] __ubsan_handle_shift_out_of_bounds+0x156/0x310 [ 567.614769] ? srso_alias_return_thunk+0x5/0x7f [ 567.614773] ? update_sd_lb_stats.constprop.0+0xf2/0x3c0 [ 567.614780] svm_range_split_by_granularity.cold+0x2b/0x34 [amdgpu] [ 567.615047] ? srso_alias_return_thunk+0x5/0x7f [ 567.615052] svm_migrate_to_ram+0x185/0x4d0 [amdgpu] [ 567.615286] do_swap_page+0x7b6/0xa30 [ 567.615291] ? srso_alias_return_thunk+0x5/0x7f [ 567.615294] ? __free_pages+0x119/0x130 [ 567.615299] handle_pte_fault+0x227/0x280 [ 567.615303] __handle_mm_fault+0x3c0/0x720
5294] ? __free_pages+0x119/0x130 [ 567.615299] handle_pte_fault+0x227/0x280 [ 567.615303] __handle_mm_fault+0x3c0/0x720 [ 567.615311] handle_mm_fault+0x119/0x330 [ 567.615314] ? lock_mm_and_find_vma+0x44/0x250 [ 567.615318] do_user_addr_fault+0x1a9/0x640 [ 567.615323] exc_page_fault+0x81/0x1b0 [ 567.615328] asm_exc_page_fault+0x27/0x30 [ 567.615332] RIP: 0010:__get_user_8+0x1c/0x30 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3f7a400d5e80f99581e3e8a9843e1f6118bf454f - https://git.kernel.org/stable/c/2806f880379232e789957c2078d612669eb7a69c - https://git.kernel.org/stable/c/d33a35b13cbfec3238043f196fa87a6384f9d087 -
c/2806f880379232e789957c2078d612669eb7a69c - https://git.kernel.org/stable/c/d33a35b13cbfec3238043f196fa87a6384f9d087 - https://git.kernel.org/stable/c/56649c43d40ce0147465a2d5756d300e87f9ee1c - https://git.kernel.org/stable/c/282c1d793076c2edac6c3db51b7e8ed2b41d60a5
CVE ID: CVE-2023-52817 State: PUBLISHED Published: 2024-05-21T15:31:24.225Z Last Updated: 2025-09-16T13:50:38.254Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log: 1. Navigate to the directory: /sys/kernel/debug/dri/0 2. Execute command: cat amdgpu_regs_smc 3. Exception Log:: [4005007.702554] BUG: kernel NULL pointer derefe
/debug/dri/0 2. Execute command: cat amdgpu_regs_smc 3. Exception Log:: [4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000 [4005007.702562] #PF: supervisor instruction fetch in kernel mode [4005007.702567] #PF: error_code(0x0010) - not-present page [4005007.702570] PGD 0 P4D 0 [4005007.702576] Oops: 0010 [#1] SMP NOPTI [4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G OE 5.15.0-43-generic #46-Ubunt u [4005007.702590] RIP: 0010:0x0 [4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206 [4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68 [4005
ffa82b46d27da0 EFLAGS: 00010206 [4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68 [4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000 [4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980 [4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000 [4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000 [4005007.702622] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000 [4005007.702626] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0 [4005007.70
000 CR0: 0000000080050033 [4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0 [4005007.702633] Call Trace: [4005007.702636] <TASK> [4005007.702640] amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu] [4005007.703002] full_proxy_read+0x5c/0x80 [4005007.703011] vfs_read+0x9f/0x1a0 [4005007.703019] ksys_read+0x67/0xe0 [4005007.703023] __x64_sys_read+0x19/0x20 [4005007.703028] do_syscall_64+0x5c/0xc0 [4005007.703034] ? do_user_addr_fault+0x1e3/0x670 [4005007.703040] ? exit_to_user_mode_prepare+0x37/0xb0 [4005007.703047] ? irqentry_exit_to_user_mode+0x9/0x20 [4005007.703052] ? irqentry_exit+0x19/0x30 [4005007.703057] ? exc_page_fault+0x89/0x160 [4005007.703062] ? asm_e
x9/0x20 [4005007.703052] ? irqentry_exit+0x19/0x30 [4005007.703057] ? exc_page_fault+0x89/0x160 [4005007.703062] ? asm_exc_page_fault+0x8/0x30 [4005007.703068] entry_SYSCALL_64_after_hwframe+0x44/0xae [4005007.703075] RIP: 0033:0x7f5e07672992 [4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e c 28 48 89 54 24 [4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992 [4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 00
fffffda RBX: 0000000000020000 RCX: 00007f5e07672992 [4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003 [4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010 [4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000 [4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 [4005007.703105] </TASK> [4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_ iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_
