Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
_ioctl+0x4e8/0x834 net/socket.c:1322 vfs_ioctl fs/ioctl.c:51 [inline] __do_ ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b4f0e605a508f6d7cda6df2f03a0c676b778b1fe - https://git.kernel.org/stable/c/396baca6683f415b5bc2b380289387bef1406edc - https://git.kernel.org/stable/c/53064e8239dd2ecfefc5634e991f1025abc2ee0c - https://git.kernel.org/stable/c/19554aa901b5833787df4417a05ccdebf351b7f4 - https://git.kernel.org/stable/c/87c49806a37f88eddde3f537c162fd0c2834170c - https://git.kernel.org/stable/c/d98c91215a5748a0f536e7ccea26027005196859 - https://git.kernel.org/stable/c/3cffa2ddc4d3fcf70cde361236f5a614f81a
stable/c/d98c91215a5748a0f536e7ccea26027005196859 - https://git.kernel.org/stable/c/3cffa2ddc4d3fcf70cde361236f5a614f81a09b2
CVE ID: CVE-2023-52785 State: PUBLISHED Published: 2024-05-21T15:31:03.040Z Last Updated: 2025-05-04T07:43:10.175Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR If command timeout happens and cq complete IRQ is raised at the same time, ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the ISR. Error log: ufshcd_abort: Device abort task at tag 18 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44 lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114 A
0000108 pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44 lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8f15a7e3c054d960bbd1521110700450bbf798a1 - https://git.kernel.org/stable/c/f84d461f33a6b27304d468d9cfb56c0cefdb4ee7 - https://git.kernel.org/stable/c/27900d7119c464b43cd9eac69c85884d17bae240
CVE ID: CVE-2023-52786 State: PUBLISHED Published: 2024-05-21T15:31:03.694Z Last Updated: 2025-05-04T07:43:11.227Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: fix racy may inline data check in dio write syzbot reports that the following warning from ext4_iomap_begin() triggers as of the commit referenced below: if (WARN_ON_ONCE(ext4_has_inline_data(inode))) return -ERANGE; This occurs during a dio write, which is never expected to encounter an inode with inline data. To enforce this behavior, ext4_dio_write_iter() checks the current inline state of the inode and clears the MAY_INLINE_DATA state flag to either fall back
_write_iter() checks the current inline state of the inode and clears the MAY_INLINE_DATA state flag to either fall back to buffered writes, or enforce that any other writers in progress on the inode are not allowed to create inline data. The problem is that the check for existing inline data and the state flag can span a lock cycle. For example, if the ilock is originally locked shared and subsequently upgraded to exclusive, another writer may have reacquired the lock and created inline data before the dio write task acquires the lock and proceeds. The commit referenced below loosens the lock requirements to allow some forms of unaligned dio writes to occur under shared lock, but AFAICT the
low loosens the lock requirements to allow some forms of unaligned dio writes to occur under shared lock, but AFAICT the inline data check was technically already racy for any dio write that would have involved a lock cycle. Regardless, lift clearing of the state bit to the same lock critical section that checks for preexisting inline data on the inode to close the race. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e3b83d87c93eb6fc96a80b5e8527f7dc9f5a11bc - https://git.kernel.org/stable/c/7343c23ebcadbedc23a7063d1e24d976eccb0d0d - https://git.kernel.org/stable/c/ce56d21355cd6f6937aca32f1f44ca749d1e4808
CVE ID: CVE-2023-52787 State: PUBLISHED Published: 2024-05-21T15:31:04.343Z Last Updated: 2025-05-04T07:43:12.344Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: blk-mq: make sure active queue usage is held for bio_integrity_prep() blk_integrity_unregister() can come if queue usage counter isn't held for one bio with integrity prepared, so this request may be completed with calling profile->complete_fn, then kernel panic. Another constraint is that bio_integrity_prep() needs to be called before bio merge. Fix the issue by: - call bio_integrity_prep() with one queue usage counter grabbed reliably - call bio_integrity_prep() befo
