Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
re/datagram.c:533 skb_copy_datagram_msg include/linux/skbuff.h:3696 [inline] netlink_recvmsg+0x669/0x1c80 net/netlink/af_netlink.c:1977 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] __sys_recvfrom+0x795/0xa10 net/socket.c:2097 __do_sys_recvfrom net/socket.c:2115 [inline] __se_sys_recvfrom net/socket.c:2111 [inline] __x64_sys_recvfrom+0x19d/0x210 net/socket.c:2111 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slub.c:3247 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/sl
alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slub.c:3247 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4975 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1158 [inline] netlink_dump+0x3e5/0x16c0 net/netlink/af_netlink.c:2248 __netlink_dump_start+0xcf8/0xe90 net/netlink/af_netlink.c:2373 netlink_dump_start include/linux/netlink.h:254 [inline] inet_diag_handler_cmd+0x2e7/0x400 net/ipv4/inet_diag.c:1341 sock_diag_rcv_msg+0x24a/0x620 netlink_rcv_skb+0x40c/0x7e0 net/netlink/af_netlink.c:2494 sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:277 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inli
tlink.c:2494 sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:277 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x1093/0x1360 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x14d9/0x1720 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] sock_write_iter+0x594/0x690 net/socket.c:1061 do_iter_readv_writev+0xa7f/0xc70 do_iter_write+0x52c/0x1500 fs/read_write.c:851 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86
] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Bytes 68-71 of 2508 are uninitialized Memory access of size 2508 starts at ffff888114f9b000 Data copied to user address 00007f7fe09ff2e0 CPU: 1 PID: 3478 Comm: syz-executor306 Not tainted 5.17.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3fc0fd724d199e061432b66a8d85b7d48fe4
m Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3fc0fd724d199e061432b66a8d85b7d48fe485f7 - https://git.kernel.org/stable/c/41a2864cf719c17294f417726edd411643462ab8 - https://git.kernel.org/stable/c/2d8fa3fdf4542a2174a72d92018f488d65d848c5 - https://git.kernel.org/stable/c/bbf59d7ae558940cfa2b36a287fd1e88d83f89f8 - https://git.kernel.org/stable/c/b7e4d9ba2ddb78801488b4c623875b81fb46b545 - https://git.kernel.org/stable/c/1502f15b9f29c41883a6139f2923523873282a83 - https://git.kernel.org/stable/c/d828b0fe6631f3ae8709ac9a10c77c5836c76a08 - https://git.kernel.org/stable/c/633593a808980f82d251d0ca89730d8bb8b0220c
CVE ID: CVE-2022-48856 State: PUBLISHED Published: 2024-07-16T12:25:21.804Z Last Updated: 2025-05-04T08:24:48.987Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gianfar: ethtool: Fix refcount leak in gfar_get_ts_info The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6263f2eb93a85ad7df504daf0c341a7fb6bbe8a6 - https://git.kernel.org/stable/c/f7b3b520349193f8a82cca74daf36619
org/stable/c/6263f2eb93a85ad7df504daf0c341a7fb6bbe8a6 - https://git.kernel.org/stable/c/f7b3b520349193f8a82cca74daf366199e06add9 - https://git.kernel.org/stable/c/21044e679ed535345042d2023f7df0ca8e897e2a - https://git.kernel.org/stable/c/f49f646f9ec296fc0afe7ae92c2bb47f23e3846c - https://git.kernel.org/stable/c/0e1b9a2078e07fb1e6e91bf8badfd89ecab1e848 - https://git.kernel.org/stable/c/2ac5b58e645c66932438bb021cb5b52097ce70b0
CVE ID: CVE-2022-48857 State: PUBLISHED Published: 2024-07-16T12:25:22.464Z Last Updated: 2025-05-04T08:24:50.329Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe function. port100_send_complete() accesses devm allocated memory which will be freed on probe failure. We should kill this urbs before returning an error from probe function to prevent reported use-after-free Fail log: BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 d