er drm_ttm_helper amd64_edac t tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v 2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca [4005007.703184] CR2: 0000000000000000 [4005007.703188] ---[ en ---truncated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org
ated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/bf2d51eedf03bd61e3556e35d74d49e2e6112398 - https://git.kernel.org/stable/c/437e0fa907ba39b4d7eda863c03ea9cf48bd93a9 - https://git.kernel.org/stable/c/f475d5502f33a6c5b149b0afe96316ad1962a64a - https://git.kernel.org/stable/c/174f62a0aa15c211e60208b41ee9e7cdfb73d455 - https://git.kernel.org/stable/c/6c1b3d89a2dda79881726bb6e37af19c0936d736 - https://git.kernel.org/stable/c/820daf9ffe2b0afb804567b10983fb38bc5ae288 - https://git.kernel.org/stable/c/ba3c0796d292de84f2932cc5bbb0f771fc720996 - https://git.kernel.org/stable/c/5104fdf50d326db2c1a994f8b35dcd46e63ae4ad
CVE ID: CVE-2023-52818 State: PUBLISHED Published: 2024-05-21T15:31:24.915Z Last Updated: 2025-05-04T07:43:46.442Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 For pptable structs that use flexible array sizes, use flexible arrays. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e52e324a21341c97350d5f11de14721c1c609498 - https://git.kernel.org/stable/c/cfd8cd907fd94538561479a43aea455f5cf16928 - https://git.kernel.org/stable/c/c847379a5d00078ad6fcb1c24230e72c5609342f - https://git.kernel.org/stable/c/
5f5cf16928 - https://git.kernel.org/stable/c/c847379a5d00078ad6fcb1c24230e72c5609342f - https://git.kernel.org/stable/c/8af28ae3acb736ada4ce3457662fa446cc913bb4 - https://git.kernel.org/stable/c/acdb6830de02cf2873aeaccdf2d9bca4aee50e47 - https://git.kernel.org/stable/c/fc9ac0e8e0bcb3740c6eaad3a1a50c20016d422b - https://git.kernel.org/stable/c/6dffdddfca818c02a42b6caa1d9845995f0a1f94 - https://git.kernel.org/stable/c/92a775e7c9707aed28782bafe636bf87675f5a97 - https://git.kernel.org/stable/c/760efbca74a405dc439a013a5efaa9fadc95a8c3
CVE ID: CVE-2023-52819 State: PUBLISHED Published: 2024-05-21T15:31:25.582Z Last Updated: 2025-05-04T07:43:47.544Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga For pptable structs that use flexible array sizes, use flexible arrays. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/60a00dfc7c5deafd1dd393beaf53224f7256dad6 - https://git.kernel.org/stable/c/a63fd579e7b1c3a9ebd6e6c494d49b1b6cf5515e - https://git.kernel.org/stable/c/d50a56749e5afdc63491b88f5153c1aae00d4679 - https://git.kernel.
bd6e6c494d49b1b6cf5515e - https://git.kernel.org/stable/c/d50a56749e5afdc63491b88f5153c1aae00d4679 - https://git.kernel.org/stable/c/8c1dbddbfcb051e82cea0c197c620f9dcdc38e92 - https://git.kernel.org/stable/c/a237675aa1e62bbfaa341c535331c8656a508fa1 - https://git.kernel.org/stable/c/d0725232da777840703f5f1e22f2e3081d712aa4 - https://git.kernel.org/stable/c/7c68283f3166221af3df5791f0e13d3137a72216 - https://git.kernel.org/stable/c/b3b8b7c040cf069da7afe11c5bd73b870b8f3d18 - https://git.kernel.org/stable/c/0f0e59075b5c22f1e871fbd508d6e4f495048356
CVE ID: CVE-2023-52820 State: REJECTED Published: 2024-05-21T15:31:26.238Z Last Updated: 2024-05-24T15:26:37.788Z Description: No description available.
CVE ID: CVE-2023-52821 State: PUBLISHED Published: 2024-05-21T15:31:26.888Z Last Updated: 2025-05-04T07:43:48.695Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/panel: fix a possible null pointer dereference In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c7dc0aca5962fb37dbea9769dd26ec37813faae1 - https://git.kernel.org/stable/c/2381f6b628b3214f07375e0
t.kernel.org/stable/c/c7dc0aca5962fb37dbea9769dd26ec37813faae1 - https://git.kernel.org/stable/c/2381f6b628b3214f07375e0adf5ce17093c31190 - https://git.kernel.org/stable/c/79813cd59398015867d51e6d7dcc14d287d4c402 - https://git.kernel.org/stable/c/4fa930ba046d20fc1899770396ee11e905fa96e4 - https://git.kernel.org/stable/c/8a9dd36fcb4f3906982b82593393578db4479992 - https://git.kernel.org/stable/c/924e5814d1f84e6fa5cb19c6eceb69f066225229
CVE ID: CVE-2023-52822 State: REJECTED Published: 2024-05-21T15:31:27.548Z Last Updated: 2024-05-24T15:25:25.145Z Description: No description available.
CVE ID: CVE-2023-52823 State: REJECTED Published: 2024-05-21T15:31:28.211Z Last Updated: 2024-05-24T10:16:07.397Z Description: No description available.
