Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-52438 State: PUBLISHED Published: 2024-02-20T18:34:48.694Z Last Updated: 2025-05-04T07:36:28.136Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated. I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The follo
e this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF: ================================================================== BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4
st_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758 ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368 vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8 vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi
reation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7c Fix this issue by performing instead a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade. Note that this option has better performance than upgrading to a mmap write lock which would increase contention. Plus, mmap_write_trylock() has been recently removed anyway. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a53e15e592b4dcc91c3a3b8514e484a0bdbc53
nrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a53e15e592b4dcc91c3a3b8514e484a0bdbc53a3 - https://git.kernel.org/stable/c/c8c1158ffb007197f31f9d9170cf13e4f34cbb5c - https://git.kernel.org/stable/c/8ad4d580e8aff8de2a4d57c5930fcc29f1ffd4a6 - https://git.kernel.org/stable/c/9fa04c93f24138747807fe75b5591bb680098f56 - https://git.kernel.org/stable/c/a49087ab93508b60d9b8add91707a22dda832869 - https://git.kernel.org/stable/c/e074686e993ff1be5f21b085a3b1b4275ccd5727 - https://git.kernel.org/stable/c/3f489c2067c5824528212b0fc18b28d51332d906
CVE ID: CVE-2023-52439 State: PUBLISHED Published: 2024-02-20T18:34:49.323Z Last Updated: 2025-05-04T12:49:00.841Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the
--------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c - https://git.kernel.org/stable/c/e93da893d52d82d57f
://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c - https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50 - https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570 - https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7 - https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea - https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad - https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41 - https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2
CVE ID: CVE-2023-52440 State: PUBLISHED Published: 2024-02-21T07:21:00.438Z Last Updated: 2025-05-04T07:36:35.594Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/bd554ed4fdc3d38404a1c43d428432577573e809 - https://git.kernel.org/stable/c/30fd6521b2fbd9b76
s://git.kernel.org/stable/c/bd554ed4fdc3d38404a1c43d428432577573e809 - https://git.kernel.org/stable/c/30fd6521b2fbd9b767e438e31945e5ea3e3a2fba - https://git.kernel.org/stable/c/7f1d6cb0eb6af3a8088dc24b7ddee9a9711538c4 - https://git.kernel.org/stable/c/ecd7e1c562cb08e41957fcd4b0e404de5ab38e20 - https://git.kernel.org/stable/c/4b081ce0d830b684fdf967abc3696d1261387254
CVE ID: CVE-2023-52441 State: PUBLISHED Published: 2024-02-21T07:21:01.075Z Last Updated: 2025-05-04T07:36:36.612Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b - https://git.kernel.org/stable/c/
eferences: - https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b - https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc - https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f - https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b
CVE ID: CVE-2023-52442 State: PUBLISHED Published: 2024-02-21T07:21:01.814Z Last Updated: 2025-10-01T19:11:27.132Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
