Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
g/stable/c/f5575041ec15310bdc50c42b8b22118cc900226e - https://git.kernel.org/stable/c/3f566b626029ca8598d48e5074e56bb37399ca1b - https://git.kernel.org/stable/c/5eb114f55b37dbc0487aa9c1913b81bb7837f1c4 - https://git.kernel.org/stable/c/f7419fc42afc035f6b29ce713e17dcd2000c833f - https://git.kernel.org/stable/c/d45d9f45e7b1365fd0d9bf14680d6d5082a590d1 - https://git.kernel.org/stable/c/fc92d9e3de0b2d30a3ccc08048a5fad533e4672b
CVE ID: CVE-2022-49033 State: PUBLISHED Published: 2024-10-21T20:06:36.566Z Last Updated: 2025-05-04T08:28:29.479Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Syzkaller reported BUG as follows: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 __might_resched.cold+0x222/0x26b kmem_cache_alloc+0x2e7/0x3c0 update_qgroup_limit_item+0xe1/0x390 btrfs_qgroup_inherit+0x147b/0x1ee0 create_subvol+0x4eb/0x1710 btrfs_mksubvol+0xfe5/0x13f0 __btrfs_ioctl_snap_create+0x2b0/0x430 btrfs_io
erit+0x147b/0x1ee0 create_subvol+0x4eb/0x1710 btrfs_mksubvol+0xfe5/0x13f0 __btrfs_ioctl_snap_create+0x2b0/0x430 btrfs_ioctl_snap_create_v2+0x25a/0x520 btrfs_ioctl+0x2a1c/0x5ce0 __x64_sys_ioctl+0x193/0x200 do_syscall_64+0x35/0x80 Fix this by calling qgroup_dirty() on @dstqgroup, and update limit item in btrfs_run_qgroups() later outside of the spinlock context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/89840b12c8fad7200eb6478525c13261512c01be - https://git.kernel.org/stable/c/3c98e91be6aea4c7acf09da6eb0c107ea9186bb5 - https://git.kernel.org/stable/c/f4b930a1602b05e77fee31f9616599b25e910a86 - https://git.kernel.org/stable/c/8eb912af525042a
tps://git.kernel.org/stable/c/f4b930a1602b05e77fee31f9616599b25e910a86 - https://git.kernel.org/stable/c/8eb912af525042a7365295eb62f6d5270c2a6462 - https://git.kernel.org/stable/c/01d7c41eac9129fba80d8aed0060caab4a7dbe09 - https://git.kernel.org/stable/c/044da1a371a0da579e805e89c96865f62d8f6f69 - https://git.kernel.org/stable/c/588ae4fdd8b11788a797776b10d6c44ae12bc133 - https://git.kernel.org/stable/c/f7e942b5bb35d8e3af54053d19a6bf04143a3955
CVE ID: CVE-2022-49034 State: PUBLISHED Published: 2024-12-27T13:49:10.297Z Last Updated: 2025-11-03T20:35:12.889Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as below when showing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked
- [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3
00 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xc
0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/8fbb57eabfc8ae67115cb47f904614c99d6
nalyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/8fbb57eabfc8ae67115cb47f904614c99d626a89 - https://git.kernel.org/stable/c/f8f26cf69003a37ffa947631fc0e6fe6daee624a - https://git.kernel.org/stable/c/77755dc95ff2f9a3e473acc1e039f498629949ea - https://git.kernel.org/stable/c/e2b91997db286a5dd3cca6d5d9c20004851f22eb - https://git.kernel.org/stable/c/2b6b8e011fab680a223b5e07a3c64774156ec6fe - https://git.kernel.org/stable/c/09faf32c682ea4a547200b8b9e04d8b3c8e84b55 - https://git.kernel.org/stable/c/39373f6f89f52770a5405d30dddd08a27d097872 - https://git.kernel.org/stable/c/701e32900683378d93693fec15d133e2c5f7ada2 - https://git.kernel.org/stable/c/3c891f7c6a4e90b
tps://git.kernel.org/stable/c/701e32900683378d93693fec15d133e2c5f7ada2 - https://git.kernel.org/stable/c/3c891f7c6a4e90bb1199497552f24b26e46383bc
CVE ID: CVE-2022-49035 State: PUBLISHED Published: 2025-01-02T14:38:04.604Z Last Updated: 2025-10-29T10:49:51.933Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7ccb40f26cbefa1c6dfd3418bea54c9518cdbd8a - https://git.kernel.org/stable/c/fc0f76dd5f116fa9291327024dda392f8b4e849c - https://git.kernel.org/stable/c/a2728bf9b6c65e46468c763e3dab7e04839d4e11 - https://git.kernel.o
1327024dda392f8b4e849c - https://git.kernel.org/stable/c/a2728bf9b6c65e46468c763e3dab7e04839d4e11 - https://git.kernel.org/stable/c/4a449430ecfb199b99ba58af63c467eb53500b39 - https://git.kernel.org/stable/c/1609231f86760c1f6a429de7913dd795b9faa08c - https://git.kernel.org/stable/c/cbfa26936f318b16ccf9ca31b8e8b30c0dc087bd - https://git.kernel.org/stable/c/2654e785bd4aa2439cdffbe7dc1ea30a0eddbfe4 - https://git.kernel.org/stable/c/93f65ce036863893c164ca410938e0968964b26c
