Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-47000 State: PUBLISHED Published: 2024-02-28T08:13:22.868Z Last Updated: 2025-05-07T20:03:46.719Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ceph: fix inode leak on getattr error in __fh_to_dentry Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2ad8af2b70e986284050213230428b823b950a38 - https://git.kernel.org/stable/c/bf45c9fe99aa8003d2703f1bd353f956dea47e40 - https://git.kernel.org/stable/c/22fa4c8288f1ec40f6d62d7a32c57ac176f9f0bc - https://git.kernel.org/stable/c/0a219432127d396120fc88cabd82785e0ff72a2f - https://git.kernel.org/stab
2c57ac176f9f0bc - https://git.kernel.org/stable/c/0a219432127d396120fc88cabd82785e0ff72a2f - https://git.kernel.org/stable/c/1775c7ddacfcea29051c67409087578f8f4d751b
CVE ID: CVE-2021-47001 State: PUBLISHED Published: 2024-02-28T08:13:23.482Z Last Updated: 2025-05-04T12:40:48.260Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix cwnd update ordering After a reconnect, the reply handler is opening the cwnd (and thus enabling more RPC Calls to be sent) /before/ rpcrdma_post_recvs() can post enough Receive WRs to receive their replies. This causes an RNR and the new connection is lost immediately. The race is most clearly exposed when KASAN and disconnect injection are enabled. This slows down rpcrdma_rep_create() enough to allow the send side to post a bunch of RPC Calls before the
are enabled. This slows down rpcrdma_rep_create() enough to allow the send side to post a bunch of RPC Calls before the Receive completion handler can invoke ib_post_recv(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/eddae8be7944096419c2ae29477a45f767d0fcd4 - https://git.kernel.org/stable/c/8834ecb5df22b7ff3c9b0deba7726579bb613f95 - https://git.kernel.org/stable/c/19b5fa9489b5706bc878c3a522a7f771079e2fa0 - https://git.kernel.org/stable/c/35d8b10a25884050bb3b0149b62c3818ec59f77c
CVE ID: CVE-2021-47002 State: PUBLISHED Published: 2024-02-28T08:13:24.091Z Last Updated: 2025-05-04T07:02:05.909Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null pointer dereference in svc_rqst_free() When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). Fix it by adding a null check. Addresses-Coverity: ("Dereference after null check") Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3de81c1e84bf84803308da3272a829a7655c5336 - https://git.
Program Container: References: - https://git.kernel.org/stable/c/3de81c1e84bf84803308da3272a829a7655c5336 - https://git.kernel.org/stable/c/1e10f58f1c9a6b667b045513c7a4e6111c24fe7c - https://git.kernel.org/stable/c/c664aaec9aee544538a78ba4893a44bc73a6d742 - https://git.kernel.org/stable/c/b9f83ffaa0c096b4c832a43964fe6bff3acffe10
CVE ID: CVE-2021-47003 State: PUBLISHED Published: 2024-02-28T08:13:24.712Z Last Updated: 2025-05-04T07:02:06.974Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix potential null dereference on pointer status There are calls to idxd_cmd_exec that pass a null status pointer however a recent commit has added an assignment to *status that can end up with a null pointer dereference. The function expects a null status pointer sometimes as there is a later assignment to *status where status is first null checked. Fix the issue by null checking status before making the assignment. Addresses-Coverity: ("Explicit null
st null checked. Fix the issue by null checking status before making the assignment. Addresses-Coverity: ("Explicit null dereferenced") Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5756f757c72501ef1a16f5f63f940623044180e9 - https://git.kernel.org/stable/c/2280b4cc29d8cdd2be3d1b2d1ea4f958e2131c97 - https://git.kernel.org/stable/c/7bc402f843e7817a4a808e7b9ab0bcd7ffd55bfa - https://git.kernel.org/stable/c/28ac8e03c43dfc6a703aa420d18222540b801120
CVE ID: CVE-2021-47004 State: PUBLISHED Published: 2024-02-28T08:13:25.324Z Last Updated: 2025-05-04T07:02:08.051Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid touching checkpointed data in get_victim() In CP disabling mode, there are two issues when using LFS or SSR | AT_SSR mode to select victim: 1. LFS is set to find source section during GC, the victim should have no checkpointed data, since after GC, section could not be set free for reuse. Previously, we only check valid chpt blocks in current segment rather than section, fix it. 2. SSR | AT_SSR are set to find target segment for writes which can be f
