Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.096136] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.096136] Call Trace: [ 472.096136] <TASK> [ 472.096136] ? __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ?
e: [ 472.096136] <TASK> [ 472.096136] ? __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0 [ 472.096136] ? do_user_addr_fault+0x1027/0x1340 [ 472.096136] ? _printk+0x7a/0xa0 [ 472.096136] ? mutex_lock+0x68/0xc0 [ 472.096136] ? add_taint+0x42/0xd0 [ 472.096136] ? exc_page_fault+0x6a/0x1b0 [ 472.096136] ? asm_exc_page_fault+0x26/0x30 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] ? mutex_lock+0x88/0xc0 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] l2cap_chan_timeo ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e137e2ba96e51902dc2
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e137e2ba96e51902dc2878131823a96bf8e638ae - https://git.kernel.org/stable/c/6466ee65e5b27161c846c73ef407f49dfa1bd1d9 - https://git.kernel.org/stable/c/06acb75e7ed600d0bbf7bff5628aa8f24a97978c - https://git.kernel.org/stable/c/e97e16433eb4533083b096a3824b93a5ca3aee79 - https://git.kernel.org/stable/c/8960ff650aec70485b40771cd8e6e8c4cb467d33 - https://git.kernel.org/stable/c/955b5b6c54d95b5e7444dfc81c95c8e013f27ac0 - https://git.kernel.org/stable/c/eb86f955488c39526534211f2610e48a5cf8ead4 - https://git.kernel.org/stable/c/adf0398cee86643b8eacde95f17d073d022f782c
CVE ID: CVE-2024-27400 State: PUBLISHED Published: 2024-05-13T10:26:13.504Z Last Updated: 2025-05-04T12:55:33.172Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 This reverts drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap. The basic problem here is that after the move the old location is simply not available any more. Some fixes were suggested, but essentially we should call the move notification before actually moving things because only this way we have the correct order for DMA-buf and VM move notifications as well. Also rework the statisti
because only this way we have the correct order for DMA-buf and VM move notifications as well. Also rework the statistic handling so that we don't update the eviction counter before the move. v2: add missing NULL check Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5c25b169f9a0b34ee410891a96bc9d7b9ed6f9be - https://git.kernel.org/stable/c/0c7ed3ed35eec9138b88d42217b5a6b9a62bda4d - https://git.kernel.org/stable/c/9a4f6e138720b6e9adf7b82a71d0292f3f276480 - https://git.kernel.org/stable/c/d3a9331a6591e9df64791e076f6591f440af51c3
CVE ID: CVE-2024-27401 State: PUBLISHED Published: 2024-05-13T10:29:53.862Z Last Updated: 2025-05-04T09:04:18.940Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firewire: nosy: ensure user_length is taken into account when fetching packet contents Ensure that packet_buffer_get respects the user_length provided. If the length of the head packet exceeds the user_length, packet_buffer_get will now return 0 to signify to the user that no data were read and a larger buffer size is required. Helps prevent user space overflows. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kerne
e overflows. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/67f34f093c0f7bf33f5b4ae64d3d695a3b978285 - https://git.kernel.org/stable/c/7b8c7bd2296e95b38a6ff346242356a2e7190239 - https://git.kernel.org/stable/c/cca330c59c54207567a648357835f59df9a286bb - https://git.kernel.org/stable/c/79f988d3ffc1aa778fc5181bdfab312e57956c6b - https://git.kernel.org/stable/c/4ee0941da10e8fdcdb34756b877efd3282594c1f - https://git.kernel.org/stable/c/1fe60ee709436550f8cfbab01295936b868d5baa - https://git.kernel.org/stable/c/539d51ac48bcfcfa1b3d4a85f8df92fa22c1d41c - https://git.kernel.org/stable/c/38762a0763c10c24a4915feee722d7aa6e73eb98
