Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rksRepairing). CVE: CVE-2024-8805 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/baaa50c6f91ea5a9c7503af51f2bc50e6568b66b - https://git.kernel.org/stable/c/22b49d6e4f399a390c70f3034f5fbacbb9413858 - https://git.kernel.org/stable/c/d17c631ba04e960eb6f8728b10d585de20ac4f71 - https://git.kernel.org/stable/c/830c03e58beb70b99349760f822e505ecb4eeb7e - https://git.kernel.org/stable/c/ad7adfb95f64a761e4784381e47bee1a362eb30d - https://git.kernel.org/stable/c/5291ff856d2c5177b4fe9c18828312be30213193 - https://git.kernel.org/stable/c/b25e11f978b63cb7857890edb3a698599cddb10e - https://www.zerodayinitiative.com/advisories/ZDI-24-1229/
CVE ID: CVE-2024-53145 State: PUBLISHED Published: 2024-12-24T11:28:46.113Z Last Updated: 2025-11-03T20:46:27.001Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: um: Fix potential integer overflow during physmem setup This issue happens when the real map size is greater than LONG_MAX, which can be easily triggered on UML/i386. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5c710f45811e7e2bfcf703980c306f19c7e1ecfe - https://git.kernel.org/stable/c/e6102b72edc4eb8c0858df00ba74b5ce579c8fa2 - https://git.kernel.org/stable/c/1bd118c5f887802cef2d9ba0d191725866
g/stable/c/e6102b72edc4eb8c0858df00ba74b5ce579c8fa2 - https://git.kernel.org/stable/c/1bd118c5f887802cef2d9ba0d1917258667f1cae - https://git.kernel.org/stable/c/1575df968650d11771359e5ac78278c5b0cc19f3 - https://git.kernel.org/stable/c/a875c023155ea92b75d6323977003e64d92ae7fc - https://git.kernel.org/stable/c/d1a211e5210d31da8f49fc0021bf7129b726468c - https://git.kernel.org/stable/c/a9c95f787b88b29165563fd97761032db77116e7 - https://git.kernel.org/stable/c/a98b7761f697e590ed5d610d87fa12be66f23419
CVE ID: CVE-2024-53146 State: PUBLISHED Published: 2024-12-24T11:28:46.883Z Last Updated: 2025-11-03T20:46:29.848Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/745f7ce5a95e783ba62fe774325829466aec2aa8 - https://
CVE Program Container: References: - https://git.kernel.org/stable/c/745f7ce5a95e783ba62fe774325829466aec2aa8 - https://git.kernel.org/stable/c/90adbae9dd158da8331d9fdd32077bd1af04f553 - https://git.kernel.org/stable/c/3c5f545c9a1f8a1869246f6f3ae8c17289d6a841 - https://git.kernel.org/stable/c/842f1c27a1aef5367e535f9e85c8c3b06352151a - https://git.kernel.org/stable/c/de53c5305184ca1333b87e695d329d1502d694ce - https://git.kernel.org/stable/c/dde654cad08fdaac370febb161ec41eb58e9d2a2 - https://git.kernel.org/stable/c/084f797dbc7e52209a4ab6dbc7f0109268754eb9 - https://git.kernel.org/stable/c/ccd3394f9a7200d6b088553bf38e688620cd27af - https://git.kernel.org/stable/c/7f33b92e5b18e904a481e6e208486da
.org/stable/c/ccd3394f9a7200d6b088553bf38e688620cd27af - https://git.kernel.org/stable/c/7f33b92e5b18e904a481e6e208486da43e4dc841
CVE ID: CVE-2024-53147 State: PUBLISHED Published: 2024-12-24T11:28:47.695Z Last Updated: 2025-10-01T20:17:09.224Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: exfat: fix out-of-bounds access of directory entries In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei->hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption. This commit adds a check for start_clu, if it is an invalid cluster, the file or direc
e further file system corruption. This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a0120d6463368378539ef928cf067d02372efb8c - https://git.kernel.org/stable/c/3ddd1cb2b458ff6a193bc845f408dfff217db29e - https://git.kernel.org/stable/c/184fa506e392eb78364d9283c961217ff2c0617b
CVE ID: CVE-2024-53148 State: PUBLISHED Published: 2024-12-24T11:28:48.619Z Last Updated: 2025-11-03T20:46:32.627Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: comedi: Flush partial mappings in error case If some remap_pfn_range() calls succeeded before one failed, we still have buffer pages mapped into the userspace page tables when we drop the buffer reference with comedi_buf_map_put(bm). The userspace mappings are only cleaned up later in the mmap error path. Fix it by explicitly flushing all mappings in our VMA on the error path. See commit 79a61cc3fc04 ("mm: avoid leaving partial pfn mappings around in error case"). Addi