function to prevent reported use-after-free Fail log: BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26 ... Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670 ... Allocated by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set
/0x5c0 drivers/usb/core/hcd.c:1670 ... Allocated by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524 alloc_dr drivers/base/devres.c:116 [inline] devm_kmalloc+0x96/0x1d0 drivers/base/devres.c:823 devm_kzalloc include/linux/device.h:209 [inline] port100_probe+0x8a/0x1320 drivers/nfc/port100.c:1502 Freed by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/g
k+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0xff/0x140 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [inline] __cache_free mm/slab.c:3437 [inline] kfree+0xf8/0x2b0 mm/slab.c:3794 release_nodes+0x112/0x1a0 drivers/base/devres.c:501 devres_release_all+0x114/0x190 drivers/base/devres.c:530 really_probe+0x626/0xcc0 drivers/base/dd.c:670 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/205c4ec78e71cbf561794e6043da80e7bae6790f - https://git.kernel.org
ichment: References: - https://git.kernel.org/stable/c/205c4ec78e71cbf561794e6043da80e7bae6790f - https://git.kernel.org/stable/c/32e866ae5a7af590597ef4bcff8451bf96d5f980 - https://git.kernel.org/stable/c/b1db33d4e54bc35d8db96ce143ea0ef92e23d58e - https://git.kernel.org/stable/c/cd2a5c0da0d1ddf11d1f84e9c9b1949f50f6e161 - https://git.kernel.org/stable/c/2b1c85f56512d49e43bc53741fce2f508cd90029 - https://git.kernel.org/stable/c/0e721b8f2ee5e11376dd55363f9ccb539d754b8a - https://git.kernel.org/stable/c/7194737e1be8fdc89d2a9382bd2f371f7ee2eda8 - https://git.kernel.org/stable/c/f80cfe2f26581f188429c12bd937eb905ad3ac7b
CVE ID: CVE-2022-48858 State: PUBLISHED Published: 2024-07-16T12:25:23.123Z Last Updated: 2025-05-04T12:43:50.438Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix a race on command flush flow Fix a refcount use after free warning due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The process which handles commands flush may see this command as needed to be flushed if the other process released its refcount but didn't release the index yet. Fix it by a
command as needed to be flushed if the other process released its refcount but didn't release the index yet. Fix it by adding the needed spin lock. It fixes the following warning trace: refcount_t: addition on 0; use-after-free. WARNING: CPU: 11 PID: 540311 at lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0 ... RIP: 0010:refcount_warn_saturate+0x80/0xe0 ... Call Trace: <TASK> mlx5_cmd_trigger_completions+0x293/0x340 [mlx5_core] mlx5_cmd_flush+0x3a/0xf0 [mlx5_core] enter_error_state+0x44/0x80 [mlx5_core] mlx5_fw_fatal_reporter_err_work+0x37/0xe0 [mlx5_core] process_one_work+0x1be/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x141/0x160 ? set_kthread_struct+0x40/0x40
rk+0x1be/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x141/0x160 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 </TASK> Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1a4017926eeea56c7540cc41b42106746ee8a0ee - https://git.kernel.org/stable/c/f3331bc17449f15832c31823f27573f4c0e13e5f - https://git.kernel.org/stable/c/7c519f769f555ff7d9d4ccba3497bbb589df360a - https://git.kernel.org/stable/c/0401bfb27a91d7bdd74b1635c1aae57cbb128da6 - https://git.kernel.org/stable/c/063bd355595428750803d8736a9bb7c8db67d42d
CVE ID: CVE-2022-48859 State: PUBLISHED Published: 2024-07-16T12:25:23.799Z Last Updated: 2025-05-04T08:24:52.779Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_put() to aovid the refcount leak. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b7c2fd1d126329340639adfb8dd2938fe4b65df7 - https://git.kernel.org/stable/c/4cc66bf17220ff9631f9fa99b02a872e0ad5a08b - https://gi
