Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
re name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5_ib_dereg_mr+0x14/0x3b0 [mlx5_ib] Code: 48 63 cd 4c 89 f7 48 89 0c 24 e8 37 30 03 e1 48 8b 0c 24 eb a0 90 0f 1f 44 00 00 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 30 <48> 8b 2f 65 48 8b 04 25 28 00 00 00 48 89 44 24 28 31 c0 8b 87 c8 RSP: 0018:ffff88811afa3a60 EFLAGS: 00010286 RAX: 000000000000001c RBX: 0000000800000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000800000000 RBP: 0000000800000000 R08: 0000000000000000 R09: c0000000fffff7ff R10: ffff88811afa38f8 R11: ffff88811afa38f0 R12: ffffffffa02c7ac0 R13: 0000000000000000 R14: ffff88811a
c0000000fffff7ff R10: ffff88811afa38f8 R11: ffff88811afa38f0 R12: ffffffffa02c7ac0 R13: 0000000000000000 R14: ffff88811afa3cd8 R15: ffff88810772fa00 FS: 00007f47b9080740(0000) GS:ffff88852cd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000800000000 CR3: 000000010761e003 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_free_odp_mr+0x95/0xc0 [mlx5_ib] mlx5_ib_dereg_mr+0x128/0x3b0 [mlx5_ib] ib_dereg_mr_user+0x45/0xb0 [ib_core] ? xas_load+0x8/0x80 destroy_hw_idr_uobject+0x1a/0x50 [ib_uverbs] uverbs_destroy_uobject+0x2f/0x150 [
0x45/0xb0 [ib_core] ? xas_load+0x8/0x80 destroy_hw_idr_uobject+0x1a/0x50 [ib_uverbs] uverbs_destroy_uobject+0x2f/0x150 [ib_uverbs] uobj_destroy+0x3c/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x467/0xb00 [ib_uverbs] ? uverbs_finalize_object+0x60/0x60 [ib_uverbs] ? ttwu_queue_wakelist+0xa9/0xe0 ? pty_write+0x85/0x90 ? file_tty_write.isra.33+0x214/0x330 ? process_echoes+0x60/0x60 ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs] __x64_sys_ioctl+0x10d/0x8e0 ? vfs_write+0x17f/0x260 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Add the missing xarray initialization and remove the desc_size set. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git
the desc_size set. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5f6995295f65d1ee6f36d466d26afd98eb797afe - https://git.kernel.org/stable/c/5508546631a0f555d7088203dec2614e41b5106e
CVE ID: CVE-2021-47482 State: PUBLISHED Published: 2024-05-22T08:19:34.174Z Last Updated: 2025-05-04T07:12:02.779Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: batman-adv: fix error handling Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was in wrong error handling in batadv_mesh_init(). Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case of any batadv_*_init() calls failure. This approach may work well, when there is some kind of indicator, which can tell which parts of batadv are initialized; but there isn't any. All written above lead to cleaning up uninitialized fields. E
hich parts of batadv are initialized; but there isn't any. All written above lead to cleaning up uninitialized fields. Even if we hide ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1] To fix these bugs we can unwind batadv_*_init() calls one by one. It is good approach for 2 reasons: 1) It fixes bugs on error handling path 2) It improves the performance, since we won't call unneeded batadv_*_free() functions. So, this patch makes all batadv_*_init() clean up all allocated memory before returning with an error to no call correspoing batadv_*_free() and open-codes batadv_mesh_free() with proper orde
before returning with an error to no call correspoing batadv_*_free() and open-codes batadv_mesh_free() with proper order to avoid touching uninitialized fields. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73 - https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20 - https://git.kernel.org/stable/c/e50f957652190b5a88a8ebce7e5ab14ebd0d3f00 - https://git.kernel.org/stable/c/fbf150b16a3635634b7dfb7f229d8fcd643c6c51 - https://git.kernel.org/stable/c/6422e8471890273994fe8cc6d452b0dcd2c9483e - https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8
e/c/6422e8471890273994fe8cc6d452b0dcd2c9483e - https://git.kernel.org/stable/c/b0a2cd38553c77928ef1646ed1518486b1e70ae8 - https://git.kernel.org/stable/c/a8f7359259dd5923adc6129284fdad12fc5db347 - https://git.kernel.org/stable/c/6f68cd634856f8ca93bafd623ba5357e0f648c68
CVE ID: CVE-2021-47483 State: PUBLISHED Published: 2024-05-22T08:19:34.852Z Last Updated: 2025-05-04T07:12:04.209Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will be freed, so 'rbnode->block' points a freed memory, in the error handling path of regcache_rbtree_init(), 'rbnode->block' will be freed again in regcache_rbtree_exit(), KASAN will report double-free as follows: BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 Call Trace:
it(), KASAN will report double-free as follows: BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 Call Trace: slab_free_freelist_hook+0x10d/0x240 kfree+0xce/0x390 regcache_rbtree_exit+0x15d/0x1a0 regcache_rbtree_init+0x224/0x2c0 regcache_init+0x88d/0x1310 __regmap_init+0x3151/0x4a80 __devm_regmap_init+0x7d/0x100 madera_spi_probe+0x10f/0x333 [madera_spi] spi_probe+0x183/0x210 really_probe+0x285/0xc30 To fix this, moving up the assignment of rbnode->block to immediately after the reallocation has succeeded so that the data structure stays valid even if the second reallocation fails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.