our VMA on the error path. See commit 79a61cc3fc04 ("mm: avoid leaving partial pfn mappings around in error case"). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/57f048c2d205b85e34282a9b0b0ae177e84c2f44 - https://git.kernel.org/stable/c/b9322408d83accc8b96322bc7356593206288c56 - https://git.kernel.org/stable/c/8797b7712de704dc231f9e821d8eb3b9aeb3a032 - https://git.kernel.org/stable/c/16c507df509113c037cdc0ba642b9ab3389bd26c - https://git.kernel.org/stable/c/9b07fb464eb69a752406e78e62ab3a60bfa7b00d - https://git.kernel.org/stable/c/c6963a06ce5c61d3238751ada04ee1569663a828 - https://git.kernel.org/stable/c/297f14fbb81895f4ccdb0ad25d196786d6461
table/c/c6963a06ce5c61d3238751ada04ee1569663a828 - https://git.kernel.org/stable/c/297f14fbb81895f4ccdb0ad25d196786d6461e00 - https://git.kernel.org/stable/c/ce8f9fb651fac95dd41f69afe54d935420b945bd
CVE ID: CVE-2024-53149 State: PUBLISHED Published: 2024-12-24T11:28:49.432Z Last Updated: 2025-05-04T09:54:17.480Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix off-by-one in connector_status UCSI connector's indices start from 1 up to 3, PMIC_GLINK_MAX_PORTS. Correct the condition in the pmic_glink_ucsi_connector_status() callback, fixing Type-C orientation reporting for the third USB-C connector. References: - https://git.kernel.org/stable/c/8a2273e5c1beb285729aa001422967b4711c53fe - https://git.kernel.org/stable/c/9a5a8b5bd72169aa7a8ec800ef57be2f2cb4d9b2 - https://git.kernel.org/stable/c/6ba6f7f
3fe - https://git.kernel.org/stable/c/9a5a8b5bd72169aa7a8ec800ef57be2f2cb4d9b2 - https://git.kernel.org/stable/c/6ba6f7f29e0dff47a2799e60dcd1b5c29cd811a5 - https://git.kernel.org/stable/c/4a22918810980897393fa1776ea3877e4baf8cca
CVE ID: CVE-2024-53150 State: PUBLISHED Published: 2024-12-24T11:28:50.175Z Last Updated: 2025-11-03T20:46:35.493Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skippe
validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a632bdcb359fd8145e86486ff8612da98e239acd - https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b - https://git
59fd8145e86486ff8612da98e239acd - https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b - https://git.kernel.org/stable/c/ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9 - https://git.kernel.org/stable/c/da13ade87a12dd58829278bc816a61bea06a56a9 - https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77 - https://git.kernel.org/stable/c/ea0fa76f61cf8e932d1d26e6193513230816e11d - https://git.kernel.org/stable/c/096bb5b43edf755bc4477e64004fa3a20539ec2f - https://git.kernel.org/stable/c/a3dd4d63eeb452cfb064a13862fb376ab108f6a6
CVE ID: CVE-2024-53151 State: PUBLISHED Published: 2024-12-24T11:28:50.917Z Last Updated: 2025-11-03T20:46:36.897Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: svcrdma: Address an integer overflow Dan Carpenter reports: > Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data > structure") from Jun 22, 2020 (linux-next), leads to the following > Smatch static checker warning: > > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk() > warn: potential user controlled sizeof overflow 'segcount * 4 * 4' > > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c > 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_c
ount * 4 * 4' > > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c > 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt) > 489 { > 490 u32 segcount; > 491 __be32 *p; > 492 > 493 if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount)) > ^^^^^^^^ > > 494 return false; > 495 > 496 /* A bogus segcount causes this buffer overflow check to fail. */ > 497 p = xdr_inline_decode(&rctxt->rc_stream, > --> 498 segcount * rpcrdma_segment_maxsz * sizeof(*p)); > > > segcount is an untrusted u32. On 32bit systems anything >= SIZE_MAX / 16 will > have an integer overflow and some those values will be accepted by > xdr_inline_decode(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progr