126329340639adfb8dd2938fe4b65df7 - https://git.kernel.org/stable/c/4cc66bf17220ff9631f9fa99b02a872e0ad5a08b - https://git.kernel.org/stable/c/c9ffa3e2bc451816ce0295e40063514fabf2bd36
CVE ID: CVE-2022-48860 State: PUBLISHED Published: 2024-07-16T12:25:24.498Z Last Updated: 2025-05-04T08:24:54.037Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ethernet: Fix error handling in xemaclite_of_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. As the remove function do. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/669172ce976608b25a2f76f3c65d47f042d125c9 - https://git.kernel.org/stable/c/b7220f8e9d6c6b9594ddfb3125dad938cd478b1f - https://g
e976608b25a2f76f3c65d47f042d125c9 - https://git.kernel.org/stable/c/b7220f8e9d6c6b9594ddfb3125dad938cd478b1f - https://git.kernel.org/stable/c/8609e29611befc4bfbe7a91bb50fc65ae72ff549 - https://git.kernel.org/stable/c/8ee065a7a9b6a3976c16340503677efc4d8351f6 - https://git.kernel.org/stable/c/979b418b96e35f07136f77962ccfaa54cf3e30e1 - https://git.kernel.org/stable/c/5e7c402892e189a7bc152b125e72261154aa585d - https://git.kernel.org/stable/c/1852854ee349881efb78ccdbbb237838975902e4 - https://git.kernel.org/stable/c/b19ab4b38b06aae12442b2de95ccf58b5dc53584
CVE ID: CVE-2022-48861 State: PUBLISHED Published: 2024-07-16T12:25:25.160Z Last Updated: 2025-05-04T08:24:55.147Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vdpa: fix use-after-free on vp_vdpa_remove When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, triggering use-after-free. Call Trace of unbinding driver free vp_vdpa : do_syscall_64 vfs_write kernfs_fop_write_iter device_release_driver_internal pci_device_remove vp_vdpa_remove vdpa_unregister_device kobject_release device_release kfree Call Trace of dereference vp_vdpa->mdev.pci_d
vp_vdpa_remove vdpa_unregister_device kobject_release device_release kfree Call Trace of dereference vp_vdpa->mdev.pci_dev: vp_modern_remove pci_release_selected_regions pci_release_region pci_resource_len pci_resource_end (dev)->resource[(bar)].end Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4b1743bc715a3691a63ac21b349079b07bf1b19e - https://git.kernel.org/stable/c/dc54ba9932aeaaa1a21fe214af1f446593a78274 - https://git.kernel.org/stable/c/eb057b44dbe35ae14527830236a92f51de8f9184
CVE ID: CVE-2022-48862 State: PUBLISHED Published: 2024-07-16T12:25:25.833Z Last Updated: 2025-05-04T08:24:56.215Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and last is ULONG_MAX. One instance where it can happen is when userspace sends an IOTLB message with iova=size=uaddr=0 (vhost_process_iotlb_msg). So, an entry with size = 0, start = 0, last = ULONG_MAX ends up in the iotlb. Next time a packet is sent, iotlb_access_ok() loops indefinitely due to that erroneous entry. Call Trace: <TASK> iotl
b. Next time a packet is sent, iotlb_access_ok() loops indefinitely due to that erroneous entry. Call Trace: <TASK> iotlb_access_ok+0x21b/0x3e0 drivers/vhost/vhost.c:1340 vq_meta_prefetch+0xbc/0x280 drivers/vhost/vhost.c:1366 vhost_transport_do_send_pkt+0xe0/0xfd0 drivers/vhost/vsock.c:104 vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Reported by syzbot at: https://syzkaller.appspot.com/bug?extid=0abd373e2e50d704db87 To fix this, do two things: 1. Return -EINVAL in vhost_chr_write_iter() when userspace asks to map a range with size 0. 2. Fix vhost_iotlb_add_range_ctx() to handle the ra
ost_chr_write_iter() when userspace asks to map a range with size 0. 2. Fix vhost_iotlb_add_range_ctx() to handle the range [0, ULONG_MAX] by splitting it into two entries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f8d88e86e90ea1002226d7ac2430152bfea003d1 - https://git.kernel.org/stable/c/d9a747e6b6561280bf1791bb24c5e9e082193dad - https://git.kernel.org/stable/c/e2ae38cf3d91837a493cb2093c87700ff3cbe667