t() to get current command in compound. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 - https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f - https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac - https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e
CVE ID: CVE-2023-52443 State: PUBLISHED Published: 2024-02-22T16:13:31.154Z Last Updated: 2025-05-04T07:36:39.239Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid crash when parsed profile name is empty When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aa_splitn_fqname(). aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aa_alloc_profile() crashes a
ontaining a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aa_alloc_profile() crashes as the new profile name is NULL now. general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 a
en+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0 It seems such behaviour of aa_splitn_fqname() is expected and checked in other places where it is called (e.g. aa_remove_profiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside. AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it i
owing profile is allowed" inside. AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace. Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message. Found by Linux Verification Center (linuxtesting.org). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9286ee97aa4803d99185768735011d0d65827c9e - https://git.kernel.org/stable/c/1d8e62b5569cc1466ceb8a7e4872cf10160a9dcf - https://git.kernel.org/stable/c/5ff00408e5029d3550ee77f62dc15f1e15c47f87 - https://git.kernel.org/stable/c/0a12db736edbb4933e4274932aeea594b5876fa4 - htt
ff00408e5029d3550ee77f62dc15f1e15c47f87 - https://git.kernel.org/stable/c/0a12db736edbb4933e4274932aeea594b5876fa4 - https://git.kernel.org/stable/c/9d4fa5fe2b1d56662afd14915a73b4d0783ffa45 - https://git.kernel.org/stable/c/5c0392fdafb0a2321311900be83ffa572bef8203 - https://git.kernel.org/stable/c/77ab09b92f16c8439a948d1af489196953dc4a0e - https://git.kernel.org/stable/c/55a8210c9e7d21ff2644809699765796d4bfb200
CVE ID: CVE-2023-52444 State: PUBLISHED Published: 2024-02-22T16:21:37.043Z Last Updated: 2025-05-04T07:36:40.605Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase,
leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/02160112e6d45c2610b049df6eb693d7a2e57b46 - https://git.kernel.org/stable/c/5624a3c1b1ebc8991318e1cce2aa719542991024 - https://git.kernel.org/stable/c/6f866885e147d33ef
s://git.kernel.org/stable/c/5624a3c1b1ebc8991318e1cce2aa719542991024 - https://git.kernel.org/stable/c/6f866885e147d33efc497f1095f35b2ee5ec7310 - https://git.kernel.org/stable/c/f100ba617d8be6c98a68f3744ef7617082975b77 - https://git.kernel.org/stable/c/f0145860c20be6bae6785c7a2249577674702ac7 - https://git.kernel.org/stable/c/d3c0b49aaa12a61d560528f5d605029ab57f0728 - https://git.kernel.org/stable/c/2fb4867f4405aea8c0519d7d188207f232a57862 - https://git.kernel.org/stable/c/53edb549565f55ccd0bdf43be3d66ce4c2d48b28
CVE ID: CVE-2023-52445 State: PUBLISHED Published: 2024-02-22T16:21:37.784Z Last Updated: 2025-05-04T07:36:41.651Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack. Additional Analyst Notes: - CVE Pr
ore the invalid read reported by syzbot, within the context disconnection call stack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ec36c134dd020d28e312c2f1766f85525e747aab - https://git.kernel.org/stable/c/47aa8fcd5e8b5563af4042a00f25ba89bef8f33d - https://git.kernel.org/stable/c/3233d8bf7893550045682192cb227af7fa3defeb - https://git.kernel.org/stable/c/ec3634ebe23fc3c44ebc67c6d25917300bc68c08 - https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e - https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795 - https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c -
