Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-36010 State: PUBLISHED Published: 2024-05-22T11:46:32.984Z Last Updated: 2025-05-04T09:10:26.508Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: igb: Fix string truncation warnings in igb_set_fw_version Commit 1978d3ead82c ("intel: fix string truncation warnings") fixes '-Wformat-truncation=' warnings in igb_main.c by using kasprintf. drivers/net/ethernet/intel/igb/igb_main.c:3092:53: warning：‘%d’ directive output may be truncated writing between 1 and 5 bytes into a region of size between 1 and 13 [-Wformat-truncation=] 3092 | "%d.%d, 0x%08x, %d.%d.%d", | ^~ drivers/net/ethernet/intel/igb/igb_main.c:3092:34: n
nd 13 [-Wformat-truncation=] 3092 | "%d.%d, 0x%08x, %d.%d.%d", | ^~ drivers/net/ethernet/intel/igb/igb_main.c:3092:34: note：directive argument in the range [0, 65535] 3092 | "%d.%d, 0x%08x, %d.%d.%d", | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/intel/igb/igb_main.c:3092:34: note：directive argument in the range [0, 65535] drivers/net/ethernet/intel/igb/igb_main.c:3090:25: note：‘snprintf’ output between 23 and 43 bytes into a destination of size 32 kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Fix this warning by using a larger space for adapter->fw_version, and then fall back and continue to use snprintf. Additional Analyst Notes: - CISA AD
rger space for adapter->fw_version, and then fall back and continue to use snprintf. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c56d055893cbe97848611855d1c97d0ab171eccc
CVE ID: CVE-2024-36011 State: PUBLISHED Published: 2024-05-23T07:03:06.225Z Last Updated: 2025-05-07T19:48:25.589Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Fix potential null-ptr-deref Fix potential null-ptr-deref in hci_le_big_sync_established_evt(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1f7ebb69c1d65732bcac2fda9d15421f76f01e81 - https://git.kernel.org/stable/c/9f3be61f55d4eedc20eedc56c0f04a5ce2b4a55a - https://git.kernel.org/stable/c/d2706004a1b8b526592e823d7e52551b518a7941
CVE ID: CVE-2024-36012 State: PUBLISHED Published: 2024-05-23T07:03:06.904Z Last Updated: 2025-05-04T09:10:28.848Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msft_do_close() Tying the msft->data lifetime to hdev by freeing it in hci_release_dev() to fix the following case: [use] msft_do_close() msft = hdev->msft_data; if (!msft) ...(1) <- passed. return; mutex_lock(&msft->filter_lock); ...(4) <- used after freed. [free] msft_unregister() msft = hdev->msft_data; hdev->msft_data = NULL; ...(2) kfree(msft); ...(3) <- msft is freed. ====================================================
dev->msft_data = NULL; ...(2) kfree(msft); ...(3) <- msft is freed. ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e3880b531b68f98d3941d83f2f6dd11cf4fd6b76 - https://git.kernel.org/stable/c/a85a60e62355e3bf4802dead7938966824b23940 - https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56 - https://
e62355e3bf4802dead7938966824b23940 - https://git.kernel.org/stable/c/4f1de02de07748da80a8178879bc7a1df37fdf56 - https://git.kernel.org/stable/c/10f9f426ac6e752c8d87bf4346930ba347aaabac
CVE ID: CVE-2024-36013 State: PUBLISHED Published: 2024-05-23T07:03:07.571Z Last Updated: 2025-05-04T09:10:30.158Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_c
w the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free [free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: sla
eed └ mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5 - https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d
el.org/stable/c/cfe560c7050bfb37b0d2491bbe7cd8b59e77fdc5 - https://git.kernel.org/stable/c/826af9d2f69567c646ff46d10393d47e30ad23c6 - https://git.kernel.org/stable/c/4d7b41c0e43995b0e992b9f8903109275744b658
CVE ID: CVE-2024-36014 State: PUBLISHED Published: 2024-05-29T06:06:25.631Z Last Updated: 2025-11-04T17:20:54.977Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/arm/malidp: fix a possible null pointer dereference In malidp_mw_connector_reset, new memory is allocated with kzalloc, but no check is performed. In order to prevent null pointer dereferencing, ensure that mw_state is checked before calling __drm_atomic_helper_connector_reset. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b6cc5dd06336ed8bb3a7a1fc5aaf7d5e88bc0818 - https://git.kernel.org/st