CVE ID: CVE-2024-27402 State: PUBLISHED Published: 2024-05-17T11:40:14.365Z Last Updated: 2025-05-04T09:04:20.509Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fix racy skb_queue_empty() use The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skb_peek() unexpectedly returning NULL or a pointer to an already dequeued socket buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7d3914a477eed92b48c493a8631cc4554ab4fd4f - https://git.kernel.org/stable/c/9d5523e065b568e79dfaa2ea1085a5bcf74baf7
ble/c/7d3914a477eed92b48c493a8631cc4554ab4fd4f - https://git.kernel.org/stable/c/9d5523e065b568e79dfaa2ea1085a5bcf74baf78 - https://git.kernel.org/stable/c/0a9f558c72c47472c38c05fcb72c70abb9104277 - https://git.kernel.org/stable/c/8ef4fcc7014b9f93619851d6b78d6cc2789a4c88 - https://git.kernel.org/stable/c/7d2a894d7f487dcb894df023e9d3014cf5b93fe5
CVE ID: CVE-2024-27403 State: PUBLISHED Published: 2024-05-17T11:40:17.992Z Last Updated: 2025-05-04T09:04:21.899Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: reset dst in route object after setting up flow dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flow_offload_add() fails, error path releases dst twice, leading to a refcount underflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c - https://git.kernel.org/s
ainer: References: - https://git.kernel.org/stable/c/4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c - https://git.kernel.org/stable/c/012df10717da02367aaf92c65f9c89db206c15f4 - https://git.kernel.org/stable/c/558b00a30e05753a62ecc7e05e939ca8f0241148 - https://git.kernel.org/stable/c/670548c8db44d76e40e1dfc06812bca36a61e9ae - https://git.kernel.org/stable/c/9e0f0430389be7696396c62f037be4bf72cf93e3
CVE ID: CVE-2024-27404 State: PUBLISHED Published: 2024-05-17T11:40:21.607Z Last Updated: 2025-05-04T09:04:23.378Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data races on remote_id Similar to the previous patch, address the data race on remote_id, adding the suitable ONCE annotations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e64148635509bf13eea851986f5a0b150e5bd066 - https://git.kernel.org/stable/c/2dba5774e8ed326a78ad4339d921a4291281ea6e - https://git.kernel.org/stable/c/987c3ed7297e5661bc7f448f06fc366e497ac9b2 - https://git.kernel
78ad4339d921a4291281ea6e - https://git.kernel.org/stable/c/987c3ed7297e5661bc7f448f06fc366e497ac9b2 - https://git.kernel.org/stable/c/967d3c27127e71a10ff5c083583a038606431b61
CVE ID: CVE-2024-27405 State: PUBLISHED Published: 2024-05-17T11:40:25.069Z Last Updated: 2025-05-04T09:04:24.877Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some instances, the gadget_giveback has one byte appended at the end of a proper NTB. When the NTB is parsed, unwrap call looks for any leftover bytes in SKB provided by u_ether and if there are any pending bytes, it treats them as a separate NTB and parses it. But in case the second NTB (as per unwrap call) is faulty/c
nding bytes, it treats them as a separate NTB and parses it. But in case the second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that were parsed properly in the first NTB and saved in rx_list are dropped. Adding a few custom traces showed the following: [002] d..1 7828.532866: dwc3_gadget_giveback: ep1out: req 000000003868811a length 1025/16384 zsI ==> 0 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400 [002] d..1 7828.532868: ncm_unwrap
seq: 0xce67 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10 [002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames In this case, the giveback is of 1025 bytes and block length is 1024. The rest 1 byte (which is 0x00) won't be parsed resulting in drop of all datagrams in rx_list. Same is case with packets of size 2048: [002] d..1 7828.557948: dwc3_gadget_giveback: ep1out: req 0000000011dfd96e length 2049/16384 zsI ==> 0 [002] d..1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800 Lecroy shows one by
