Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-52498 State: PUBLISHED Published: 2024-02-29T15:52:14.029Z Last Updated: 2025-05-04T07:38:01.601Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported that in low-memory situations the system-wide resume core code deadlocks, because async_schedule_dev() executes its argument function synchronously if it cannot allocate memory (and not only in that case) and that function attempts to acquire a mutex that is already held. Executing the argument function synchronously from within dpm_async_fn() may also be problematic for ordering reasons (it m
cuting the argument function synchronously from within dpm_async_fn() may also be problematic for ordering reasons (it may cause a consumer device's resume callback to be invoked before a requisite supplier device's one, for example). Address this by changing the code in question to use async_schedule_dev_nocall() for scheduling the asynchronous execution of device suspend and resume functions and to directly run them synchronously if async_schedule_dev_nocall() returns false. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d - https://git.kernel.org/stable/c/a1d62c775b07213c73f81
git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d - https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 - https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 - https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe - https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 - https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557
CVE ID: CVE-2023-52499 State: PUBLISHED Published: 2024-03-02T21:52:15.268Z Last Updated: 2025-05-04T07:38:03.204Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/47x: Fix 47x syscall return crash Eddie reported that newer kernels were crashing during boot on his 476 FSP2 system: kernel tried to execute user page (b7ee2000) - exploit attempt? (uid: 0) BUG: Unable to handle kernel instruction fetch Faulting instruction address: 0xb7ee2000 Oops: Kernel access of bad area, sig: 11 [#1] BE PAGE_SIZE=4K FSP-2 Modules linked in: CPU: 0 PID: 61 Comm: mount Not tainted 6.1.55-d23900f.ppcnf-fsp2 #1 Hardware name: ibm,fsp2 476fpe
2 Modules linked in: CPU: 0 PID: 61 Comm: mount Not tainted 6.1.55-d23900f.ppcnf-fsp2 #1 Hardware name: ibm,fsp2 476fpe 0x7ff520c0 FSP-2 NIP: b7ee2000 LR: 8c008000 CTR: 00000000 REGS: bffebd83 TRAP: 0400 Not tainted (6.1.55-d23900f.ppcnf-fs p2) MSR: 00000030 <IR,DR> CR: 00001000 XER: 20000000 GPR00: c00110ac bffebe63 bffebe7e bffebe88 8c008000 00001000 00000d12 b7ee2000 GPR08: 00000033 00000000 00000000 c139df10 48224824 1016c314 10160000 00000000 GPR16: 10160000 10160000 00000008 00000000 10160000 00000000 10160000 1017f5b0 GPR24: 1017fa50 1017f4f0 1017fa50 1017f740 1017f630 00000000 00000000 1017f4f0 NIP [b7ee2000] 0xb7ee2000 LR [8c008000] 0x8c008000 Call Trace: Instruction dump: XXXXXXXX
30 00000000 00000000 1017f4f0 NIP [b7ee2000] 0xb7ee2000 LR [8c008000] 0x8c008000 Call Trace: Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX ---[ end trace 0000000000000000 ]--- The problem is in ret_from_syscall where the check for icache_44x_need_flush is done. When the flush is needed the code jumps out-of-line to do the flush, and then intends to jump back to continue the syscall return. However the branch back to label 1b doesn't return to the correct location, instead branching back just prior to the return to userspace, causing bogus register values to be used by the rfi.