iner: References: - https://git.kernel.org/stable/c/b6cc5dd06336ed8bb3a7a1fc5aaf7d5e88bc0818 - https://git.kernel.org/stable/c/565d9ad7e5a18eb69ed8b66a9e9bb3f45346520c - https://git.kernel.org/stable/c/a5fa5b40a278a3ca978fed64707bd27614adb1eb - https://git.kernel.org/stable/c/3e54d4e95120641216dfe91a6c49f116a9f68490 - https://git.kernel.org/stable/c/e4b52d49383306ef73fd1bd9102538beebb0fe07 - https://git.kernel.org/stable/c/335cc45ef2b81b68be63c698b4f867a530bdf7a5 - https://git.kernel.org/stable/c/b77620730f614059db2470e8ebab3e725280fc6d - https://git.kernel.org/stable/c/93f76ec1eddce60dbb5885cbc0d7df54adee4639 - https://git.kernel.org/stable/c/a1f95aede6285dba6dd036d907196f35ae3a11ea
CVE ID: CVE-2024-36015 State: PUBLISHED Published: 2024-05-29T07:35:04.506Z Last Updated: 2025-11-04T17:20:56.337Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in register_device In register_device, the return value of ida_simple_get is unchecked, in witch ida_simple_get will use an invalid index value. To address this issue, index should be checked after ida_simple_get. When the index value is abnormal, a warning message should be printed, the port should be dropped, and the value should be recorded. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gi
should be recorded. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/65cd017d43f4319a56747d38308b0a24cf57299e - https://git.kernel.org/stable/c/b8c6b83cc3adff3ddf403c8c7063fe6d08b2b9d9 - https://git.kernel.org/stable/c/d32caf51379a4d71db03d3d4d7c22d27cdf7f68b - https://git.kernel.org/stable/c/b65d0410b879af0295d22438a4a32012786d152a - https://git.kernel.org/stable/c/df9329247dbbf00f6057e002139ab3fa529ad828 - https://git.kernel.org/stable/c/ec3468221efec6660ff656e9ebe51ced3520fc57 - https://git.kernel.org/stable/c/5d5b24edad1107a2ffa99058f20f6aeeafeb5d39 - https://git.kernel.org/stable/c/fbf740aeb86a4fe82ad158d26d711f2f3
rg/stable/c/5d5b24edad1107a2ffa99058f20f6aeeafeb5d39 - https://git.kernel.org/stable/c/fbf740aeb86a4fe82ad158d26d711f2f3be79b3e
CVE ID: CVE-2024-36016 State: PUBLISHED Published: 2024-05-29T18:46:34.778Z Last Updated: 2025-11-04T17:20:57.711Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither
- side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru. All other checks remain as we still need to limit the data according to the user configuration and actual payload size. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e
richment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5 - https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56 - https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04 - https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54 - https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc - https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350 - https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3 - https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d - https://git.kernel.org/stable/c/47388e807f85948eefc
//git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d - https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a
CVE ID: CVE-2024-36017 State: PUBLISHED Published: 2024-05-30T12:52:03.554Z Last Updated: 2025-05-04T09:10:39.898Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes) which is less than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too small attribute might be cast to a str
than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too small attribute might be cast to a struct ifla_vf_vlan_info, this might result in an out of bands read access when accessing the saved (casted) entry in ivvl. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8ac69ff2d0d5be9734c4402de932aa3dc8549c1a - https://git.kernel.org/stable/c/5e7ef2d88666a0212db8c38e6703864b9ce70169 - https://git.kernel.org/stable/c/6c8f44b02500c7d14b5e6618fe4ef9a0da47b3de - https://git.kernel.org/stable/c/f3c1bf3054f96ddeab0621d920445bada769b40e - https://git.kernel.org/stable/c/6e4c7193954f4faab92f6e8d88bc5565317b4
table/c/f3c1bf3054f96ddeab0621d920445bada769b40e - https://git.kernel.org/stable/c/6e4c7193954f4faab92f6e8d88bc5565317b44e7 - https://git.kernel.org/stable/c/206003c748b88890a910ef7142d18f77be57550b - https://git.kernel.org/stable/c/4a4b9757789a1551d2df130df23bfb3545bfa7e8 - https://git.kernel.org/stable/c/1aec77b2bb2ed1db0f5efc61c4c1ca3813307489