CVE ID: CVE-2022-49037 State: PUBLISHED Published: 2024-09-26T03:32:31.301Z Last Updated: 2024-09-26T14:52:35.431Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Synology Products: Synology Drive Client Problem Types: CWE-532 Description: Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allows remote authenticated users to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_10
CVE ID: CVE-2022-49038 State: PUBLISHED Published: 2024-09-26T03:33:01.093Z Last Updated: 2024-09-26T14:52:02.124Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Synology Products: Synology Drive Client Problem Types: CWE-829 Description: Inclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component in Synology Drive Client before 3.3.0-15082 allows local users to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_10
CVE ID: CVE-2022-49039 State: PUBLISHED Published: 2024-09-26T03:33:29.551Z Last Updated: 2024-09-26T14:51:05.107Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Synology Products: Synology Drive Client Problem Types: CWE-787 Description: Out-of-bounds write vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to execute arbitrary commands via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_10
CVE ID: CVE-2022-49040 State: PUBLISHED Published: 2024-09-26T03:34:10.329Z Last Updated: 2024-09-26T14:40:39.040Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Synology Products: Synology Drive Client Problem Types: CWE-120 Description: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in connection management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to crash the client via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_10
CVE ID: CVE-2022-49041 State: PUBLISHED Published: 2024-09-26T03:34:56.493Z Last Updated: 2024-09-26T14:40:15.626Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Synology Products: Synology Drive Client Problem Types: CWE-120 Description: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to crash the client via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_10
CVE ID: CVE-2022-49043 State: PUBLISHED Published: 2025-01-26T00:00:00.000Z Last Updated: 2025-11-03T20:35:14.313Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: xmlsoft Products: libxml2 Problem Types: CWE-416 Description: xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/libxml2/-/commit/5a19e21605398cef6a8b1452477a8705cb41562b - https://github.com/php/php-src/issues/17467
CVE ID: CVE-2022-49044 State: PUBLISHED Published: 2025-02-26T01:54:21.389Z Last Updated: 2025-05-04T08:28:33.434Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm integrity: fix memory corruption when tag_size is less than digest size It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored. In this case, dm-integrity would write beyond the end of the ic->recalc_tags array and corrupt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final. Fix this corrupt
upt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final. Fix this corruption by increasing the tags array so that it has enough padding at the end to accomodate the loop in integrity_recalc() being able to write a full digest size for the last member of the tags array. References: - https://git.kernel.org/stable/c/6a95d91c0b315c965198f6ab7dec7c94129e17e0 - https://git.kernel.org/stable/c/7f84c937222944c03f4615ca4742df6bed0e5adf - https://git.kernel.org/stable/c/cd02b2687d66f0a8e716384de4b9a0671331f1dc - https://git.kernel.org/stable/c/6b4bf97587ef6c1927a78934b700204920655123 - https://git.kernel.org/stable/c/4d485cf9b609709e45d5113e6e2b1b01254b2
table/c/6b4bf97587ef6c1927a78934b700204920655123 - https://git.kernel.org/stable/c/4d485cf9b609709e45d5113e6e2b1b01254b2fe9 - https://git.kernel.org/stable/c/08c1af8f1c13bbf210f1760132f4df24d0ed46d6
CVE ID: CVE-2022-49045 State: REJECTED Published: 2025-02-26T01:54:22.168Z Last Updated: 2025-03-02T14:29:14.527Z Description: No description available.