e those values will be accepted by > xdr_inline_decode(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b - https://git.kernel.org/stable/c/c1f8195bf68edd2cef0f18a4cead394075a54b5a - https://git.kernel.org/stable/c/838dd342962cef4c320632a5af48d3c31f2f9877 - https://git.kernel.org/stable/c/4cbc3ba6dc2f746497cade60bcbaa82ae3696689 - https://git.kernel.org/stable/c/e5c440c227ecdc721f2da0dd88b6358afd1031a7 - https://git.kernel.org/stable/c/3c63d8946e578663b868cb9912dac616ea68bfd0
CVE ID: CVE-2024-53152 State: PUBLISHED Published: 2024-12-24T11:28:51.610Z Last Updated: 2025-05-04T09:54:22.364Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF deinit notify function pci_epc_deinit_notify() are called during the execution of pex_ep_event_pex_rst_assert() i.e., when the host has asserted PERST#. But quickly after this step, refclk will also be disabled by the host. All of the tegra194 endpoint SoCs supported as of now depend on the refclk from the host for keeping the
ed by the host. All of the tegra194 endpoint SoCs supported as of now depend on the refclk from the host for keeping the controller operational. Due to this limitation, any access to the hardware registers in the absence of refclk will result in a whole endpoint crash. Unfortunately, most of the controller cleanups require accessing the hardware registers (like eDMA cleanup performed in dw_pcie_ep_cleanup(), etc...). So these cleanup functions can cause the crash in the endpoint SoC once host asserts PERST#. One way to address this issue is by generating the refclk in the endpoint itself and not depending on the host. But that is not always possible as some of the endpoint designs do require
ndpoint itself and not depending on the host. But that is not always possible as some of the endpoint designs do require the endpoint to consume refclk from the host. Thus, fix this crash by moving the controller cleanups to the start of the pex_ep_event_pex_rst_deassert() function. This function is called whenever the host has deasserted PERST# and it is guaranteed that the refclk would be active at this point. So at the start of this function (after enabling resources) the controller cleanup can be performed. Once finished, rest of the code execution for PERST# deassert can continue as usual. References: - https://git.kernel.org/stable/c/70212c2300971506e986d95000d2745529cac9d7 - https://g
an continue as usual. References: - https://git.kernel.org/stable/c/70212c2300971506e986d95000d2745529cac9d7 - https://git.kernel.org/stable/c/72034050ccf4202cd6558b0afd2474f756ea3b9b - https://git.kernel.org/stable/c/40e2125381dc11379112485e3eefdd25c6df5375
CVE ID: CVE-2024-53153 State: PUBLISHED Published: 2024-12-24T11:28:52.518Z Last Updated: 2025-05-04T09:54:23.958Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF deinit notify function pci_epc_deinit_notify() are called during the execution of qcom_pcie_perst_assert() i.e., when the host has asserted PERST#. But quickly after this step, refclk will also be disabled by the host. All of the Qcom endpoint SoCs supported as of now depend on the refclk from the host for keeping the controller ope
ost. All of the Qcom endpoint SoCs supported as of now depend on the refclk from the host for keeping the controller operational. Due to this limitation, any access to the hardware registers in the absence of refclk will result in a whole endpoint crash. Unfortunately, most of the controller cleanups require accessing the hardware registers (like eDMA cleanup performed in dw_pcie_ep_cleanup(), powering down MHI EPF etc...). So these cleanup functions are currently causing the crash in the endpoint SoC once host asserts PERST#. One way to address this issue is by generating the refclk in the endpoint itself and not depending on the host. But that is not always possible as some of the endpoint