CVE ID: CVE-2024-36018 State: PUBLISHED Published: 2024-05-30T14:59:42.091Z Last Updated: 2025-05-04T09:10:41.008Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nouveau/uvmm: fix addr/range calcs for remap operations dEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8 was causing a remap operation like the below. op_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000 op_remap: next: op_remap: unmap: 0000003fffed0000 0000000000100000 0 op_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000 This was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x10000
0000010000 000000005b1ba33c 00000000000e0000 This was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000 which was corrupting the pagetables and oopsing the kernel. Fixes the prev + unmap range calcs to use start/end and map back to addr/range. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/692a51bebf4552bdf0a79ccd68d291182a26a569 - https://git.kernel.org/stable/c/0c16020d2b69a602c8ae6a1dd2aac9a3023249d6 - https://git.kernel.org/stable/c/be141849ec00ef39935bf169c0f194ac70bf85ce
CVE ID: CVE-2024-36019 State: PUBLISHED Published: 2024-05-30T14:59:42.840Z Last Updated: 2025-05-04T09:10:42.264Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: regmap: maple: Fix cache corruption in regcache_maple_drop() When keeping the upper end of a cache block entry, the entry[] array must be indexed by the offset from the base register of the block, i.e. max - mas.index. The code was indexing entry[] by only the register address, leading to an out-of-bounds access that copied some part of the kernel memory over the cache contents. This bug was not detected by the regmap KUnit test because it only tests with a block of re
ory over the cache contents. This bug was not detected by the regmap KUnit test because it only tests with a block of registers starting at 0, so mas.index == 0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3af6c5ac72dc5b721058132a0a1d7779e443175e - https://git.kernel.org/stable/c/51c4440b9d3fd7c8234e6de9170a487c03506e53 - https://git.kernel.org/stable/c/00bb549d7d63a21532e76e4a334d7807a54d9f31
CVE ID: CVE-2024-36020 State: PUBLISHED Published: 2024-05-30T14:59:44.447Z Last Updated: 2025-05-04T12:56:17.412Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with resets races. Using two sources for the information is the root cause. In this function before the fix bumping v didn't mean bumping vf pointer. But the code used this variables interchangeably, so stale vf could point to different/not intended vf. Remove redundant "v" variable and i
his variables interchangeably, so stale vf could point to different/not intended vf. Remove redundant "v" variable and iterate via single VF pointer across whole function instead to guarantee VF pointer validity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d - https://git.kernel.org/stable/c/9dcf0fcb80f6aeb01469e3c957f8d4c97365450a - https://git.kernel.org/stable/c/b8e82128b44fa40bf99a50b919488ef361e1683c - https://git.kernel.org/stable/c/951d2748a2a8242853abc3d0c153ce4bf8faad31 - https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba - https://git.kernel.org
c3d0c153ce4bf8faad31 - https://git.kernel.org/stable/c/3e89846283f3cf7c7a8e28b342576fd7c561d2ba - https://git.kernel.org/stable/c/0dcf573f997732702917af1563aa2493dc772fc0 - https://git.kernel.org/stable/c/06df7618f591b2dc43c59967e294d7b9fc8675b6 - https://git.kernel.org/stable/c/f37c4eac99c258111d414d31b740437e1925b8e8
CVE ID: CVE-2024-36021 State: PUBLISHED Published: 2024-05-30T14:59:45.757Z Last Updated: 2025-05-04T09:10:44.480Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when devlink reload during pf initialization The devlink reload process will access the hardware resources, but the register operation is done before the hardware is initialized. So, processing the devlink reload during initialization may lead to kernel crash. This patch fixes this by taking devl_lock during initialization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/50b69054f455dcdb34bd6b22764c7579b270eef3 - https://git.kernel.org/stable/c/1b550dae55901c2cc9075d6a7155a71b4f516e86 - https://git.kernel.org/stable/c/7ca0f73e5e2da3c129935b97f3a0877cce8ebdf5 - https://git.kernel.org/stable/c/93305b77ffcb042f1538ecc383505e87d95aa05a
CVE ID: CVE-2024-36022 State: REJECTED Published: 2024-05-30T15:03:59.678Z Last Updated: 2025-06-19T13:03:48.081Z Description: No description available.