ion, instead branching back just prior to the return to userspace, causing bogus register values to be used by the rfi. The breakage was introduced by commit 6f76a01173cc ("powerpc/syscall: implement system call entry/exit logic in C for PPC32") which inadvertently removed the "1" label and reused it elsewhere. Fix it by adding named local labels in the correct locations. Note that the return label needs to be outside the ifdef so that CONFIG_PPC_47x=n compiles. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/29017ab1a539101d9c7bec63cc13a019f97b2820 - https://git.kernel.org/stable/c/8ac2689502f986a46f4221e239d4ff2897f1
stable/c/29017ab1a539101d9c7bec63cc13a019f97b2820 - https://git.kernel.org/stable/c/8ac2689502f986a46f4221e239d4ff2897f1ccb3 - https://git.kernel.org/stable/c/70f6756ad96dd70177dddcfac2fe4bd4bb320746 - https://git.kernel.org/stable/c/f0eee815babed70a749d2496a7678be5b45b4c14
CVE ID: CVE-2023-52500 State: PUBLISHED Published: 2024-03-02T21:52:15.903Z Last Updated: 2025-05-04T07:38:04.675Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4 - https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d - https://git.kernel.org/stable/c/2259e1901b
- https://git.kernel.org/stable/c/d540a4370aba378fbedf349ba0bb68e96e24243d - https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749 - https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7 - https://git.kernel.org/stable/c/c13e7331745852d0dd7c35eabbe181cbd5b01172
CVE ID: CVE-2023-52501 State: PUBLISHED Published: 2024-03-02T21:52:16.556Z Last Updated: 2025-06-19T12:56:26.686Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not attempt to read past "commit" When iterating over the ring buffer while the ring buffer is active, the writer can corrupt the reader. There's barriers to help detect this and handle it, but that code missed the case where the last event was at the very end of the page and has only 4 bytes left. The checks to detect the corruption by the writer to reads needs to see the length of the event. If the length in the first 4 bytes is zero then the length i
y the writer to reads needs to see the length of the event. If the length in the first 4 bytes is zero then the length is stored in the second 4 bytes. But if the writer is in the process of updating that code, there's a small window where the length in the first 4 bytes could be zero even though the length is only 4 bytes. That will cause rb_event_length() to read the next 4 bytes which could happen to be off the allocated page. To protect against this, fail immediately if the next event pointer is less than 8 bytes from the end of the commit (last byte of data), as all events must be a minimum of 8 bytes anyway. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Re
ents must be a minimum of 8 bytes anyway. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cee5151c5410e868826b8afecfb356f3799ebea3 - https://git.kernel.org/stable/c/344f2f3e61a90f0150c754796ec9a17fcaeec03d - https://git.kernel.org/stable/c/b08a4938229dbb530a35c41b83002a1457c6ff49 - https://git.kernel.org/stable/c/75fc9e99b3a71006720ad1e029db11a4b5c32d4a - https://git.kernel.org/stable/c/95a404bd60af6c4d9d8db01ad14fe8957ece31ca
CVE ID: CVE-2023-52502 State: PUBLISHED Published: 2024-03-02T21:52:17.218Z Last Updated: 2025-05-04T07:38:07.231Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Co
found by nfc_llcp_sock_from_sn() does not disappear. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e863f5720a5680e50c4cecf12424d7cc31b3eb0a - https://git.kernel.org/stable/c/7adcf014bda16cdbf804af5c164d94d5d025db2d - https://git.kernel.org/stable/c/6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9 - https://git.kernel.org/stable/c/d888d3f70b0de32b4f51534175f039ddab15eef8 - https://git.kernel.org/stable/c/e4f2611f07c87b3ddb57c4b9e8efcd1e330fc3dc - https://git.kernel.org/stable/c/d1af8a39cf839d93c8967fdd858f6bbdc3e4a15c - https://git.kernel.org/stable/c/31c07dffafce914c1d1543c135382a11ff058d93