/c/2cf0005d315549b8d2b940ff96a66c2a889aa795 - https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c - https://git.kernel.org/stable/c/ded85b0c0edd8f45fec88783d7555a5b982449c1
CVE ID: CVE-2023-52446 State: PUBLISHED Published: 2024-02-22T16:21:38.408Z Last Updated: 2025-05-04T07:36:42.890Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a race condition between btf_put() and map_free() When running `./test_progs -j` in my local vm with latest kernel, I once hit a kasan error like below: [ 1887.184724] BUG: KASAN: slab-use-after-free in bpf_rb_root_free+0x1f8/0x2b0 [ 1887.185599] Read of size 4 at addr ffff888106806910 by task kworker/u12:2/2830 [ 1887.186498] [ 1887.186712] CPU: 3 PID: 2830 Comm: kworker/u12:2 Tainted: G OEL 6.7.0-rc3-00699-g90679706d486-dirty #494 [ 1887.188034] Hardware nam
CPU: 3 PID: 2830 Comm: kworker/u12:2 Tainted: G OEL 6.7.0-rc3-00699-g90679706d486-dirty #494 [ 1887.188034] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1887.189618] Workqueue: events_unbound bpf_map_free_deferred [ 1887.190341] Call Trace: [ 1887.190666] <TASK> [ 1887.190949] dump_stack_lvl+0xac/0xe0 [ 1887.191423] ? nf_tcp_handle_invalid+0x1b0/0x1b0 [ 1887.192019] ? panic+0x3c0/0x3c0 [ 1887.192449] print_report+0x14f/0x720 [ 1887.192930] ? preempt_count_sub+0x1c/0xd0 [ 1887.193459] ? __virt_addr_valid+0xac/0x120 [ 1887.194004] ? bpf_rb_root_free+0x1f8/0x2b0 [ 1887.194572] kasan_report+0xc3/0x100 [ 1887.195085] ? bpf_r
d+0xac/0x120 [ 1887.194004] ? bpf_rb_root_free+0x1f8/0x2b0 [ 1887.194572] kasan_report+0xc3/0x100 [ 1887.195085] ? bpf_rb_root_free+0x1f8/0x2b0 [ 1887.195668] bpf_rb_root_free+0x1f8/0x2b0 [ 1887.196183] ? __bpf_obj_drop_impl+0xb0/0xb0 [ 1887.196736] ? preempt_count_sub+0x1c/0xd0 [ 1887.197270] ? preempt_count_sub+0x1c/0xd0 [ 1887.197802] ? _raw_spin_unlock+0x1f/0x40 [ 1887.198319] bpf_obj_free_fields+0x1d4/0x260 [ 1887.198883] array_map_free+0x1a3/0x260 [ 1887.199380] bpf_map_free_deferred+0x7b/0xe0 [ 1887.199943] process_scheduled_works+0x3a2/0x6c0 [ 1887.200549] worker_thread+0x633/0x890 [ 1887.201047] ? __kthread_parkme+0xd7/0xf0 [ 1887.201574] ? kthread+0x102/0x1d0 [ 1887.202020] kthread
read+0x633/0x890 [ 1887.201047] ? __kthread_parkme+0xd7/0xf0 [ 1887.201574] ? kthread+0x102/0x1d0 [ 1887.202020] kthread+0x1ab/0x1d0 [ 1887.202447] ? pr_cont_work+0x270/0x270 [ 1887.202954] ? kthread_blkcg+0x50/0x50 [ 1887.203444] ret_from_fork+0x34/0x50 [ 1887.203914] ? kthread_blkcg+0x50/0x50 [ 1887.204397] ret_from_fork_asm+0x11/0x20 [ 1887.204913] </TASK> [ 1887.204913] </TASK> [ 1887.205209] [ 1887.205416] Allocated by task 2197: [ 1887.205881] kasan_set_track+0x3f/0x60 [ 1887.206366] __kasan_kmalloc+0x6e/0x80 [ 1887.206856] __kmalloc+0xac/0x1a0 [ 1887.207293] btf_parse_fields+0xa15/0x1480 [ 1887.207836] btf_parse_struct_metas+0x566/0x670 [ 1887.208387] btf_new_fd+0x294/0x4d0 [ 1887.208
e_fields+0xa15/0x1480 [ 1887.207836] btf_parse_struct_metas+0x566/0x670 [ 1887.208387] btf_new_fd+0x294/0x4d0 [ 1887.208851] __sys_bpf+0x4ba/0x600 [ 1887.209292] __x64_sys_bpf+0x41/0x50 [ 1887.209762] do_syscall_64+0x4c/0xf0 [ 1887.210222] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1887.210868] [ 1887.211074] Freed by task 36: [ 1887.211460] kasan_set_track+0x3f/0x60 [ 1887.211951] kasan_save_free_info+0x28/0x40 [ 1887.212485] ____kasan_slab_free+0x101/0x180 [ 1887.213027] __kmem_cache_free+0xe4/0x210 [ 1887.213514] btf_free+0x5b/0x130 [ 1887.213918] rcu_core+0x638/0xcc0 [ 1887.214347] __do_softirq+0x114/0x37e The error happens at bpf_rb_root_free+0x1f8/0x2b0: 00000000000034c0 <bpf_rb_root_f