CVE ID: CVE-2022-49046 State: PUBLISHED Published: 2025-02-26T01:54:22.837Z Last Updated: 2025-11-03T19:27:47.333Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i2c: dev: check return value when calling dev_set_name() If dev_set_name() fails, the dev_name() is null, check the return value of dev_set_name() to avoid the null-ptr-deref. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/2e539b17d4cbe5fb8b5152dd9a6e4a8828f97db2 - https://git.kernel.org/stable/c/2f345bb14ad4744950499ff222e2899209297afa - https://git.kernel.org/stable/c/c74d77a2d07744147d734138acd6ce9dba715e5d - https:/
bb14ad4744950499ff222e2899209297afa - https://git.kernel.org/stable/c/c74d77a2d07744147d734138acd6ce9dba715e5d - https://git.kernel.org/stable/c/993eb48fa199b5f476df8204e652eff63dd19361
CVE ID: CVE-2022-49047 State: PUBLISHED Published: 2025-02-26T01:54:23.471Z Last Updated: 2025-05-04T08:28:36.151Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ep93xx: clock: Fix UAF in ep93xx_clk_register_gate() arch/arm/mach-ep93xx/clock.c:154:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc] arch/arm/mach-ep93xx/clock.c:151:2: note: Taking true branch if (IS_ERR(clk)) ^ arch/arm/mach-ep93xx/clock.c:152:3: note: Memory is released kfree(psc); ^~~~~~~~~~ arch/arm/mach-ep93xx/clock.c:154:2: note: Use of memory after it is freed return &psc->hw; ^ ~~~~~~~~ Additional Analyst Notes: - CISA ADP Vulnrichmen
54:2: note: Use of memory after it is freed return &psc->hw; ^ ~~~~~~~~ Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0f12166872da46c6b57ba2f1314bbf310b3bf017 - https://git.kernel.org/stable/c/3b68b08885217abd9c57ff9b3bb3eb173eee02a9
CVE ID: CVE-2022-49048 State: PUBLISHED Published: 2025-02-26T01:54:24.115Z Last Updated: 2025-05-04T12:44:13.362Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6_forward() when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev vxlan100 root tc qdisc add dev vxlan100 root netem corrupt 5% References: - https://git.kernel.org/stable/c/74b68f5249f16c5f7f675d0f604fa6ae20e3a151 - https://git.kernel.org/stable/c/ab2f5afb7af5c68389e8c7dd29e0a98fbeaaa435 - https://git.ker
c5f7f675d0f604fa6ae20e3a151 - https://git.kernel.org/stable/c/ab2f5afb7af5c68389e8c7dd29e0a98fbeaaa435 - https://git.kernel.org/stable/c/a263712ba8c9ded25dd9d2d5ced11bcea5b33a3e - https://git.kernel.org/stable/c/adee01bbf6cb5b3e4ed08be8ff866aac90f13836 - https://git.kernel.org/stable/c/e69fb3de87a8923e5931a272a38fa3cceb01da44 - https://git.kernel.org/stable/c/e3fa461d8b0e185b7da8a101fe94dfe6dd500ac0
CVE ID: CVE-2022-49049 State: PUBLISHED Published: 2025-02-26T01:54:24.783Z Last Updated: 2025-05-04T08:28:38.980Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix panic when growing a memfd_secret When one tries to grow an existing memfd_secret with ftruncate, one gets a panic [1]. For example, doing the following reliably induces the panic: fd = memfd_secret(); ftruncate(fd, 10); ptr = mmap(NULL, 10, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); strcpy(ptr, "123456789"); munmap(ptr, 10); ftruncate(fd, 20); The basic reason for this is, when we grow with ftruncate, we call down into simple_setattr, and then trunc
ate(fd, 20); The basic reason for this is, when we grow with ftruncate, we call down into simple_setattr, and then truncate_inode_pages_range, and eventually we try to zero part of the memory. The normal truncation code does this via the direct map (i.e., it calls page_address() and hands that to memset()). For memfd_secret though, we specifically don't map our pages via the direct map (i.e. we call set_direct_map_invalid_noflush() on every fault). So the address returned by page_address() isn't useful, and when we try to memset() with it we panic. This patch avoids the panic by implementing a custom setattr for memfd_secret, which detects resizes specifically (setting the size for the first
ic by implementing a custom setattr for memfd_secret, which detects resizes specifically (setting the size for the first time works just fine, since there are no existing pages to try to zero), and rejects them with EINVAL. One could argue growing should be supported, but I think that will require a significantly more lengthy change. So, I propose a minimal fix for the benefit of stable kernels, and then perhaps to extend memfd_secret to support growing in a separate patch. [1]: BUG: unable to handle page fault for address: ffffa0a889277028 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD afa01067 P4D afa01067 PUD 83f909067 PMD 83f8bf067 PTE 800ffffe