the refclk in the endpoint itself and not depending on the host. But that is not always possible as some of the endpoint designs do require the endpoint to consume refclk from the host (as I was told by the Qcom engineers). Thus, fix this crash by moving the controller cleanups to the start of the qcom_pcie_perst_deassert() function. qcom_pcie_perst_deassert() is called whenever the host has deasserted PERST# and it is guaranteed that the refclk would be active at this point. So at the start of this function (after enabling resources), the controller cleanup can be performed. Once finished, rest of the code execution for PERST# deassert can continue as usual. References: - https://git.kernel
d. Once finished, rest of the code execution for PERST# deassert can continue as usual. References: - https://git.kernel.org/stable/c/e03b5f1615c84f4139cb53ef8659f4cdb8d6a563 - https://git.kernel.org/stable/c/516969d5765e2302d33b4f251496eedb757d55ea - https://git.kernel.org/stable/c/7d7cf89b119af433354f865fc01017b9f8aa411a
CVE ID: CVE-2024-53154 State: PUBLISHED Published: 2024-12-24T11:28:53.424Z Last Updated: 2025-11-03T20:46:38.309Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: clk-apple-nco: Add NULL check in applnco_probe Add NULL check in applnco_probe, to handle kernel NULL pointer dereference error. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9a5905b725739af6a105f9e564e7c80d69969d2b - https://git.kernel.org/stable/c/72ea9a7e9e260aa39f9d1c9254cf92adfb05c4f5 - https://git.kernel.org/stable/c/066c14619e8379c1bafbbf8196fd38eac303472b - https://git.kernel.org/s
9254cf92adfb05c4f5 - https://git.kernel.org/stable/c/066c14619e8379c1bafbbf8196fd38eac303472b - https://git.kernel.org/stable/c/534e02f83889ccef5fe6beb46e773ab9d4ae1655 - https://git.kernel.org/stable/c/969c765e2b508cca9099d246c010a1e48dcfd089
CVE ID: CVE-2024-53155 State: PUBLISHED Published: 2024-12-24T11:28:54.241Z Last Updated: 2025-11-03T20:46:41.159Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix uninitialized value in ocfs2_file_read_iter() Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4/0xf80 __io_read+0x8d4/0x20f0 io_read+0x3e/0xf0 io_issue_sqe+0x42b/0x22c0 io_wq_submit_work+0xaf9/0xdc0 io_worker_handle_work+0xd13/0x2110 io_wq_worker+0x447/0x1410 ret_from_fork+0x6f/0x90 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pag
10 ret_from_fork+0x6f/0x90 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 alloc_pages_noprof+0x1bf/0x1e0 allocate_slab+0x33a/0x1250 ___slab_alloc+0x12ef/0x35e0 kmem_cache_alloc_bulk_noprof+0x486/0x1330 __io_alloc_req_refill+0x84/0x560 io_submit_sqes+0x172f/0x2f30 __se_sys_io_uring_enter+0x406/0x41c0 __x64_sys_io_uring_enter+0x11f/0x1a0 x64_sys_call+0x2b54/0x3ba0 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Since an instance of 'struct kiocb' may be passed from the block layer with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' and use it from where 'ocfs2_dio_end_io()' might
'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in 'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6c8f8d1e595dabd5389817f6d798cc8bd95c40ab - https://git.kernel.org/stable/c/f4078ef38d3163e6be47403a619558b19c4bfccd - https://git.kernel.org/stable/c/66b7ddd1804e2c4216dd7ead8eeb746cdbb3b62f - https://git.kernel.org/stable/c/8c966150d5abff58c3c2bdb9a6e63fd773782905 - https://git.kernel.org/stable/c/83f8713a0ef1d55d6a287bcfadcaab8245ac5098 - https://git.kernel.org/stable/c/8e0de82e
05 - https://git.kernel.org/stable/c/83f8713a0ef1d55d6a287bcfadcaab8245ac5098 - https://git.kernel.org/stable/c/8e0de82ed18ba0e71f817adbd81317fd1032ca5a - https://git.kernel.org/stable/c/366c933c2ab34dd6551acc03b4872726b7605143 - https://git.kernel.org/stable/c/dc78efe556fed162d48736ef24066f42e463e27c - https://git.kernel.org/stable/c/adc77b19f62d7e80f98400b2fca9d700d2afdd6f
CVE ID: CVE-2024-53156 State: PUBLISHED Published: 2024-12-24T11:28:55.275Z Last Updated: 2025-11-03T20:46:44.047Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 index 255 is out of range for type 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <TASK> dump_st