1887.214347] __do_softirq+0x114/0x37e The error happens at bpf_rb_root_free+0x1f8/0x2b0: 00000000000034c0 <bpf_rb_root_free>: ; { 34c0: f3 0f 1e fa endbr64 34c4: e8 00 00 00 00 callq 0x34c9 <bpf_rb_root_free+0x9> 34c9: 55 pushq %rbp 34ca: 48 89 e5 movq %rsp, %rbp ... ; if (rec && rec->refcount_off >= 0 && 36aa: 4d 85 ed testq %r13, %r13 36ad: 74 a9 je 0x3658 <bpf_rb_root_free+0x198> 36af: 49 8d 7d 10 leaq 0x10(%r13), %rdi 36b3: e8 00 00 00 00 callq 0x36b8 <bpf_rb_root_free+0x1f8> <==== kasan function 36b8: 45 8b 7d 10 movl 0x10(%r13), %r15d <==== use-after-free load 36bc: 45 85 ff testl %r15d, %r15d 36bf: 78 8c js 0x364d <bpf_rb_root_free+0x18d> So the problem ---truncated--- Additional Anal
5 85 ff testl %r15d, %r15d 36bf: 78 8c js 0x364d <bpf_rb_root_free+0x18d> So the problem ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d048dced8ea5eac6723ae873a40567e6f101ea42 - https://git.kernel.org/stable/c/f9ff6ef1c73cd9e1a6bb1ab3e57c5d141a536306 - https://git.kernel.org/stable/c/59e5791f59dd83e8aa72a4e74217eabb6e8cfd90
CVE ID: CVE-2023-52447 State: PUBLISHED Published: 2024-02-22T16:21:39.032Z Last Updated: 2025-05-04T07:36:44.024Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map directly through bpf_map_put(), if the ref-counter is the last one (which is true for most cases), the inner map will be freed by ops->map_free() in a kworker. But for now, most .map_free() callbacks don't use s
cases), the inner map will be freed by ops->map_free() in a kworker. But for now, most .map_free() callbacks don't use synchronize_rcu() or its variants to wait for the elapse of a RCU grace period, so after the invocation of ops->map_free completes, the bpf program which is accessing the inner map may incur use-after-free problem. Fix the free of inner map by invoking bpf_map_free_deferred() after both one RCU grace period and one tasks trace RCU grace period if the inner map has been removed from the outer map before. The deferment is accomplished by using call_rcu() or call_rcu_tasks_trace() when releasing the last ref-counter of bpf map. The newly-added rcu_head field in bpf_map shares t
all_rcu_tasks_trace() when releasing the last ref-counter of bpf map. The newly-added rcu_head field in bpf_map shares the same storage space with work field to reduce the size of bpf_map. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/90c445799fd1dc214d7c6279c144e33a35e29ef2 - https://git.kernel.org/stable/c/37d98fb9c3144c0fddf7f6e99aece9927ac8dce6 - https://git.kernel.org/stable/c/62fca83303d608ad4fec3f7428c8685680bb01b0 - https://git.kernel.org/stable/c/f91cd728b10c51f6d4a39957ccd56d1e802fc8ee - https://git.kernel.org/stable/c/bfd9b20c4862f41d4590fde11d70a5eeae53dcc5 - https://git.kernel.org/stable/c/876673364161da
ttps://git.kernel.org/stable/c/bfd9b20c4862f41d4590fde11d70a5eeae53dcc5 - https://git.kernel.org/stable/c/876673364161da50eed6b472d746ef88242b2368
CVE ID: CVE-2023-52448 State: PUBLISHED Published: 2024-02-22T16:21:39.915Z Last Updated: 2025-05-04T07:36:45.265Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/efc8ef87ab9185a23d5676f2f7d986022d91bcde - https://git.kerne
am Container: References: - https://git.kernel.org/stable/c/efc8ef87ab9185a23d5676f2f7d986022d91bcde - https://git.kernel.org/stable/c/5c28478af371a1c3fdb570ca67f110e1ae60fc37 - https://git.kernel.org/stable/c/ee0586d73cbaf0e7058bc640d62a9daf2dfa9178 - https://git.kernel.org/stable/c/d69d7804cf9e2ba171a27e5f98bc266f13d0414a - https://git.kernel.org/stable/c/067a7c48c2c70f05f9460d6f0e8423e234729f05 - https://git.kernel.org/stable/c/c323efd620c741168c8e0cc6fc0be04ab57e331a - https://git.kernel.org/stable/c/8877243beafa7c6bfc42022cbfdf9e39b25bd4fa
CVE ID: CVE-2023-52449 State: PUBLISHED Published: 2024-02-22T16:21:40.841Z Last Updated: 2025-05-04T07:36:46.435Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header