the issue by: - call bio_integrity_prep() with one queue usage counter grabbed reliably - call bio_integrity_prep() before bio merge Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9 - https://git.kernel.org/stable/c/e9c309ded295b7f8849097d71ae231456ca79f78 - https://git.kernel.org/stable/c/b80056bd75a16e4550873ecefe12bc8fd190b1cf - https://git.kernel.org/stable/c/b0077e269f6c152e807fdac90b58caf012cdbaab
CVE ID: CVE-2023-52788 State: PUBLISHED Published: 2024-05-21T15:31:04.980Z Last Updated: 2025-05-04T07:43:13.520Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i915/perf: Fix NULL deref bugs with drm_dbg() calls When i915 perf interface is not available dereferencing it will lead to NULL dereferences. As returning -ENOTSUPP is pretty clear return when perf interface is not available. [tursulin: added stable tag] (cherry picked from commit 36f27350ff745bd228ab04d7845dfbffc177a889) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1566e8be73fd5fa424e88d2a4c
CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1566e8be73fd5fa424e88d2a4cffdc34f970f0e1 - https://git.kernel.org/stable/c/55db76caa782baa4a1bf02296e2773c38a524a3e - https://git.kernel.org/stable/c/bf8e105030083e7b71591cdf437e464bcd8a0c09 - https://git.kernel.org/stable/c/10f49cdfd5fb342a1a9641930dc040c570694e98 - https://git.kernel.org/stable/c/471aa951bf1206d3c10d0daa67005b8e4db4ff83
CVE ID: CVE-2023-52789 State: PUBLISHED Published: 2024-05-21T15:31:05.616Z Last Updated: 2025-05-04T07:43:14.701Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tty: vcc: Add check for kstrdup() in vcc_probe() Add check for the return value of kstrdup() and return the error, if it fails in order to avoid NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/38cd56fc9de78bf3c878790785e8c231116ef9d3 - https://git.kernel.org/stable/c/909963e0c16778cec28efb1affc21558825f4200 - https://git.kernel.org/stable/c/460284dfb10b207980c6f3f7046e33
l.org/stable/c/909963e0c16778cec28efb1affc21558825f4200 - https://git.kernel.org/stable/c/460284dfb10b207980c6f3f7046e33446ceb38ac - https://git.kernel.org/stable/c/4ef41a7f33ffe1a335e7db7e1564ddc6afad47cc - https://git.kernel.org/stable/c/6c80f48912b5bd4965352d1a9a989e21743a4a06 - https://git.kernel.org/stable/c/7cebc86481bf16049e266f6774d90f2fd4f8d5d2 - https://git.kernel.org/stable/c/4a24a31826246b15477399febd13292b0c9f0ee9 - https://git.kernel.org/stable/c/8f8771757b130383732195497e47fba2aba76d3a - https://git.kernel.org/stable/c/d81ffb87aaa75f842cd7aa57091810353755b3e6
CVE ID: CVE-2023-52790 State: PUBLISHED Published: 2024-05-21T15:31:06.319Z Last Updated: 2025-05-04T07:43:15.723Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC Limit the free list length to the size of the IO TLB. Transient pool can be smaller than IO_TLB_SEGSIZE, but the free list is initialized with the assumption that the total number of slots is a multiple of IO_TLB_SEGSIZE. As a result, swiotlb_area_find_slots() may allocate slots past the end of a transient IO TLB buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Ref
st the end of a transient IO TLB buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ce7612496a4ba6068bc68aa1fa9d947dadb4ad9b - https://git.kernel.org/stable/c/53c87e846e335e3c18044c397cc35178163d7827
CVE ID: CVE-2023-52791 State: PUBLISHED Published: 2024-05-21T15:31:06.997Z Last Updated: 2025-05-04T07:43:16.771Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i2c: core: Run atomic i2c xfer when !preemptible Since bae1d3a05a8b, i2c transfers are non-atomic if preemption is disabled. However, non-atomic i2c transfers require preemption (e.g. in wait_for_completion() while waiting for the DMA). panic() calls preempt_disable_notrace() before calling emergency_restart(). Therefore, if an i2c device is used for the restart, the xfer should be atomic. This avoids warnings like: [ 12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tre