in current segment rather than section, fix it. 2. SSR | AT_SSR are set to find target segment for writes which can be fully filled by checkpointed and newly written blocks, we should never select such segment, otherwise it can cause panic or data corruption during allocation, potential case is described as below: a) target segment has 'n' (n < 512) ckpt valid blocks b) GC migrates 'n' valid blocks to other segment (segment is still in dirty list) c) GC migrates '512 - n' blocks to target segment (segment has 'n' cp_vblocks and '512 - n' vblocks) d) If GC selects target segment via {AT,}SSR allocator, however there is no free space in targe segment. Additional Analyst Notes: - CVE Program Co
ment via {AT,}SSR allocator, however there is no free space in targe segment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/105155a8146ddb54c119d8318964eef3859d109d - https://git.kernel.org/stable/c/1e116f87825f01a6380286472196882746b16f63 - https://git.kernel.org/stable/c/211372b2571520e394b56b431a0705586013b3ff - https://git.kernel.org/stable/c/61461fc921b756ae16e64243f72af2bfc2e620db
CVE ID: CVE-2021-47005 State: PUBLISHED Published: 2024-02-28T08:13:25.933Z Last Updated: 2025-05-04T07:02:09.368Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix NULL pointer dereference for ->get_features() get_features ops of pci_epc_ops may return NULL, causing NULL pointer dereference in pci_epf_test_alloc_space function. Let us add a check for pci_epc_feature pointer in pci_epf_test_bind before we access it to avoid any such NULL pointer dereference and return -ENOTSUPP in case pci_epc_feature is not found. When the patch is not applied and EPC features is not implemented in the platform driver, we see t
feature is not found. When the patch is not applied and EPC features is not implemented in the platform driver, we see the following dump due to kernel NULL pointer dereference. Call trace: pci_epf_test_bind+0xf4/0x388 pci_epf_bind+0x3c/0x80 pci_epc_epf_link+0xa8/0xcc configfs_symlink+0x1a4/0x48c vfs_symlink+0x104/0x184 do_symlinkat+0x80/0xd4 __arm64_sys_symlinkat+0x1c/0x24 el0_svc_common.constprop.3+0xb8/0x170 el0_svc_handler+0x70/0x88 el0_svc+0x8/0x640 Code: d2800581 b9403ab9 f9404ebb 8b394f60 (f9400400) ---[ end trace a438e3c5a24f9df0 ]--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/bbed83d7060e07a5d309104d25a00
A ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/bbed83d7060e07a5d309104d25a00f0a24441428 - https://git.kernel.org/stable/c/679ebad058b8168f10e63876d63b0877fd2fe784 - https://git.kernel.org/stable/c/0169d4f0bee44fdfef908c13ed21fcb326c38695 - https://git.kernel.org/stable/c/6613bc2301ba291a1c5a90e1dc24cf3edf223c03
CVE ID: CVE-2021-47006 State: PUBLISHED Published: 2024-02-28T08:13:26.541Z Last Updated: 2025-05-04T07:02:10.811Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook The commit 1879445dfa7b ("perf/core: Set event's default ::overflow_handler()") set a default event->overflow_handler in perf_event_alloc(), and replace the check event->overflow_handler with is_default_overflow_handler(), but one is missing. Currently, the bp->overflow_handler can not be NULL. As a result, enable_single_step() is always not invoked. Comments from Zhen Lei: https://patc
w_handler can not be NULL. As a result, enable_single_step() is always not invoked. Comments from Zhen Lei: https://patchwork.kernel.org/project/linux-arm-kernel/patch/20210207105934.2001-1-thunder.leizhen@huawei.com/ Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/555a70f7fff03bd669123487905c47ae27dbdaac - https://git.kernel.org/stable/c/ed1f67465327cec4457bb988775245b199da86e6 - https://git.kernel.org/stable/c/a9938d6d78a238d6ab8de57a4d3dcf77adceb9bb - https://git.kernel.org/stable/c/3ed8832aeaa9a37b0fc386bb72ff604352567c80 - https://git.kernel.org/stable/c/630146203108bf6b8934eec0dfdb3e46dcb917de - https://git.kerne