ernel mode #PF: error_code(0x0002) - not-present page PGD afa01067 P4D afa01067 PUD 83f909067 PMD 83f8bf067 PTE 800ffffef6d88060 Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI CPU: 0 PID: 281 Comm: repro Not tainted 5.17.0-dbg-DEV #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:memset_erms+0x9/0x10 Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 <f3> aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 RSP: 0018:ffffb932c09afbf0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffda63c4249dc0 RCX: 0000000000000fd8 RDX: 0000000000000fd8 RSI: 0000000000000000
00010246 RAX: 0000000000000000 RBX: ffffda63c4249dc0 RCX: 0000000000000fd8 RDX: 0000000000000fd8 RSI: 0000000000000000 RDI: ffffa0a889277028 RBP: ffffb932c09afc00 R08: 0000000000001000 R09: ffffa0a889277028 R10: 0000000000020023 R11: 0000000000000000 R12: ffffda63c4249dc0 R13: ffffa0a890d70d98 R14: 0000000000000028 R15: 0000000000000fd8 FS: 00007f7294899580(0000) GS:ffffa0af9bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa0a889277028 CR3: 0000000107ef6006 CR4: 0000000000370ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? zero_user_segments+0x82
0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? zero_user_segments+0x82/0x190 truncate_inode_partial_folio+0xd4/0x2a0 truncate_inode_pages_range+0x380/0x830 truncate_setsize+0x63/0x80 simple_setattr+0x37/0x60 notify_change+0x3d8/0x4d0 do_sys_ftruncate+0x162/0x1d0 __x64_sys_ftruncate+0x1c/0x20 do_syscall_64+0x44/0xa0 entry_SYSCALL_64_after_hwframe+0x44/0xae Modules linked in: xhci_pci xhci_hcd virtio_net net_failover failover virtio_blk virtio_balloon uhci_hcd ohci_pci ohci_hcd evdev ehci_pci ehci_hcd 9pnet_virtio 9p netfs 9pnet CR2: ffffa0a889277028 [lkp@intel.com: secretmem_iops can be static] [axelrasmussen@google.com: return EINVAL] Referen
et CR2: ffffa0a889277028 [lkp@intel.com: secretmem_iops can be static] [axelrasmussen@google.com: return EINVAL] References: - https://git.kernel.org/stable/c/b6d17c67885a5624e96eb30c4178c65eea8374bf - https://git.kernel.org/stable/c/9d3b877daf805fed29be8f61aa3d0ea37df82c7b - https://git.kernel.org/stable/c/f9b141f93659e09a52e28791ccbaf69c273b8e92
CVE ID: CVE-2022-49050 State: PUBLISHED Published: 2025-02-26T01:54:25.392Z Last Updated: 2025-05-04T08:28:40.501Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: memory: renesas-rpc-if: fix platform-device leak in error path Make sure to free the flash platform device in the event that registration fails during probe. References: - https://git.kernel.org/stable/c/c089ffc846c85f200db34ad208338f4f81a6d82d - https://git.kernel.org/stable/c/05d1824a7fb43ab9adb1eb82404954af81d8c984 - https://git.kernel.org/stable/c/66b9b707ea4dcafca92b6261c6924652914e3b73 - https://git.kernel.org/stable/c/b452dbf24d7d9a990d70118462925f6ee287d135
CVE ID: CVE-2022-49051 State: PUBLISHED Published: 2025-02-26T01:54:25.850Z Last Updated: 2025-05-04T08:28:41.831Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup aqc111_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (desc_offset..desc_offset+2*pkt_count) can be out of bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has alre
t can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is far beyond its end, causing out-of-bounds heap data to be considered part of the SKB's data. Found doing variant analysis. Tested it with another driver (ax88179_178a), since I don't have a aqc111 device to test it, but the code looks very similar. References: - https://git.kernel.org/stable/c/404998a137bcb8a926f7c949030afbe285472593 - https://git.kernel.org/stable/c/d90df6da50c56ad8b1a132e3cf86b6cdf8f507b7 - https://git.kernel.org/stable/c/b416898442f2b6aa9f1b2f2968ce07e3abaa05f7 -
c/d90df6da50c56ad8b1a132e3cf86b6cdf8f507b7 - https://git.kernel.org/stable/c/b416898442f2b6aa9f1b2f2968ce07e3abaa05f7 - https://git.kernel.org/stable/c/36311fe98f55dea9200c69e2dd6d6ddb8fc94080 - https://git.kernel.org/stable/c/afb8e246527536848b9b4025b40e613edf776a9d
CVE ID: CVE-2022-49052 State: PUBLISHED Published: 2025-02-26T01:54:26.322Z Last Updated: 2025-05-04T08:28:42.999Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm: fix unexpected zeroed page mapping with zram swap Two processes under CLONE_VM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage valid data swap_slot_free_notify delete zram entry swap_readpage zeroed(invalid) data pte_lock map the *zero data* to userspace pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return and next refault w
map the *zero data* to userspace pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return and next refault will read zeroed data The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't increase the refcount of swap slot at copy_mm so it couldn't catch up whether it's safe or not to discard data from backing device. In the case, only the lock it could rely on to synchronize swap slot freeing is page table lock. Thus, this patch gets rid of the swap_slot_free_notify function. With this patch, CPU A will see correct data. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage original data pte_lock map the original data swap