CVE ID: CVE-2023-52503 State: PUBLISHED Published: 2024-03-02T21:52:17.854Z Last Updated: 2025-05-04T07:38:08.762Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session There is a potential race condition in amdtee_close_session that may cause use-after-free in amdtee_open_session. For instance, if a session has refcount == 1, and one thread tries to free this session via: kref_put(&sess->refcount, destroy_session); the reference count will get decremented, and the next step would be to call destroy_session(). However, if in another thread, amdtee_open_session() is
remented, and the next step would be to call destroy_session(). However, if in another thread, amdtee_open_session() is called before destroy_session() has completed execution, alloc_session() may return 'sess' that will be freed up later in destroy_session() leading to use-after-free in amdtee_open_session. To fix this issue, treat decrement of sess->refcount and removal of 'sess' from session list in destroy_session() as a critical section, so that it is executed atomically. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27 - https://git.kernel.org/stable/c/1680c82929bc14d706065
git.kernel.org/stable/c/da7ce52a2f6c468946195b116615297d3d113a27 - https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116 - https://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05c - https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa06658010768f2a0ce - https://git.kernel.org/stable/c/f4384b3e54ea813868bb81a861bf5b2406e15d8f
CVE ID: CVE-2023-52504 State: PUBLISHED Published: 2024-03-02T21:52:18.500Z Last Updated: 2025-05-04T07:38:09.999Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Disable KASAN in apply_alternatives() Fei has reported that KASAN triggers during apply_alternatives() on a 5-level paging machine: BUG: KASAN: out-of-bounds in rcu_is_watching() Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0 ... __asan_load4() rcu_is_watching() trace_hardirqs_on() text_poke_early() apply_alternatives() ... On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) gets patched. It includes KASAN code, where K
... On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on __VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled(). KASAN gets confused when apply_alternatives() patches the KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue. Fix it for real by disabling KASAN while the kernel is patching alternatives. [ mingo: updated the changelog ] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3719d3c36aa853d5a2401af9f8d6b116c91ad5ae - https:
- CVE Program Container: References: - https://git.kernel.org/stable/c/3719d3c36aa853d5a2401af9f8d6b116c91ad5ae - https://git.kernel.org/stable/c/3770c38cd6a60494da29ac2da73ff8156440a2d1 - https://git.kernel.org/stable/c/6788b10620ca6e98575d1e06e72a8974aad7657e - https://git.kernel.org/stable/c/ecba5afe86f30605eb9dfb7f265a8de0218d4cfc - https://git.kernel.org/stable/c/5b784489c8158518bf7a466bb3cc045b0fb66b4b - https://git.kernel.org/stable/c/cd287cc208dfe6bd6da98e7f88e723209242c9b4 - https://git.kernel.org/stable/c/d35652a5fc9944784f6f50a5c979518ff8dacf61
CVE ID: CVE-2023-52505 State: PUBLISHED Published: 2024-03-02T21:52:19.215Z Last Updated: 2025-05-04T07:38:11.314Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD (implemented by the driver), as well as others, control protocol converters from multiple lanes (each represented as a different struct phy). So, if there are simultaneous calls to phy_set_mode_ext() to lanes sharing the same PCC register (either for the "old" or for the "new" protocol), corruption of the values programmed to
sharing the same PCC register (either for the "old" or for the "new" protocol), corruption of the values programmed to hardware is possible, because lynx_28g_rmw() has no locking. Add a spinlock in the struct lynx_28g_priv shared by all lanes, and take the global spinlock from the phy_ops :: set_mode() implementation. There are no other callers which modify PCC registers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6f901f8448c6b25ed843796b114471d2a3fc5dfb - https://git.kernel.org/stable/c/c2d7c79898b427d263c64a4841987eec131f2d4e - https://git.kernel.org/stable/c/139ad1143151a07be93bf741d4ea7c89e59f89ce