b0fc386bb72ff604352567c80 - https://git.kernel.org/stable/c/630146203108bf6b8934eec0dfdb3e46dcb917de - https://git.kernel.org/stable/c/7eeacc6728c5478e3c01bc82a1f08958eaa12366 - https://git.kernel.org/stable/c/dabe299425b1a53a69461fed7ac8922ea6733a25 - https://git.kernel.org/stable/c/a506bd5756290821a4314f502b4bafc2afcf5260
CVE ID: CVE-2021-47007 State: PUBLISHED Published: 2024-02-28T08:13:27.159Z Last Updated: 2025-05-04T07:02:11.875Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix panic during f2fs_resize_fs() f2fs_resize_fs() hangs in below callstack with testcase: - mkfs 16GB image & mount image - dd 8GB fileA - dd 8GB fileB - sync - rm fileA - sync - resize filesystem to 8GB kernel BUG at segment.c:2484! Call Trace: allocate_segment_by_default+0x92/0xf0 [f2fs] f2fs_allocate_data_block+0x44b/0x7e0 [f2fs] do_write_page+0x5a/0x110 [f2fs] f2fs_outplace_write_data+0x55/0x100 [f2fs] f2fs_do_write_data_page+0x392/0x850 [f2fs] move_data_pag
ge+0x5a/0x110 [f2fs] f2fs_outplace_write_data+0x55/0x100 [f2fs] f2fs_do_write_data_page+0x392/0x850 [f2fs] move_data_page+0x233/0x320 [f2fs] do_garbage_collect+0x14d9/0x1660 [f2fs] free_segment_range+0x1f7/0x310 [f2fs] f2fs_resize_fs+0x118/0x330 [f2fs] __f2fs_ioctl+0x487/0x3680 [f2fs] __x64_sys_ioctl+0x8e/0xd0 do_syscall_64+0x33/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The root cause is we forgot to check that whether we have enough space in resized filesystem to store all valid blocks in before-resizing filesystem, then allocator will run out-of-space during block migration in free_segment_range(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
ration in free_segment_range(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1c20a4896409f5ca1c770e1880c33d0a28a8b10f - https://git.kernel.org/stable/c/860afd680d9cc1dabd61cda3cd246f60aa1eb705 - https://git.kernel.org/stable/c/822054e5026c43b1dd60cf387dd999e95ee2ecc2 - https://git.kernel.org/stable/c/3ab0598e6d860ef49d029943ba80f627c15c15d6
CVE ID: CVE-2021-47008 State: PUBLISHED Published: 2024-02-28T08:13:27.786Z Last Updated: 2025-05-04T07:02:13.088Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Make sure GHCB is mapped before updating Access to the GHCB is mainly in the VMGEXIT path and it is known that the GHCB will be mapped. But there are two paths where it is possible the GHCB might not be mapped. The sev_vcpu_deliver_sipi_vector() routine will update the GHCB to inform the caller of the AP Reset Hold NAE event that a SIPI has been delivered. However, if a SIPI is performed without a corresponding AP Reset Hold, then the GHCB might not be mapped
been delivered. However, if a SIPI is performed without a corresponding AP Reset Hold, then the GHCB might not be mapped (depending on the previous VMEXIT), which will result in a NULL pointer dereference. The svm_complete_emulated_msr() routine will update the GHCB to inform the caller of a RDMSR/WRMSR operation about any errors. While it is likely that the GHCB will be mapped in this situation, add a safe guard in this path to be certain a NULL pointer dereference is not encountered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/fb9e14f4f8217a0980f8da2c8ff70dee058cbe47 - https://git.kernel.org/stable/c/fd722a57fe0b
https://git.kernel.org/stable/c/fb9e14f4f8217a0980f8da2c8ff70dee058cbe47 - https://git.kernel.org/stable/c/fd722a57fe0b80133dacae4e1c852ee4212f9b2e - https://git.kernel.org/stable/c/a3ba26ecfb569f4aa3f867e80c02aa65f20aadad
CVE ID: CVE-2021-47009 State: PUBLISHED Published: 2024-02-28T08:13:28.439Z Last Updated: 2025-05-04T07:02:14.401Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak on object td Two error return paths are neglecting to free allocated object td, causing a memory leak. Fix this by returning via the error return path that securely kfree's td. Fixes clang scan-build warning: security/keys/trusted-keys/trusted_tpm1.c:496:10: warning: Potential memory leak [unix.Malloc] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/31c9a4b24d86cbb3