the restart, the xfer should be atomic. This avoids warnings like: [ 12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x33c/0x6b0 [ 12.676926] Voluntary context switch within RCU read-side critical section! ... [ 12.742376] schedule_timeout from wait_for_completion_timeout+0x90/0x114 [ 12.749179] wait_for_completion_timeout from tegra_i2c_wait_completion+0x40/0x70 ... [ 12.994527] atomic_notifier_call_chain from machine_restart+0x34/0x58 [ 13.001050] machine_restart from panic+0x2a8/0x32c Use !preemptible() instead, which is basically the same check as pre-v5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
y the same check as pre-v5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/25eb381a736e7ae39a4245ef5c96484eb1073809 - https://git.kernel.org/stable/c/25284c46b657f48c0f3880a2e0706c70d81182c0 - https://git.kernel.org/stable/c/f6237afabc349c1c7909db00e15d2816519e0d2b - https://git.kernel.org/stable/c/185f3617adc8fe45e40489b458f03911f0dec46c - https://git.kernel.org/stable/c/8c3fa52a46ff4d208cefb1a462ec94e0043a91e1 - https://git.kernel.org/stable/c/3473cf43b9068b9dfef2f545f833f33c6a544b91 - https://git.kernel.org/stable/c/aa49c90894d06e18a1ee7c095edbd2f37c232d02
CVE ID: CVE-2023-52792 State: PUBLISHED Published: 2024-05-21T15:31:07.633Z Last Updated: 2025-05-04T07:43:17.847Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cxl/region: Do not try to cleanup after cxl_region_setup_targets() fails Commit 5e42bcbc3fef ("cxl/region: decrement ->nr_targets on error in cxl_region_attach()") tried to avoid 'eiw' initialization errors when ->nr_targets exceeded 16, by just decrementing ->nr_targets when cxl_region_setup_targets() failed. Commit 86987c766276 ("cxl/region: Cleanup target list on attach error") extended that cleanup to also clear cxled->pos and p->targets[pos]. The initialization er
target list on attach error") extended that cleanup to also clear cxled->pos and p->targets[pos]. The initialization error was incidentally fixed separately by: Commit 8d4285425714 ("cxl/region: Fix port setup uninitialized variable warnings") which was merged a few days after 5e42bcbc3fef. But now the original cleanup when cxl_region_setup_targets() fails prevents endpoint and switch decoder resources from being reused: 1) the cleanup does not set the decoder's region to NULL, which results in future dpa_size_store() calls returning -EBUSY 2) the decoder is not properly freed, which results in future commit errors associated with the upstream switch Now that the initialization errors were
reed, which results in future commit errors associated with the upstream switch Now that the initialization errors were fixed separately, the proper cleanup for this case is to just return immediately. Then the resources associated with this target get cleanup up as normal when the failed region is deleted. The ->nr_targets decrement in the error case also helped prevent a p->targets[] array overflow, so add a new check to prevent against that overflow. Tested by trying to create an invalid region for a 2 switch * 2 endpoint topology, and then following up with creating a valid region. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kerne
alid region. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/90db4c1d5ebaf574d3c3065c055977982c378a83 - https://git.kernel.org/stable/c/9090c5537c93cd0811ab7bfbd925b57addfffb60 - https://git.kernel.org/stable/c/07ffcd8ec79cf7383e1e45815f4842fd357991c2 - https://git.kernel.org/stable/c/0718588c7aaa7a1510b4de972370535b61dddd0d
CVE ID: CVE-2023-52793 State: REJECTED Published: 2024-05-21T15:31:08.299Z Last Updated: 2024-05-24T04:35:34.485Z Description: No description available.