CVE ID: CVE-2023-52506 State: PUBLISHED Published: 2024-03-02T21:52:20.064Z Last Updated: 2025-05-04T07:38:12.522Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: LoongArch: Set all reserved memblocks on Node#0 at initialization After commit 61167ad5fecdea ("mm: pass nid to reserve_bootmem_region()") we get a panic if DEFERRED_STRUCT_PAGE_INIT is enabled: [ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000002b82, era == 90000000040e3f28, ra == 90000000040e3f18 [ 0.000000] Oops[#1]: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.5.0+ #733 [ 0.000000] pc 90000000040e3f28 ra 90000000040e3f1
[#1]: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.5.0+ #733 [ 0.000000] pc 90000000040e3f28 ra 90000000040e3f18 tp 90000000046f4000 sp 90000000046f7c90 [ 0.000000] a0 0000000000000001 a1 0000000000200000 a2 0000000000000040 a3 90000000046f7ca0 [ 0.000000] a4 90000000046f7ca4 a5 0000000000000000 a6 90000000046f7c38 a7 0000000000000000 [ 0.000000] t0 0000000000000002 t1 9000000004b00ac8 t2 90000000040e3f18 t3 90000000040f0800 [ 0.000000] t4 00000000000f0000 t5 80000000ffffe07e t6 0000000000000003 t7 900000047fff5e20 [ 0.000000] t8 aaaaaaaaaaaaaaab u0 0000000000000018 s9 0000000000000000 s0 fffffefffe000000 [ 0.000000] s1 0000000000000000 s2 0000000000000080 s3 0000000000000040 s4 000
8 s9 0000000000000000 s0 fffffefffe000000 [ 0.000000] s1 0000000000000000 s2 0000000000000080 s3 0000000000000040 s4 0000000000000000 [ 0.000000] s5 0000000000000000 s6 fffffefffe000000 s7 900000000470b740 s8 9000000004ad4000 [ 0.000000] ra: 90000000040e3f18 reserve_bootmem_region+0xec/0x21c [ 0.000000] ERA: 90000000040e3f28 reserve_bootmem_region+0xfc/0x21c [ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE) [ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 0.000000] ECFG: 00070800 (LIE=11 VS=7) [ 0.000000] ESTAT: 00010800 [PIL] (IS=11 ECode=1 EsubCode=0) [ 0.000000] BADV: 0000000000002b82 [ 0.000000] PRID: 0014d000 (Loongson-64bi
: 00010800 [PIL] (IS=11 ECode=1 EsubCode=0) [ 0.000000] BADV: 0000000000002b82 [ 0.000000] PRID: 0014d000 (Loongson-64bit, Loongson-3A6000) [ 0.000000] Modules linked in: [ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____)) [ 0.000000] Stack : 0000000000000000 9000000002eb5430 0000003a00000020 90000000045ccd00 [ 0.000000] 900000000470e000 90000000002c1918 0000000000000000 9000000004110780 [ 0.000000] 00000000fe6c0000 0000000480000000 9000000004b4e368 9000000004110748 [ 0.000000] 0000000000000000 900000000421ca84 9000000004620000 9000000004564970 [ 0.000000] 90000000046f7d78 9000000002cc9f70 90000000002c1918 900000000470e000 [ 0.000000] 9000000004564970 900
4564970 [ 0.000000] 90000000046f7d78 9000000002cc9f70 90000000002c1918 900000000470e000 [ 0.000000] 9000000004564970 90000000040bc0e0 90000000046f7d78 0000000000000000 [ 0.000000] 0000000000004000 90000000045ccd00 0000000000000000 90000000002c1918 [ 0.000000] 90000000002c1900 900000000470b700 9000000004b4df78 9000000004620000 [ 0.000000] 90000000046200a8 90000000046200a8 0000000000000000 9000000004218b2c [ 0.000000] 9000000004270008 0000000000000001 0000000000000000 90000000045ccd00 [ 0.000000] ... [ 0.000000] Call Trace: [ 0.000000] [<90000000040e3f28>] reserve_bootmem_region+0xfc/0x21c [ 0.000000] [<900000000421ca84>] memblock_free_all+0x114/0x350 [ 0.000000] [<9000000004218b2c>] mm_core_i
ion+0xfc/0x21c [ 0.000000] [<900000000421ca84>] memblock_free_all+0x114/0x350 [ 0.000000] [<9000000004218b2c>] mm_core_init+0x138/0x3cc [ 0.000000] [<9000000004200e38>] start_kernel+0x488/0x7a4 [ 0.000000] [<90000000040df0d8>] kernel_entry+0xd8/0xdc [ 0.000000] [ 0.000000] Code: 02eb21ad 00410f4c 380c31ac <262b818d> 6800b70d 02c1c196 0015001c 57fe4bb1 260002cd The reason is early memblock_reserve() in memblock_init() set node id to MAX_NUMNODES, making NODE_DATA(nid) a NULL dereference in the call chain reserve_bootmem_region() -> init_reserved_page(). After memblock_init(), those late calls of memblock_reserve() operate on subregions of memblock .memory regions. As a result, these reserved