CVE ID: CVE-2024-36023 State: PUBLISHED Published: 2024-05-30T15:04:00.404Z Last Updated: 2025-05-04T09:10:47.016Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Julia Lawall reported this null pointer dereference, this should fix it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2e2177f94c0e0bc41323d7b6975a5f4820ed347e - https://git.kernel.org/stable/c/214a6c4a28c11d67044e6cf3a0ab415050d9f03a - https://git.kernel.org/stable/c/b972e8ac3f44f693127a2806031962d100dfc4d1 - https://git.kernel.org/stable/c/9bf93dcfc453fae192fe5d7874b89699e8f800ac
CVE ID: CVE-2024-36024 State: PUBLISHED Published: 2024-05-30T15:04:01.114Z Last Updated: 2025-07-11T17:19:43.927Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Disable idle reallow as part of command/gpint execution [Why] Workaroud for a race condition where DMCUB is in the process of committing to IPS1 during the handshake causing us to miss the transition into IPS2 and touch the INBOX1 RPTR causing a HW hang. [How] Disable the reallow to ensure that we have enough of a gap between entry and exit and we're not seeing back-to-back wake_and_executes. Additional Analyst Notes: - CVE Program Container: - CISA AD
d exit and we're not seeing back-to-back wake_and_executes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2aac387445610d6dfd681f5214388e86f5677ef7 - https://git.kernel.org/stable/c/6226a5aa77370329e01ee8abe50a95e60618ce97
CVE ID: CVE-2024-36025 State: PUBLISHED Published: 2024-05-30T15:07:30.702Z Last Updated: 2025-05-04T09:10:49.523Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() The app_reply->elem[] array is allocated earlier in this function and it has app_req.num_ports elements. Thus this > comparison needs to be >= to prevent memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8c820f7c8e9b46238d277c575392fe9930207aab - https://git.kernel.org/stable/c/9fc74e367be4247a5ac39bb8ec41eaa73fade510 - htt
c820f7c8e9b46238d277c575392fe9930207aab - https://git.kernel.org/stable/c/9fc74e367be4247a5ac39bb8ec41eaa73fade510 - https://git.kernel.org/stable/c/60b87b5ecbe07d70897d35947b0bb3e76ccd1b3a - https://git.kernel.org/stable/c/ea8ac95c22c93acecb710209a7fd10b851afe817 - https://git.kernel.org/stable/c/4406e4176f47177f5e51b4cc7e6a7a2ff3dbfbbd
CVE ID: CVE-2024-36026 State: PUBLISHED Published: 2024-05-30T15:07:31.295Z Last Updated: 2025-05-04T09:10:50.684Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 While doing multiple S4 stress tests, GC/RLC/PMFW get into an invalid state resulting into hard hangs. Adding a GFX reset as workaround just before sending the MP1_UNLOAD message avoids this failure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/bd9b94055c3deb2398ee4490c1dfdf03f53efb8f - https://git.kernel.org/stable/c/1e3b8874d55c0c28378
//git.kernel.org/stable/c/bd9b94055c3deb2398ee4490c1dfdf03f53efb8f - https://git.kernel.org/stable/c/1e3b8874d55c0c28378beb9007494a7a9269a5f5 - https://git.kernel.org/stable/c/7521329e54931ede9e042bbf5f4f812b5bc4a01d - https://git.kernel.org/stable/c/31729e8c21ecfd671458e02b6511eb68c2225113
CVE ID: CVE-2024-36027 State: PUBLISHED Published: 2024-05-30T15:10:17.129Z Last Updated: 2025-05-04T09:10:51.723Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer Btrfs clears the content of an extent buffer marked as EXTENT_BUFFER_ZONED_ZEROOUT before the bio submission. This mechanism is introduced to prevent a write hole of an extent buffer, which is once allocated, marked dirty, but turns out unnecessary and cleaned up within one transaction operation. Currently, btrfs_clear_buffer_dirty() marks the extent buffer as EXTENT_BUFFER_ZONED_ZEROOUT, and skips the entry
tion. Currently, btrfs_clear_buffer_dirty() marks the extent buffer as EXTENT_BUFFER_ZONED_ZEROOUT, and skips the entry function. If this call happens while the buffer is under IO (with the WRITEBACK flag set, without the DIRTY flag), we can add the ZEROOUT flag and clear the buffer's content just before a bio submission. As a result: 1) it can lead to adding faulty delayed reference item which leads to a FS corrupted (EUCLEAN) error, and 2) it writes out cleared tree node on disk The former issue is previously discussed in [1]. The corruption happens when it runs a delayed reference update. So, on-disk data is safe. [1] https://lore.kernel.org/linux-btrfs/3f4f2a0ff1a6c818050434288925bdcf3cd
reference update. So, on-disk data is safe. [1] https://lore.kernel.org/linux-btrfs/3f4f2a0ff1a6c818050434288925bdcf3cd719e5.1709124777.git.naohiro.aota@wdc.com/ The latter one can reach on-disk data. But, as that node is already processed by btrfs_clear_buffer_dirty(), that will be invalidated in the next transaction commit anyway. So, the chance of hitting the corruption is relatively small. Anyway, we should skip flagging ZEROOUT on a non-DIRTY extent buffer, to keep the content under IO intact. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f4b994fccbb6f294c4b31a6ca0114b09f7245043 - https://git.kernel.org/stable/