CVE ID: CVE-2023-52794 State: PUBLISHED Published: 2024-05-21T15:31:08.970Z Last Updated: 2025-05-04T07:43:19.101Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal: intel: powerclamp: fix mismatch in get function for max_idle KASAN reported this [ 444.853098] BUG: KASAN: global-out-of-bounds in param_get_int+0x77/0x90 [ 444.853111] Read of size 4 at addr ffffffffc16c9220 by task cat/2105 ... [ 444.853442] The buggy address belongs to the variable: [ 444.853443] max_idle+0x0/0xffffffffffffcde0 [intel_powerclamp] There is a mismatch between the param_get_int and the definition of max_idle. Replacing param_get_int with param
rclamp] There is a mismatch between the param_get_int and the definition of max_idle. Replacing param_get_int with param_get_byte resolves this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6a3866dbdcf39ac93e98708e6abced511733dc18 - https://git.kernel.org/stable/c/0a8585281b11e3a0723bba8d8085d61f0b55f37c - https://git.kernel.org/stable/c/fae633cfb729da2771b5433f6b84ae7e8b4aa5f7
CVE ID: CVE-2023-52795 State: PUBLISHED Published: 2024-05-21T15:31:09.623Z Last Updated: 2025-05-04T07:43:20.364Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix use after free in vhost_vdpa_probe() The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_simple_remove() is a use after free and a double free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c0f8b8fb7df9d1a38652eb5aa817afccd3c56111 - https://git.kernel.org/stable/c/ae8ea4e200675a940c365b496ef8e3fb4123601c - https://gi
7df9d1a38652eb5aa817afccd3c56111 - https://git.kernel.org/stable/c/ae8ea4e200675a940c365b496ef8e3fb4123601c - https://git.kernel.org/stable/c/bf04132cd64ccde4e9e9765d489c83fe83c09b7f - https://git.kernel.org/stable/c/e07754e0a1ea2d63fb29574253d1fd7405607343
CVE ID: CVE-2023-52796 State: PUBLISHED Published: 2024-05-21T15:31:10.290Z Last Updated: 2025-05-04T07:43:21.587Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_outbound() helper Inspired by syzbot reports using a stack of multiple ipvlan devices. Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack, immediately reclaimed. Also make sure ipvlan_process_v4_outbound() is not inlined. We might also have to lower MAX_NEST_DEV, because only syzbot uses setups with mo
_process_v4_outbound() is not inlined. We might also have to lower MAX_NEST_DEV, because only syzbot uses setups with more than four stacked devices. BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000) stack guard page: 0000 [#1] SMP KASAN CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188 Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 0
0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 RSP: 0018:ffffc9000e804000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568 RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000 FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 DR0:
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <#DF> </#DF> <TASK> [<ffffffff81f281d1>] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 [<ffffffff817e5bf2>] instrument_atomic_read include/linux/instrumented.h:72 [inline] [<ffffffff817e5bf2>] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] [<ffffffff817e5bf2>] cpumask_test_cpu include/linux/cpumask.h:506 [inline] [<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline] [<ffffffff817e5bf2>] t
inux/cpumask.h:506 [inline] [<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline] [<ffffffff817e5bf2>] trace_lock_acquire include/trace/events/lock.h:24 [inline] [<ffffffff817e5bf2>] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632 [<ffffffff8563221e>] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306 [<ffffffff8561464d>] rcu_read_lock include/linux/rcupdate.h:747 [inline] [<ffffffff8561464d>] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221 [<ffffffff85618120>] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606 [<ffffffff856f65b5>] pol_lookup_func include/net/ip6_fib.h:584 [inline] [<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116 [<fff