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/31c9a4b24d86cbb36ff0d7a085725a3b4f0138c8 - https://git.kernel.org/stable/c/1c4031014106aff48e1e686e40101c31eab5d44c - https://git.kernel.org/stable/c/3e24fbd37e72e8a67b74991970fecc82d14f57af - https://git.kernel.org/stable/c/83a775d5f9bfda95b1c295f95a3a041a40c7f321
CVE ID: CVE-2021-47010 State: PUBLISHED Published: 2024-02-28T08:13:29.051Z Last Updated: 2025-05-04T07:02:15.538Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: Only allow init netns to set default tcp cong to a restricted algo tcp_set_default_congestion_control() is netns-safe in that it writes to &net->ipv4.tcp_congestion_control, but it also sets ca->flags |= TCP_CONG_NON_RESTRICTED which is not namespaced. This has the unintended side-effect of changing the global net.ipv4.tcp_allowed_congestion_control sysctl, despite the fact that it is read-only: 97684f0970f6 ("net: Make tcp_allowed_congestion_control readonly in n
rol sysctl, despite the fact that it is read-only: 97684f0970f6 ("net: Make tcp_allowed_congestion_control readonly in non-init netns") Resolve this netns "leak" by only allowing the init netns to set the default algorithm to one that is restricted. This restriction could be removed if tcp_allowed_congestion_control were namespace-ified in the future. This bug was uncovered with https://github.com/JonathonReinhart/linux-netns-sysctl-verify Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/992de06308d9a9584d59b96d294ac676f924e437 - https://git.kernel.org/stable/c/9884f745108f7d25b189bbcd6754e284fb29ab68 - https://git.kern
584d59b96d294ac676f924e437 - https://git.kernel.org/stable/c/9884f745108f7d25b189bbcd6754e284fb29ab68 - https://git.kernel.org/stable/c/6c1ea8bee75df8fe2184a50fcd0f70bf82986f42 - https://git.kernel.org/stable/c/efe1532a6e1a8e3c343d04fff510f0ed80328f9c - https://git.kernel.org/stable/c/e7d7bedd507bb732e600403b7a96f9fe48d0ca31 - https://git.kernel.org/stable/c/8d432592f30fcc34ef5a10aac4887b4897884493
CVE ID: CVE-2021-47011 State: PUBLISHED Published: 2024-02-28T08:13:29.666Z Last Updated: 2025-05-04T07:02:16.677Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm: memcontrol: slab: fix obtain a reference to a freeing memcg Patch series "Use obj_cgroup APIs to charge kmem pages", v5. Since Roman's series "The new cgroup slab memory controller" applied. All slab objects are charged with the new APIs of obj_cgroup. The new APIs introduce a struct obj_cgroup to charge slab objects. It prevents long-living objects from pinning the original memory cgroup in the memory. But there are still some corner objects (e.g. allocations larg
ts from pinning the original memory cgroup in the memory. But there are still some corner objects (e.g. allocations larger than order-1 page on SLUB) which are not charged with the new APIs. Those objects (include the pages which are allocated from buddy allocator directly) are charged as kmem pages which still hold a reference to the memory cgroup. E.g. We know that the kernel stack is charged as kmem pages because the size of the kernel stack can be greater than 2 pages (e.g. 16KB on x86_64 or arm64). If we create a thread (suppose the thread stack is charged to memory cgroup A) and then move it from memory cgroup A to memory cgroup B. Because the kernel stack of the thread hold a referenc
roup A) and then move it from memory cgroup A to memory cgroup B. Because the kernel stack of the thread hold a reference to the memory cgroup A. The thread can pin the memory cgroup A in the memory even if we remove the cgroup A. If we want to see this scenario by using the following script. We can see that the system has added 500 dying cgroups (This is not a real world issue, just a script to show that the large kmallocs are charged as kmem pages which can pin the memory cgroup in the memory). #!/bin/bash cat /proc/cgroups | grep memory cd /sys/fs/cgroup/memory echo 1 > memory.move_charge_at_immigrate for i in range{1..500} do mkdir kmem_test echo $$ > kmem_test/cgroup.procs sleep 3600 &