allocation fails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e72dce9afbdbfa70d9b44f5908a50ff6c4858999 - https://git.kernel.org/stable/c/fc081477b47dfc3a6cb50a96087fc29674013fc2 - https://git.kernel.org/stable/c/758ced2c3878ff789801e6fee808e185c5cf08d6 - https://git.kernel.org/stable/c/3dae1a4eced3ee733d7222e69b8a55caf2d61091 - https://git.kernel.org/stable/c/1cead23c1c0bc766dacb900a3b0269f651ad596f - https://git.kernel.org/stable/c/36e911a16b377bde0ad91a8c679069d0d310b1a6 - https://git.kernel.org/stable/c/50cc1462a668dc62949a1127388bc3af785ce047 - https://git.kernel.org/stable/c/55e6d8037805b3400096d621091dfbf713f
/stable/c/50cc1462a668dc62949a1127388bc3af785ce047 - https://git.kernel.org/stable/c/55e6d8037805b3400096d621091dfbf713f97e83
CVE ID: CVE-2021-47484 State: PUBLISHED Published: 2024-05-22T08:19:35.503Z Last Updated: 2025-05-04T07:12:05.420Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Fix possible null pointer dereference. This patch fixes possible null pointer dereference in files "rvu_debugfs.c" and "rvu_nix.c" Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f1e3cd1cc80204fd02b9e9843450925a2af90dc0 - https://git.kernel.org/stable/c/c2d4c543f74c90f883e8ec62a31973ae8807d354
CVE ID: CVE-2021-47485 State: PUBLISHED Published: 2024-05-22T08:19:36.158Z Last Updated: 2025-05-04T07:12:06.695Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields Overflowing either addrlimit or bytes_togo can allow userspace to trigger a buffer overflow of kernel memory. Check for overflows in all the places doing math on user controlled buffers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0 - https://git.kernel.org/stable/c/3f57c3f67fd93b4da
s://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0 - https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad - https://git.kernel.org/stable/c/60833707b968d5ae02a75edb7886dcd4a957cf0d - https://git.kernel.org/stable/c/73d2892148aa4397a885b4f4afcfc5b27a325c42 - https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724 - https://git.kernel.org/stable/c/c3e17e58f571f34c51aeb17274ed02c2ed5cf780 - https://git.kernel.org/stable/c/0d4395477741608d123dad51def9fe50b7ebe952 - https://git.kernel.org/stable/c/d39bf40e55e666b5905fdbd46a0dced030ce87be
CVE ID: CVE-2021-47486 State: PUBLISHED Published: 2024-05-22T08:19:36.818Z Last Updated: 2025-05-04T07:12:07.846Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix potential NULL dereference The bpf_jit_binary_free() function requires a non-NULL argument. When the RISC-V BPF JIT fails to converge in NR_JIT_ITERATIONS steps, jit_data->header will be NULL, which triggers a NULL dereference. Avoid this by checking the argument, prior calling the function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cac6b043cea3e120f4fccec16f7381747cbfdc0d -
hment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cac6b043cea3e120f4fccec16f7381747cbfdc0d - https://git.kernel.org/stable/c/e1b80a5ebe5431caeb20f88c32d4a024777a2d41 - https://git.kernel.org/stable/c/27de809a3d83a6199664479ebb19712533d6fd9b
CVE ID: CVE-2021-47487 State: REJECTED Published: 2024-05-22T08:19:37.473Z Last Updated: 2024-05-28T18:59:27.726Z Description: No description available.