unc include/net/ip6_fib.h:584 [inline] [<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116 [<ffffffff85618009>] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638 [<ffffffff8561821a>] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651 [<ffffffff838bd5a3>] ip6_route_output include/net/ip6_route.h:100 [inline] [<ffffffff838bd5a3>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline] [<ffffffff838bd5a3>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff838bd5a3>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan
vers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] [<f ---truncated--- Additional Analyst Notes: -
ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] [<f ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4f7f850611aa27aaaf1bf5687702ad2240ae442a - https://git.kernel.org/stable/c/4d2d30f0792b47908af64c4d02ed1ee25ff50542 - https://git.kernel.org/stable/c/43b781e7cb5cd0b435de276111953bf2bacd1f02 - https://git.kernel.org/stable/c/1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f - https://git.kernel.org/stable/c/732a67ca436887b594ebc43bb5a04ffb0971a760 - https://git.kernel.org/stable/c/8872dc638c24bb774cd2224a69d72a7f661a4d56 - https://git.kernel.org/stable/c/03cddc4df8c6be47fd27c8f8b87e5f9a989e
stable/c/8872dc638c24bb774cd2224a69d72a7f661a4d56 - https://git.kernel.org/stable/c/03cddc4df8c6be47fd27c8f8b87e5f9a989e1458 - https://git.kernel.org/stable/c/18f039428c7df183b09c69ebf10ffd4e521035d2
CVE ID: CVE-2023-52797 State: PUBLISHED Published: 2024-05-21T15:31:10.952Z Last Updated: 2025-05-04T07:43:22.895Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers: perf: Check find_first_bit() return value We must check the return value of find_first_bit() before using the return value as an index array since it happens to overflow the array and then panic: [ 107.318430] Kernel BUG [#1] [ 107.319434] CPU: 3 PID: 1238 Comm: kill Tainted: G E 6.6.0-rc6ubuntu-defconfig #2 [ 107.319465] Hardware name: riscv-virtio,qemu (DT) [ 107.319551] epc : pmu_sbi_ovf_handler+0x3a4/0x3ae [ 107.319840] ra : pmu_sbi_ovf_handler+0x52/0x3ae
-virtio,qemu (DT) [ 107.319551] epc : pmu_sbi_ovf_handler+0x3a4/0x3ae [ 107.319840] ra : pmu_sbi_ovf_handler+0x52/0x3ae [ 107.319868] epc : ffffffff80a0a77c ra : ffffffff80a0a42a sp : ffffaf83fecda350 [ 107.319884] gp : ffffffff823961a8 tp : ffffaf8083db1dc0 t0 : ffffaf83fecda480 [ 107.319899] t1 : ffffffff80cafe62 t2 : 000000000000ff00 s0 : ffffaf83fecda520 [ 107.319921] s1 : ffffaf83fecda380 a0 : 00000018fca29df0 a1 : ffffffffffffffff [ 107.319936] a2 : 0000000001073734 a3 : 0000000000000004 a4 : 0000000000000000 [ 107.319951] a5 : 0000000000000040 a6 : 000000001d1c8774 a7 : 0000000000504d55 [ 107.319965] s2 : ffffffff82451f10 s3 : ffffffff82724e70 s4 : 000000000000003f [ 107.319980] s5 :
7 : 0000000000504d55 [ 107.319965] s2 : ffffffff82451f10 s3 : ffffffff82724e70 s4 : 000000000000003f [ 107.319980] s5 : 0000000000000011 s6 : ffffaf8083db27c0 s7 : 0000000000000000 [ 107.319995] s8 : 0000000000000001 s9 : 00007fffb45d6558 s10: 00007fffb45d81a0 [ 107.320009] s11: ffffaf7ffff60000 t3 : 0000000000000004 t4 : 0000000000000000 [ 107.320023] t5 : ffffaf7f80000000 t6 : ffffaf8000000000 [ 107.320037] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003 [ 107.320081] [<ffffffff80a0a77c>] pmu_sbi_ovf_handler+0x3a4/0x3ae [ 107.320112] [<ffffffff800b42d0>] handle_percpu_devid_irq+0x9e/0x1a0 [ 107.320131] [<ffffffff800ad92c>] generic_handle_domain_irq+0x28/0x36 [ 10
00b42d0>] handle_percpu_devid_irq+0x9e/0x1a0 [ 107.320131] [<ffffffff800ad92c>] generic_handle_domain_irq+0x28/0x36 [ 107.320148] [<ffffffff8065f9f8>] riscv_intc_irq+0x36/0x4e [ 107.320166] [<ffffffff80caf4a0>] handle_riscv_irq+0x54/0x86 [ 107.320189] [<ffffffff80cb0036>] do_irq+0x64/0x96 [ 107.320271] Code: 85a6 855e b097 ff7f 80e7 9220 b709 9002 4501 bbd9 (9002) 6097 [ 107.320585] ---[ end trace 0000000000000000 ]--- [ 107.320704] Kernel panic - not syncing: Fatal exception in interrupt [ 107.320775] SMP: stopping secondary CPUs [ 107.321219] Kernel Offset: 0x0 from 0xffffffff80000000 [ 107.333051] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Additional Analyst No