, those late calls of memblock_reserve() operate on subregions of memblock .memory regions. As a result, these reserved regions will be set to the correct node at the first iteration of memmap_init_reserved_pages(). So set all reserved memblocks on Node#0 at initialization can avoid this panic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f105e893a8edd48bdf4bef9fef845a9ff402f737 - https://git.kernel.org/stable/c/19878758accf6b2788091a771d9f9fee7bab11ab - https://git.kernel.org/stable/c/b795fb9f5861ee256070d59e33130980a01fadd7
CVE ID: CVE-2023-52507 State: PUBLISHED Published: 2024-03-02T21:52:20.724Z Last Updated: 2025-05-04T07:38:13.869Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: assert requested protocol is valid The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2c231a247a1d1628e41fa1eefd1a5307c41c5
Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2c231a247a1d1628e41fa1eefd1a5307c41c5f53 - https://git.kernel.org/stable/c/a686f84101680b8442181a8846fbd3c934653729 - https://git.kernel.org/stable/c/95733ea130e35ef9ec5949a5908dde3feaba92cb - https://git.kernel.org/stable/c/a424807d860ba816aaafc3064b46b456361c0802 - https://git.kernel.org/stable/c/25dd54b95abfdca423b65a4ee620a774777d8213 - https://git.kernel.org/stable/c/853dda54ba59ea70d5580a298b7ede4707826848 - https://git.kernel.org/stable/c/6584eba7688dcf999542778b07f63828c21521da - https://git.kernel.org/stable/c/354a6e707e29cb0c007176ee5b8db8be7bd2dee0
CVE ID: CVE-2023-52508 State: PUBLISHED Published: 2024-03-02T21:52:21.361Z Last Updated: 2025-06-24T15:00:16.544Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() The nvme_fc_fcp_op structure describing an AEN operation is initialized with a null request structure pointer. An FC LLDD may make a call to nvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation. Add validation of the request structure pointer before dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stabl
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/be90c9e29dd59b7d19a73297a1590ff3ec1d22ea - https://git.kernel.org/stable/c/dd46b3ac7322baf3772b33b29726e94f98289db7 - https://git.kernel.org/stable/c/8ae5b3a685dc59a8cf7ccfe0e850999ba9727a3c
CVE ID: CVE-2023-52509 State: PUBLISHED Published: 2024-03-02T21:52:22.006Z Last Updated: 2025-05-04T07:38:16.664Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // free priv ravb_tx_timeout_work() // use priv unregister_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is
r_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is also called. So that .ndo_tx_timeout() will not be called after phy_stop(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5 - https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82 - https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6 - https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965 - https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705 - https://git.kernel.org/stable/c/3971442
965 - https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705 - https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89
CVE ID: CVE-2023-52510 State: PUBLISHED Published: 2024-03-02T21:52:22.645Z Last Updated: 2025-05-04T07:38:17.788Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: Fix a potential UAF in ca8210_probe If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. However, the caller ca8210_probe() then calls ca8210_remove(), where priv->clk is freed again in ca8210_unregister_ext_clock(). In this case, a use-after-free may happen in the second time we call clk_unregister(). Fix this by removing the first clk_unregister(). Also, priv->clk could
ppen in the second time we call clk_unregister(). Fix this by removing the first clk_unregister(). Also, priv->clk could be an error code on failure of clk_register_fixed_rate(). Use IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/28b68cba378e3e50a4082b65f262bc4f2c7c2add - https://git.kernel.org/stable/c/cdb46be93c1f7bbf2c4649e9fc5fb147cfb5245d - https://git.kernel.org/stable/c/85c2857ef90041f567ce98722c1c342c4d31f4bc - https://git.kernel.org/stable/c/55e06850c7894f00d41b767c5f5665459f83f58f - https://git.kernel.org/stable/c/84c6aa0ae5c4dc121f9996bb8fe