CVE ID: CVE-2021-47488 State: REJECTED Published: 2024-05-22T08:19:38.117Z Last Updated: 2024-12-05T13:50:30.024Z Description: No description available.
CVE ID: CVE-2021-47489 State: PUBLISHED Published: 2024-05-22T08:19:38.771Z Last Updated: 2025-11-03T19:26:39.812Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix even more out of bound writes from debugfs CVE-2021-42327 was fixed by: commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams <tdwilliamsiv@gmail.com> Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgpu: fix out of bounds write but amdgpu_dm_debugfs.c contains more of the same issue so fix the remaining ones. v2: * Add missing fix in dp_max_bpc_write (Harry Wentland) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
missing fix in dp_max_bpc_write (Harry Wentland) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1336b886b162fdc84708096ea152a61c0e1fc09c - https://git.kernel.org/stable/c/9eb4bdd554fc31a5ef6bf645a20ff21618ce45a9 - https://git.kernel.org/stable/c/3f4e54bd312d3dafb59daf2b97ffa08abebe60f5
CVE ID: CVE-2021-47490 State: PUBLISHED Published: 2024-05-22T08:19:39.424Z Last Updated: 2025-05-04T07:12:10.524Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix memleak in ttm_transfered_destroy We need to cleanup the fences for ghost objects as well. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214029 Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214447 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/132a3d998d6753047f22152731fba2b0d6b463dd - https://git.kernel.org/stable/c/0db55f9a1bafbe3dac750ea669de9134922389b5
CVE ID: CVE-2021-47491 State: PUBLISHED Published: 2024-05-22T08:19:40.101Z Last Updated: 2025-05-04T07:12:11.704Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm: khugepaged: skip huge page collapse for special files The read-only THP for filesystems will collapse THP for files opened readonly and mapped with VM_EXEC. The intended usecase is to avoid TLB misses for large text segments. But it doesn't restrict the file types so a THP could be collapsed for a non-regular file, for example, block device, if it is opened readonly and mapped with EXEC permission. This may cause bugs, like [1] and [2]. This is definitely not the i
is opened readonly and mapped with EXEC permission. This may cause bugs, like [1] and [2]. This is definitely not the intended usecase, so just collapse THP for regular files in order to close the attack surface. [shy828301@gmail.com: fix vm_file check [3]] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6d67b2a73b8e3a079c355bab3c1aef7d85a044b8 - https://git.kernel.org/stable/c/5fcb6fce74ffa614d964667110cf1a516c48c6d9 - https://git.kernel.org/stable/c/a4aeaa06d45e90f9b279f0b09de84bd00006e733
CVE ID: CVE-2021-47492 State: PUBLISHED Published: 2024-05-22T08:19:40.759Z Last Updated: 2025-05-04T07:12:12.848Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm, thp: bail out early in collapse_file for writeback page Currently collapse_file does not explicitly check PG_writeback, instead, page_has_private and try_to_release_page are used to filter writeback pages. This does not work for xfs with blocksize equal to or larger than pagesize, because in such case xfs has no page->private. This makes collapse_file bail out early for writeback page. Otherwise, xfs end_page_writeback will panic as follows. page:fffffe00201bcc80 r
file bail out early for writeback page. Otherwise, xfs end_page_writeback will panic as follows. page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:ffff0003f88c86a8 index:0x0 pfn:0x84ef32 aops:xfs_address_space_operations [xfs] ino:30000b7 dentry name:"libtest.so" flags: 0x57fffe0000008027(locked|referenced|uptodate|active|writeback) raw: 57fffe0000008027 ffff80001b48bc28 ffff80001b48bc28 ffff0003f88c86a8 raw: 0000000000000000 0000000000000000 00000000ffffffff ffff0000c3e9a000 page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u)) page->mem_cgroup:ffff0000c3e9a000 ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:1212! Internal error: O