CVE ID: CVE-2022-48863 State: PUBLISHED Published: 2024-07-16T12:25:26.482Z Last Updated: 2025-05-04T08:24:57.485Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfree(dup), the dup variable contains NULL. Found by Linux Driver Verification project (linuxtesting.org) with SVACE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb - ht
er: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb - https://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b - https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f - https://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5
CVE ID: CVE-2022-48864 State: PUBLISHED Published: 2024-07-16T12:25:27.144Z Last Updated: 2025-05-04T08:24:59.139Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command request from the driver, presently there is no validation against the number of queue pairs to configure, or even if multiqueue had been negotiated or not is unverified. This may lead to kernel panic due to uninitialized resource for the queues were there any bogus request sent down by untrusted driver. Tie up the loose ends there. Ad
ized resource for the queues were there any bogus request sent down by untrusted driver. Tie up the loose ends there. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e7e118416465f2ba8b55007e5b789823e101421e - https://git.kernel.org/stable/c/9f6effca75626c7a7c7620dabcb1a254ca530230 - https://git.kernel.org/stable/c/ed0f849fc3a63ed2ddf5e72cdb1de3bdbbb0f8eb
CVE ID: CVE-2022-48865 State: PUBLISHED Published: 2024-07-16T12:25:27.843Z Last Updated: 2025-05-04T08:25:05.214Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tipc: fix kernel panic when enabling bearer When enabling a bearer on a node, a kernel panic is observed: [ 4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc] ... [ 4.520030] Call Trace: [ 4.520689] <IRQ> [ 4.521236] tipc_link_build_proto_msg+0x375/0x750 [tipc] [ 4.522654] tipc_link_build_state_msg+0x48/0xc0 [tipc] [ 4.524034] __tipc_node_link_up+0xd7/0x290 [tipc] [ 4.525292] tipc_rcv+0x5da/0x730 [tipc] [ 4.526346] ? __netif_receive_skb_core+0xb7/0xfc0 [ 4.527601] tip
7/0x290 [tipc] [ 4.525292] tipc_rcv+0x5da/0x730 [tipc] [ 4.526346] ? __netif_receive_skb_core+0xb7/0xfc0 [ 4.527601] tipc_l2_rcv_msg+0x5e/0x90 [tipc] [ 4.528737] __netif_receive_skb_list_core+0x20b/0x260 [ 4.530068] netif_receive_skb_list_internal+0x1bf/0x2e0 [ 4.531450] ? dev_gro_receive+0x4c2/0x680 [ 4.532512] napi_complete_done+0x6f/0x180 [ 4.533570] virtnet_poll+0x29c/0x42e [virtio_net] ... The node in question is receiving activate messages in another thread after changing bearer status to allow message sending/ receiving in current thread: thread 1 | thread 2 -------- | -------- | tipc_enable_bearer() | test_and_set_bit_lock() | tipc_bearer_xmit_skb() | | tipc_l2_rcv_msg() | tipc_rcv()
| -------- | tipc_enable_bearer() | test_and_set_bit_lock() | tipc_bearer_xmit_skb() | | tipc_l2_rcv_msg() | tipc_rcv() | __tipc_node_link_up() | tipc_link_build_state_msg() | tipc_link_build_proto_msg() | tipc_mon_prep() | { | ... | // null-pointer dereference | u16 gen = mon->dom_gen; | ... | } // Not being executed yet | tipc_mon_create() | { | ... | // allocate | mon = kzalloc(); | ... | } | Monitoring pointer in thread 2 is dereferenced before monitoring data is allocated in thread 1. This causes kernel panic. This commit fixes it by allocating the monitoring data before enabling the bearer to receive messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ore enabling the bearer to receive messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2de76d37d4a6dca9b96ea51da24d4290e6cfa1a5 - https://git.kernel.org/stable/c/f96dc3adb9a97b8f3dfdb88796483491a3006b71 - https://git.kernel.org/stable/c/f4f59fdbc748805b08c13dae14c01f0518c77c94 - https://git.kernel.org/stable/c/be4977b847f5d5cedb64d50eaaf2218c3a55a3a3