_unwrap_ntb nth: 1751999342 [002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800 Lecroy shows one byte coming in extra confirming that the byte is coming in from PC: Transfer 2959 - Bytes Transferred(1025) Timestamp((18.524 843 590) - Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590) --- Packet 4063861 Data(1024 bytes) Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590) --- Packet 4063863 Data(1 byte) Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722) According to Windows driver, no ZLP is needed if wBlockLength is non-zero, because the non-zero wBlockLength has already told the function side the size of transfer to be expected. However, there
because the non-zero wBlockLength has already told the function side the size of transfer to be expected. However, there are in-market NCM devices that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize. To deal with such devices, it pads an extra 0 at end so the transfer is no longer multiple of wMaxPacketSize. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/059285e04ebb273d32323fbad5431c5b94f77e48 - https://git.kernel.org/stable/c/a31cf46d108dabce3df80b3e5c07661e24912151 - https://git.kernel.org/stable/c/57ca0e16f393bb21d69734e536e383a3a4c665fd - https://git.kernel.org/stable/c/2cb66b62a5d64ccf09b0
/git.kernel.org/stable/c/57ca0e16f393bb21d69734e536e383a3a4c665fd - https://git.kernel.org/stable/c/2cb66b62a5d64ccf09b0591ab86fb085fa491fc5 - https://git.kernel.org/stable/c/35b604a37ec70d68b19dafd10bbacf1db505c9ca - https://git.kernel.org/stable/c/2b7ec68869d50ea998908af43b643bca7e54577e - https://git.kernel.org/stable/c/c7f43900bc723203d7554d299a2ce844054fab8e - https://git.kernel.org/stable/c/76c51146820c5dac629f21deafab0a7039bc3ccd
CVE ID: CVE-2024-27406 State: PUBLISHED Published: 2024-05-17T11:40:28.608Z Last Updated: 2025-05-04T09:04:26.697Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: lib/Kconfig.debug: TEST_IOV_ITER depends on MMU Trying to run the iov_iter unit test on a nommu system such as the qemu kc705-nommu emulation results in a crash. KTAP version 1 # Subtest: iov_iter # module: kunit_iov_iter 1..9 BUG: failure at mm/nommu.c:318/vmap()! Kernel panic - not syncing: BUG! The test calls vmap() directly, but vmap() is not supported on nommu systems, causing the crash. TEST_IOV_ITER therefore needs to depend on MMU. Additional Analyst Notes: - C
orted on nommu systems, causing the crash. TEST_IOV_ITER therefore needs to depend on MMU. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e6316749d603fe9c4c91f6ec3694e06e4de632a3 - https://git.kernel.org/stable/c/9e6e541b97762d5b1143070067f7c68f39a408f8 - https://git.kernel.org/stable/c/1eb1e984379e2da04361763f66eec90dd75cf63e
CVE ID: CVE-2024-27407 State: PUBLISHED Published: 2024-05-17T11:40:32.129Z Last Updated: 2025-11-03T20:37:04.117Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fixed overflow check in mi_enum_attr() Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e99faa97359654b6e4e769246c72cf50a57e05b2 - https://git.kernel.org/stable/c/8c77398c72618101d66480b94b34fe9087ee3d08 - https://git.kernel.org/stable/c/1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7 - https://git.kernel.org/stable/c/652cfeb43d6b9aba5c7c4902bed7a7340df131fb
CVE ID: CVE-2024-27408 State: PUBLISHED Published: 2024-05-17T11:50:36.208Z Last Updated: 2025-05-04T09:04:29.366Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup The Linked list element and pointer are not stored in the same memory as the eDMA controller register. If the doorbell register is toggled before the full write of the linked list a race condition error will occur. In remote setup we can only use a readl to the memory to assure the full write has occurred. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
mory to assure the full write has occurred. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d24fe6d5a1cfdddb7a9ef56736ec501c4d0a5fd3 - https://git.kernel.org/stable/c/f396b4df27cfe01a99f4b41f584c49e56477be3a - https://git.kernel.org/stable/c/bbcc1c83f343e580c3aa1f2a8593343bf7b55bba