em_cgroup:ffff0000c3e9a000 ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:1212! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: BUG: Bad page state in process khugepaged pfn:84ef32 xfs(E) page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:0 index:0x0 pfn:0x84ef32 libcrc32c(E) rfkill(E) aes_ce_blk(E) crypto_simd(E) ... CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Tainted: ... pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) Call trace: end_page_writeback+0x1c0/0x214 iomap_finish_page_writeback+0x13c/0x204 iomap_finish_ioend+0xe8/0x19c iomap_writepage_end_bio+0x38/0x50 bio_endio+0x168/0x1ec blk_update_request+0x278/0x3f0 blk_mq_end_request+0x34/0x15c virt
omap_writepage_end_bio+0x38/0x50 bio_endio+0x168/0x1ec blk_update_request+0x278/0x3f0 blk_mq_end_request+0x34/0x15c virtblk_request_done+0x38/0x74 [virtio_blk] blk_done_softirq+0xc4/0x110 __do_softirq+0x128/0x38c __irq_exit_rcu+0x118/0x150 irq_exit+0x1c/0x30 __handle_domain_irq+0x8c/0xf0 gic_handle_irq+0x84/0x108 el1_irq+0xcc/0x180 arch_cpu_idle+0x18/0x40 default_idle_call+0x4c/0x1a0 cpuidle_idle_call+0x168/0x1e0 do_idle+0xb4/0x104 cpu_startup_entry+0x30/0x9c secondary_start_kernel+0x104/0x180 Code: d4210000 b0006161 910c8021 94013f4d (d4210000) ---[ end trace 4a88c6a074082f8c ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt Additional Analyst Notes: - CISA ADP Vulnr
f8c ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/69a7fa5cb0de06c8956b040f19a7248c8c8308ca - https://git.kernel.org/stable/c/5e669d8ab30ab61dec3c36e27b4711f07611e6fc - https://git.kernel.org/stable/c/74c42e1baacf206338b1dd6b6199ac964512b5bb
CVE ID: CVE-2021-47493 State: PUBLISHED Published: 2024-05-22T08:19:41.419Z Last Updated: 2025-05-04T07:12:14.085Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix race between searching chunks and release journal_head from buffer_head Encountered a race between ocfs2_test_bg_bit_allocatable() and jbd2_journal_put_journal_head() resulting in the below vmcore. PID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: "loop3" Call trace: panic oops_end no_context __bad_area_nosemaphore bad_area_nosemaphore __do_page_fault do_page_fault page_fault [exception RIP: ocfs2_block_group_find_clear_bits+316] ocfs2_block_group_find_clea
o_page_fault do_page_fault page_fault [exception RIP: ocfs2_block_group_find_clear_bits+316] ocfs2_block_group_find_clear_bits [ocfs2] ocfs2_cluster_group_search [ocfs2] ocfs2_search_chain [ocfs2] ocfs2_claim_suballoc_bits [ocfs2] __ocfs2_claim_clusters [ocfs2] ocfs2_claim_clusters [ocfs2] ocfs2_local_alloc_slide_window [ocfs2] ocfs2_reserve_local_alloc_bits [ocfs2] ocfs2_reserve_clusters_with_limit [ocfs2] ocfs2_reserve_clusters [ocfs2] ocfs2_lock_refcount_allocators [ocfs2] ocfs2_make_clusters_writable [ocfs2] ocfs2_replace_cow [ocfs2] ocfs2_refcount_cow [ocfs2] ocfs2_file_write_iter [ocfs2] lo_rw_aio loop_queue_work kthread_worker_fn kthread ret_from_fork When ocfs2_test_bg_bit_allocatabl
e_write_iter [ocfs2] lo_rw_aio loop_queue_work kthread_worker_fn kthread ret_from_fork When ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the bg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and released the jounal head from the buffer head. Needed to take bit lock for the bit 'BH_JournalHead' to fix this race. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5043fbd294f5909a080ade0f04b70a4da9e122b7 - https://git.kernel.org/stable/c/2e382600e8856ea654677b5134ee66e03ea72bc2 - https://git.kernel.org/stable/c/6f1b228529ae49b0f85ab89bcdb6c365df401558
CVE ID: CVE-2021-47494 State: PUBLISHED Published: 2024-05-22T08:19:42.083Z Last Updated: 2025-05-04T07:12:15.133Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix management registrations locking The management registrations locking was broken, the list was locked for each wdev, but cfg80211_mgmt_registrations_update() iterated it without holding all the correct spinlocks, causing list corruption. Rather than trying to fix it with fine-grained locking, just move the lock to the wiphy/rdev (still need the list on each wdev), we already need to hold the wdev lock to change it, so there's no contention on the lock in