CVE ID: CVE-2022-48866 State: PUBLISHED Published: 2024-07-16T12:25:28.571Z Last Updated: 2025-05-04T08:25:06.293Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug. The root case is in missing validation check of actual number of endpoints. Code should not blindly access usb_host_interface::endpoint array, since it may contain less endpoints than code expects. Fix it by adding missing validaion check and print an error if number of endpoints do not match expected number Additional Analyst Notes: -
sing validaion check and print an error if number of endpoints do not match expected number Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3ffbe85cda7f523dad896bae08cecd8db8b555ab - https://git.kernel.org/stable/c/56185434e1e50acecee56d8f5850135009b87947 - https://git.kernel.org/stable/c/fc3ef2e3297b3c0e2006b5d7b3d66965e3392036
CVE ID: CVE-2022-48867 State: PUBLISHED Published: 2024-08-21T06:09:57.153Z Last Updated: 2025-05-04T08:25:07.385Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Prevent use after free on completion memory On driver unload any pending descriptors are flushed at the time the interrupt is freed: idxd_dmaengine_drv_remove() -> drv_disable_wq() -> idxd_wq_free_irq() -> idxd_flush_pending_descs(). If there are any descriptors present that need to be flushed this flow triggers a "not present" page fault as below: BUG: unable to handle page fault for address: ff391c97c70c9040 #PF: supervisor read access in kernel mode
ault as below: BUG: unable to handle page fault for address: ff391c97c70c9040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page The address that triggers the fault is the address of the descriptor that was freed moments earlier via: drv_disable_wq()->idxd_wq_free_resources() Fix the use after free by freeing the descriptors after any possible usage. This is done after idxd_wq_reset() to ensure that the memory remains accessible during possible completion writes by the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b9e8e3fcfec625fc1c2f68f684448aeeb882625b - https://git.kernel.org/stable/c/1beeec45f9a
- https://git.kernel.org/stable/c/b9e8e3fcfec625fc1c2f68f684448aeeb882625b - https://git.kernel.org/stable/c/1beeec45f9ac31eba52478379f70a5fa9c2ad005
CVE ID: CVE-2022-48868 State: PUBLISHED Published: 2024-08-21T06:09:58.431Z Last Updated: 2025-05-04T08:25:08.433Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Let probe fail when workqueue cannot be enabled The workqueue is enabled when the appropriate driver is loaded and disabled when the driver is removed. When the driver is removed it assumes that the workqueue was enabled successfully and proceeds to free allocations made during workqueue enabling. Failure during workqueue enabling does not prevent the driver from being loaded. This is because the error path within drv_enable_wq() returns success unless
s not prevent the driver from being loaded. This is because the error path within drv_enable_wq() returns success unless a second failure is encountered during the error path. By returning success it is possible to load the driver even if the workqueue cannot be enabled and allocations that do not exist are attempted to be freed during driver remove. Some examples of problematic flows: (a) idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_unmap_portal() is called on error exit path, but drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The driver is thus loaded successfully. idxd_dmaengine_drv_remove