CVE ID: CVE-2024-27409 State: PUBLISHED Published: 2024-05-17T11:50:39.756Z Last Updated: 2025-05-04T09:04:30.936Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup The Linked list element and pointer are not stored in the same memory as the HDMA controller register. If the doorbell register is toggled before the full write of the linked list a race condition error will occur. In remote setup we can only use a readl to the memory to assure the full write has occurred. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
mory to assure the full write has occurred. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/227ef58a9b0c372efba422e8886a8015a1509eba - https://git.kernel.org/stable/c/17be6f5cb223f22e4733ed8fe8b2247cbb677716 - https://git.kernel.org/stable/c/712a92a48158e02155b4b6b21e03a817f78c9b7e
CVE ID: CVE-2024-27410 State: PUBLISHED Published: 2024-05-17T11:50:43.212Z Last Updated: 2025-06-19T12:39:17.711Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype change with mesh ID change It's currently possible to change the mesh ID when the interface isn't yet in mesh mode, at the same time as changing it into mesh mode. This leads to an overwrite of data in the wdev->u union for the interface type it currently has, causing cfg80211_change_iface() to do wrong things when switching. We could probably allow setting an interface to mesh while setting the mesh ID at the same time by doing a different
ng. We could probably allow setting an interface to mesh while setting the mesh ID at the same time by doing a different order of operations here, but realistically there's no userspace that's going to do this, so just disallow changes in iftype when setting mesh ID. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/930e826962d9f01dcd2220176134427358d112f2 - https://git.kernel.org/stable/c/177d574be4b58f832354ab1ef5a297aa0c9aa2df - https://git.kernel.org/stable/c/a2add961a5ed25cfd6a74f9ffb9e7ab6d6ded838 - https://git.kernel.org/stable/c/f78c1375339a291cba492a70eaf12ec501d28a8e
CVE ID: CVE-2024-27411 State: PUBLISHED Published: 2024-05-17T11:50:46.770Z Last Updated: 2025-05-04T09:04:33.441Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: keep DMA buffers required for suspend/resume Nouveau deallocates a few buffers post GPU init which are required for GPU suspend/resume to function correctly. This is likely not as big an issue on systems where the NVGPU is the only GPU, but on multi-GPU set ups it leads to a regression where the kernel module errors and results in a system-wide rendering freeze. This commit addresses that regression by moving the two buffers required for suspend and resume
m-wide rendering freeze. This commit addresses that regression by moving the two buffers required for suspend and resume to be deallocated at driver unload instead of post init. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/be00e15b240ed71fc30c0576af7ab670c8271661 - https://git.kernel.org/stable/c/f6ecfdad359a01c7fd8a3bcfde3ef0acdf107e6e
CVE ID: CVE-2024-27412 State: PUBLISHED Published: 2024-05-17T11:50:50.323Z Last Updated: 2025-05-04T12:55:35.363Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do not free non existing IRQ The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxx_battery_i2c_probe() already has an if (client->irq) check wrapping the request_threaded_irq(). But bq27xxx_battery_i2c_remove() unconditionally calls free_irq(client->irq) leading to: [ 190.310742] ------------[ cut here ]------------ [ 190.310843] Trying to free already-free IRQ 0 [ 190.310861] WARNING: CPU: 2 PID: 1304 at k
---[ cut here ]------------ [ 190.310843] Trying to free already-free IRQ 0 [ 190.310861] WARNING: CPU: 2 PID: 1304 at kernel/irq/manage.c:1893 free_irq+0x1b8/0x310 Followed by a backtrace when unbinding the driver. Add an if (client->irq) to bq27xxx_battery_i2c_remove() mirroring probe() to fix this. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d4d813c0a14d6bf52d810a55db06a2e7e3d98eaa - https://git.kernel.org/stable/c/7394abc8926adee6a817bab10797e0adc898af77 - https://git.kernel.org/stable/c/d7acc4a569f5f4513120c85ea2b9f04909b7490f - https://git.kernel.org/stable/c/e601ae81910ce6a3797876e190a2d8ef6cf828bc - https:/