(i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <TASK> dump_stack_lvl+0x180/0x1b0 __ubsan_handle_out_of_bounds+0xd4/0x130 htc_issue_send.constprop.0+0x20c/0x230 ? _raw_spin_unlock_irqrestore+0x3c/0x70 ath9k_wmi_cmd+0x41d/0x610 ? mark_held_locks+0x9f/0xe0 ... Since this bug has been confirmed to be caused by insufficient verification of conn_rsp_epid, I think it would be appropriate to add a range check for conn_rsp_epid to htc_connect_service() to prevent the bug from occurring. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5f177fb9d01355ac183e65ad8909ea8ef734
ulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5f177fb9d01355ac183e65ad8909ea8ef734e0cf - https://git.kernel.org/stable/c/cb480ae80fd4d0f1ac9e107ce799183beee5124b - https://git.kernel.org/stable/c/c941af142200d975dd3be632aeb490f4cb91dae4 - https://git.kernel.org/stable/c/8965db7fe2e913ee0802b05fc94c6d6aa74e0596 - https://git.kernel.org/stable/c/70eae50d2156cb6e078d0d78809b49bf2f4c7540 - https://git.kernel.org/stable/c/b6551479daf2bfa80bfd5d9016b02a810e508bfb - https://git.kernel.org/stable/c/3fe99b9690b99606d3743c9961ebee865cfa1ab8 - https://git.kernel.org/stable/c/bc981179ab5d1a2715f35e3db4e4bb822bacc849 - https://git.kernel.org/stable/c/8619593634cbdf5a
ps://git.kernel.org/stable/c/bc981179ab5d1a2715f35e3db4e4bb822bacc849 - https://git.kernel.org/stable/c/8619593634cbdf5abf43f5714df49b04e4ef09ab
CVE ID: CVE-2024-53157 State: PUBLISHED Published: 2024-12-24T11:28:56.218Z Last Updated: 2025-11-03T20:46:47.001Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero. dvfs_info.opp_count may be zero on some platforms during the reboot test, and the kernel will crash after dereferencing the pointer to kcalloc(info->count, sizeof(*opp), GFP_KERNEL). | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 | Mem abort info: | ESR = 0x96000004 |
ble to handle kernel NULL pointer dereference at virtual address 0000000000000028 | Mem abort info: | ESR = 0x96000004 | Exception class = DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | Data abort info: | ISV = 0, ISS = 0x00000004 | CM = 0, WnR = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c | [0000000000000028] pgd=0000000000000000 | Internal error: Oops: 96000004 [#1] SMP | scpi-hwmon: probe of PHYT000D:00 failed with error -110 | Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c) | CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1 | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS | pstate: 60000005
d-udevd Not tainted 4.19.90+ #1 | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS | pstate: 60000005 (nZCv daif -PAN -UAO) | pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | lr : clk_register+0x438/0x720 | Call trace: | scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | devm_clk_hw_register+0x50/0xa0 | scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi] | scpi_clocks_probe+0x528/0x70c [clk_scpi] | platform_drv_probe+0x58/0xa8 | really_probe+0x260/0x3d0 | driver_probe_device+0x12c/0x148 | device_driver_attach+0x74/0x98 | __driver_attach+0xb4/0xe8 | bus_for_each_dev+0x88/0xe0 | driver_attach+0x30/0x40 | bus_add_driver+0x178/0x2b0 | driver_register+0x64/0x118 | __platform_driver_regist
0x88/0xe0 | driver_attach+0x30/0x40 | bus_add_driver+0x178/0x2b0 | driver_register+0x64/0x118 | __platform_driver_register+0x54/0x60 | scpi_clocks_driver_init+0x24/0x1000 [clk_scpi] | do_one_initcall+0x54/0x220 | do_init_module+0x54/0x1c8 | load_module+0x14a4/0x1668 | __se_sys_finit_module+0xf8/0x110 | __arm64_sys_finit_module+0x24/0x30 | el0_svc_common+0x78/0x170 | el0_svc_handler+0x38/0x78 | el0_svc+0x8/0x340 | Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820) | ---[ end trace 06feb22469d89fa8 ]--- | Kernel panic - not syncing: Fatal exception | SMP: stopping secondary CPUs | Kernel Offset: disabled | CPU features: 0x10,a0002008 | Memory Limit: none Additional Analyst Notes: - CISA ADP