memory.move_charge_at_immigrate for i in range{1..500} do mkdir kmem_test echo $$ > kmem_test/cgroup.procs sleep 3600 & echo $$ > cgroup.procs echo `cat kmem_test/cgroup.procs` > cgroup.procs rmdir kmem_test done cat /proc/cgroups | grep memory This patchset aims to make those kmem pages to drop the reference to memory cgroup by using the APIs of obj_cgroup. Finally, we can see that the number of the dying cgroups will not increase if we run the above test script. This patch (of 7): The rcu_read_lock/unlock only can guarantee that the memcg will not be freed, but it cannot guarantee the success of css_get (which is in the refill_stock when cached memcg changed) to memcg. rcu_read_lock() memc
guarantee the success of css_get (which is in the refill_stock when cached memcg changed) to memcg. rcu_read_lock() memcg = obj_cgroup_memcg(old) __memcg_kmem_uncharge(memcg) refill_stock(memcg) if (stock->cached != memcg) // css_get can change the ref counter from 0 back to 1. css_get(&memcg->css) rcu_read_unlock() This fix is very like the commit: eefbfa7fd678 ("mm: memcg/slab: fix use after free in obj_cgroup_charge") Fix this by holding a reference to the memcg which is passed to the __memcg_kmem_uncharge() before calling __memcg_kmem_uncharge(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/31df8bc4d3feca9f9c6b2
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/31df8bc4d3feca9f9c6b2cd06fd64a111ae1a0e6 - https://git.kernel.org/stable/c/89b1ed358e01e1b0417f5d3b0082359a23355552 - https://git.kernel.org/stable/c/c3ae6a3f3ca4f02f6ccddf213c027302586580d0 - https://git.kernel.org/stable/c/9f38f03ae8d5f57371b71aa6b4275765b65454fd
CVE ID: CVE-2021-47012 State: PUBLISHED Published: 2024-02-28T08:13:30.284Z Last Updated: 2025-05-04T07:02:17.847Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix a use after free in siw_alloc_mr Our code analyzer reported a UAF. In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a freed object. After, the execution continue up to the err_out branch of siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr). My patch moves "mr->mem = mem" beh
err_out branch of siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr). My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {} section, to avoid the uaf. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/30b9e92d0b5e5d5dc1101ab856c17009537cbca4 - https://git.kernel.org/stable/c/608a4b90ece039940e9425ee2b39c8beff27e00c - https://git.kernel.org/stable/c/3e22b88e02c194f6c80867abfef5cc09383461f4 - https://git.kernel.org/stable/c/ad9ce7188432650469a6c7625bf479f5ed0b6155 - https://git.kernel.org/stable/c/3093ee182f01689b89e9f8797b321603e5de4f63
CVE ID: CVE-2021-47013 State: PUBLISHED Published: 2024-02-28T08:13:30.905Z Last Updated: 2025-05-04T07:02:18.890Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len). As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible f
emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible free and use 'len' instead of skb->len later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c7f75d11fe72913d2619f97b2334b083cd7bb955 - https://git.kernel.org/stable/c/dc1b438a35773d030be0ee80d9c635c3e558a322 - https://git.kernel.org/stable/c/16d8c44be52e3650917736d45f5904384a9da834 - https://git.kernel.org/stable/c/55fcdd1258faaecca74b91b88cc0921f9edd775d - https://git.kernel.org/stable/c/9dc373f74097edd0e35f3393d6248eda8d1ba99d - https://git.kernel.org/stable/c/8c06f34785068b87e2b560534c77c163d6c6dc
able/c/9dc373f74097edd0e35f3393d6248eda8d1ba99d - https://git.kernel.org/stable/c/8c06f34785068b87e2b560534c77c163d6c6dca7 - https://git.kernel.org/stable/c/e407495ba6788a67d1bd41714158c079e340879b - https://git.kernel.org/stable/c/6d72e7c767acbbdd44ebc7d89c6690b405b32b57
CVE ID: CVE-2021-47014 State: PUBLISHED Published: 2024-02-28T08:13:31.513Z Last Updated: 2025-05-04T12:40:49.409Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix wild memory access when clearing fragments while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one: KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 8
Edge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440