4a569f5f4513120c85ea2b9f04909b7490f - https://git.kernel.org/stable/c/e601ae81910ce6a3797876e190a2d8ef6cf828bc - https://git.kernel.org/stable/c/cefe18e9ec84f8fe3e198ccebb815cc996eb9797 - https://git.kernel.org/stable/c/fbca8bae1ba79d443a58781b45e92a73a24ac8f8 - https://git.kernel.org/stable/c/083686474e7c97b0f8b66df37fcb64e432e8b771 - https://git.kernel.org/stable/c/2df70149e73e79783bcbc7db4fa51ecef0e2022c
CVE ID: CVE-2024-27413 State: PUBLISHED Published: 2024-05-17T11:50:53.780Z Last Updated: 2025-05-04T12:55:41.446Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL
a 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); | ^ Use the correct type instead here. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/00cf21ac526011a29fc708f8912da446fac19f7b - https://git.kernel.org/stable/c/950d4d74d311a18baed6878dbfba8180d7e5dddd - https://git.kernel.org/stable/c/537e3f49dbe88881a6f0752beaa596942d9efd64 - https://git.kernel.org/stable/c/4b73473c050a612fb4317831371073eda07c3050 - https://git.kernel.org/stable/c/ddc547dd05a46720866c32022300f7376c40119f - https://git.kernel.org/stable/c/11aabd7487857b8e7d768fefb092f66dfde68492
e/c/ddc547dd05a46720866c32022300f7376c40119f - https://git.kernel.org/stable/c/11aabd7487857b8e7d768fefb092f66dfde68492 - https://git.kernel.org/stable/c/62a5dcd9bd3097e9813de62fa6f22815e84a0172 - https://git.kernel.org/stable/c/fccfa646ef3628097d59f7d9c1a3e84d4b6bb45e
CVE ID: CVE-2024-27414 State: PUBLISHED Published: 2024-05-17T11:50:57.207Z Last Updated: 2025-05-04T12:55:42.575Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back In the commit d73ef2d69c0d ("rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length"), an adjustment was made to the old loop logic in the function `rtnl_bridge_setlink` to enable the loop to also check the length of the IFLA_BRIDGE_MODE attribute. However, this adjustment removed the `break` statement and led to an error logic of the flags writing back at the end of this function. if (have_flags)
the `break` statement and led to an error logic of the flags writing back at the end of this function. if (have_flags) memcpy(nla_data(attr), &flags, sizeof(flags)); // attr should point to IFLA_BRIDGE_FLAGS NLA !!! Before the mentioned commit, the `attr` is granted to be IFLA_BRIDGE_FLAGS. However, this is not necessarily true fow now as the updated loop will let the attr point to the last NLA, even an invalid NLA which could cause overflow writes. This patch introduces a new variable `br_flag` to save the NLA pointer that points to IFLA_BRIDGE_FLAGS and uses it to resolve the mentioned error logic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - h
e the mentioned error logic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b9fbc44159dfc3e9a7073032752d9e03f5194a6f - https://git.kernel.org/stable/c/882a51a10ecf24ce135d573afa0872aef02c5125 - https://git.kernel.org/stable/c/a1227b27fcccc99dc44f912b479e01a17e2d7d31 - https://git.kernel.org/stable/c/f2261eb994aa5757c1da046b78e3229a3ece0ad9 - https://git.kernel.org/stable/c/167d8642daa6a44b51de17f8ff0f584e1e762db7 - https://git.kernel.org/stable/c/831bc2728fb48a8957a824cba8c264b30dca1425 - https://git.kernel.org/stable/c/743ad091fb46e622f1b690385bb15e3cd3daf874
CVE ID: CVE-2024-27415 State: PUBLISHED Published: 2024-05-17T11:51:00.711Z Last Updated: 2025-05-04T09:04:39.496Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: confirm multicast packets before passing them up the stack conntrack nf_confirm logic cannot handle cloned skbs referencing the same nf_conn entry, which will happen for multicast (broadcast) frames on bridges. Example: macvlan0 | br0 / \ ethX ethY ethX (or Y) receives a L2 multicast or broadcast packet containing an IP packet, flow is not yet in conntrack table. 1. skb passes through bridge and fake-ip (br_netfilter)Prerouting. -> skb->_nfct now ref