eed the list on each wdev), we already need to hold the wdev lock to change it, so there's no contention on the lock in any case. This trivially fixes the bug since we hold one wdev's lock already, and now will hold the lock that protects all lists. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4c22227e39c7a0b4dab55617ee8d34d171fab8d4 - https://git.kernel.org/stable/c/3c897f39b71fe68f90599f6a45b5f7bf5618420e - https://git.kernel.org/stable/c/09b1d5dc6ce1c9151777f6c4e128a59457704c97
CVE ID: CVE-2021-47495 State: PUBLISHED Published: 2024-05-22T08:19:42.732Z Last Updated: 2025-05-04T07:12:16.623Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usbnet: sanity check for maxpacket maxpacket of 0 makes no sense and oopses as we need to divide by it. Give up. V2: fixed typo in log and stylistic issues Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b9eba0a4a527e04d712f0e0401e5391ef124b33e - https://git.kernel.org/stable/c/524f333e98138d909a0a0c574a9ff6737dce2767 - https://git.kernel.org/stable/c/74b3b27cf9fecce00cd8918b7882fd81191d0aa4 - ht
524f333e98138d909a0a0c574a9ff6737dce2767 - https://git.kernel.org/stable/c/74b3b27cf9fecce00cd8918b7882fd81191d0aa4 - https://git.kernel.org/stable/c/002d82227c0abe29118cf80f7e2f396b22d448ed - https://git.kernel.org/stable/c/492140e45d2bf27c1014243f8616a9b612144e20 - https://git.kernel.org/stable/c/693ecbe8f799405f8775719deedb1f76265d375a - https://git.kernel.org/stable/c/7e8b6a4f18edee070213cb6a77118e8a412253c5 - https://git.kernel.org/stable/c/397430b50a363d8b7bdda00522123f82df6adc5e
CVE ID: CVE-2021-47496 State: PUBLISHED Published: 2024-05-22T08:19:43.489Z Last Updated: 2025-05-04T07:12:17.959Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix flipped sign in tls_err_abort() calls sk->sk_err appears to expect a positive value, a convention that ktls doesn't always follow and that leads to memory corruption in other code. For instance, [kworker] tls_encrypt_done(..., err=<negative error from crypto request>) tls_err_abort(.., err) sk->sk_err = err; [task] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk->sk_err) { ret = -sk->sk_err; // ret is positive splice_from_pipe_feed (continued) ret = ac
.. tls_sw_do_sendpage if (sk->sk_err) { ret = -sk->sk_err; // ret is positive splice_from_pipe_feed (continued) ret = actor(...) // ret is still positive and interpreted as bytes // written, resulting in underflow of buf->len and // sd->len, leading to huge buf->offset and bogus // addresses computed in later calls to actor() Fix all tls_err_abort() callers to pass a negative error code consistently and centralize the error-prone sign flip there, throwing in a warning to catch future misuse and uninlining the function so it really does only warn once. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e0cfd5159f314d6b304d
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e0cfd5159f314d6b304d030363650b06a2299cbb - https://git.kernel.org/stable/c/f3dec7e7ace38224f82cf83f0049159d067c2e19 - https://git.kernel.org/stable/c/e41473543f75f7dbc5d605007e6f883f1bd13b9a - https://git.kernel.org/stable/c/da353fac65fede6b8b4cfe207f0d9408e3121105
CVE ID: CVE-2021-47497 State: PUBLISHED Published: 2024-05-22T08:19:44.144Z Last Updated: 2025-05-04T07:12:19.190Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells If a cell has 'nbits' equal to a multiple of BITS_PER_BYTE the logic *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0); will become undefined behavior because nbits modulo BITS_PER_BYTE is 0, and we subtract one from that making a large number that is then shifted more than the number of bits that fit into an unsigned long. UBSAN reports this problem: UBSAN: shift-out-of-bounds in drivers/nvmem/core.c:1386:8 sh
that fit into an unsigned long. UBSAN reports this problem: UBSAN: shift-out-of-bounds in drivers/nvmem/core.c:1386:8 shift exponent 64 is too large for 64-bit type 'unsigned long' CPU: 6 PID: 7 Comm: kworker/u16:0 Not tainted 5.15.0-rc3+ #9 Hardware name: Google Lazor (rev3+) with KB Backlight (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x0/0x170 show_stack+0x24/0x30 dump_stack_lvl+0x64/0x7c dump_stack+0x18/0x38 ubsan_epilogue+0x10/0x54 __ubsan_handle_shift_out_of_bounds+0x180/0x194 __nvmem_cell_read+0x1ec/0x21c nvmem_cell_read+0x58/0x94 nvmem_cell_read_variable_common+0x4c/0xb0 nvmem_cell_read_variable_le_u32+0x40/0x100 a6xx_gpu_init+0x170/0x2f4 adren