CVE ID: CVE-2023-52824 State: REJECTED Published: 2024-05-21T15:31:28.872Z Last Updated: 2024-05-24T15:26:11.440Z Description: No description available.
CVE ID: CVE-2023-52825 State: PUBLISHED Published: 2024-05-21T15:31:29.517Z Last Updated: 2025-05-20T14:27:32.686Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix a race condition of vram buffer unref in svm code prange->svm_bo unref can happen in both mmu callback and a callback after migrate to system ram. Both are async call in different tasks. Sync svm_bo unref operation to avoid random "use-after-free". Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7d43cdd22cd81a2b079e864c4321b9aba4c6af34 - https://git.kernel.org/stable/c/50f35a907c4
- https://git.kernel.org/stable/c/7d43cdd22cd81a2b079e864c4321b9aba4c6af34 - https://git.kernel.org/stable/c/50f35a907c4f9ed431fd3dbb8b871ef1cbb0718e - https://git.kernel.org/stable/c/c772eacbd6d0845fc922af8716bb9d29ae27b8cf - https://git.kernel.org/stable/c/fc0210720127cc6302e6d6f3de48f49c3fcf5659 - https://git.kernel.org/stable/c/709c348261618da7ed89d6c303e2ceb9e453ba74
CVE ID: CVE-2023-52826 State: PUBLISHED Published: 2024-05-21T15:31:30.184Z Last Updated: 2025-05-04T07:43:50.892Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference In tpg110_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9acc2bc00135e9ecd13a70ce1140e2673e504cdc - https://git.kernel.org/stable/c/84c923d89890518
tps://git.kernel.org/stable/c/9acc2bc00135e9ecd13a70ce1140e2673e504cdc - https://git.kernel.org/stable/c/84c923d898905187ebfd4c0ef38cd1450af7e0ea - https://git.kernel.org/stable/c/d0bc9ab0a161a9745273f5bf723733a8e6c57aca - https://git.kernel.org/stable/c/9268bfd76bebc85ff221691b61498cc16d75451c - https://git.kernel.org/stable/c/eaede6900c0961b072669d6bd97fe8f90ed1900f - https://git.kernel.org/stable/c/f22def5970c423ea7f87d5247bd0ef91416b0658
CVE ID: CVE-2023-52827 State: PUBLISHED Published: 2024-05-21T15:31:30.837Z Last Updated: 2025-05-04T07:43:51.920Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats() len is extracted from HTT message and could be an unexpected value in case errors happen, so add validation before using to avoid possible out-of-bound read in the following message iteration and parsing. The same issue also applies to ppdu_info->ppdu_stats.common.num_users, so validate it before using too. These are found during code review. Compile test only. Additional Analyst Notes: - CISA
so validate it before using too. These are found during code review. Compile test only. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/79527c21a3ce04cffc35ea54f74ee087e532be57 - https://git.kernel.org/stable/c/c9e44111da221246efb2e623ae1be40a5cf6542c - https://git.kernel.org/stable/c/1bc44a505a229bb1dd4957e11aa594edeea3690e
CVE ID: CVE-2023-52828 State: PUBLISHED Published: 2024-05-21T15:31:31.501Z Last Updated: 2025-05-04T07:43:53.136Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Detect IP == ksym.end as part of BPF program Now that bpf_throw kfunc is the first such call instruction that has noreturn semantics within the verifier, this also kicks in dead code elimination in unprecedented ways. For one, any instruction following a bpf_throw call will never be marked as seen. Moreover, if a callchain ends up throwing, any instructions after the call instruction to the eventually throwing subprog in callers will also never be marked as seen.
nstructions after the call instruction to the eventually throwing subprog in callers will also never be marked as seen. The tempting way to fix this would be to emit extra 'int3' instructions which bump the jited_len of a program, and ensure that during runtime when a program throws, we can discover its boundaries even if the call instruction to bpf_throw (or to subprogs that always throw) is emitted as the final instruction in the program. An example of such a program would be this: do_something(): ... r0 = 0 exit foo(): r1 = 0 call bpf_throw r0 = 0 exit bar(cond): if r1 != 0 goto pc+2 call do_something exit call foo r0 = 0 // Never seen by verifier exit // main(ctx): r1 = ... call bar r0 =
= 0 goto pc+2 call do_something exit call foo r0 = 0 // Never seen by verifier exit // main(ctx): r1 = ... call bar r0 = 0 exit Here, if we do end up throwing, the stacktrace would be the following: bpf_throw foo bar main In bar, the final instruction emitted will be the call to foo, as such, the return address will be the subsequent instruction (which the JIT emits as int3 on x86). This will end up lying outside the jited_len of the program, thus, when unwinding, we will fail to discover the return address as belonging to any program and end up in a panic due to the unreliable stack unwinding of BPF programs that we never expect. To remedy this case, make bpf_prog_ksym_find treat IP == ksym