Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrt
0000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303
303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 000000
00000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler
stprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/94c742324ed7e42c5bd6a9ed22e4ec6d764db4d8 - https://git.kernel.org/stable/c/2aa141f8bc58
https://git.kernel.org/stable/c/94c742324ed7e42c5bd6a9ed22e4ec6d764db4d8 - https://git.kernel.org/stable/c/2aa141f8bc580f8f9811dfe4e0e6009812b73826 - https://git.kernel.org/stable/c/d4a9aa7db574a0da64307729cc031fb68597aa8b - https://git.kernel.org/stable/c/0049fe7e4a85849bdd778cdb72e51a791ff3d737 - https://git.kernel.org/stable/c/d4a714873db0866cc471521114eeac4a5072d548 - https://git.kernel.org/stable/c/0e8d2444168dd519fea501599d150e62718ed2fe
CVE ID: CVE-2023-52464 State: PUBLISHED Published: 2024-02-23T14:46:24.150Z Last Updated: 2025-05-04T07:37:16.530Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: EDAC/thunderx: Fix possible out-of-bounds string access Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, oth
flow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/71c17ee02538802ceafc830
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/71c17ee02538802ceafc830f0736aa35b564e601 - https://git.kernel.org/stable/c/5da3b6e7196f0b4f3728e4e25eb20233a9ddfaf6 - https://git.kernel.org/stable/c/6aa7865ba7ff7f0ede0035180fb3b9400ceb405a - https://git.kernel.org/stable/c/700cf4bead80fac994dcc43ae1ca5d86d8959b21 - https://git.kernel.org/stable/c/9dbac9fdae6e3b411fc4c3fca3bf48f70609c398 - https://git.kernel.org/stable/c/e1c86511241588efffaa49556196f09a498d5057 - https://git.kernel.org/stable/c/426fae93c01dffa379225eb2bd4d3cdc42c6eec5 - https://git.kernel.org/stable/c/475c58e1a471e9b873e3e39958c64a2d278275c8
CVE ID: CVE-2023-52465 State: PUBLISHED Published: 2024-02-25T08:16:30.088Z Last Updated: 2025-05-04T07:37:17.837Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: power: supply: Fix null pointer dereference in smb2_probe devm_kasprintf and devm_kzalloc return a pointer to dynamically allocated memory which can be NULL upon failure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e2717302fbc20f148bcda362facee0444b949a3a - https://git.kernel.org/stable/c/bd3d2ec447ede9da822addf3960a5f4275e3ae76 - https://git.kernel.org/stable/c/88f04bc3e737155e13caddf0ba8ed1
l.org/stable/c/bd3d2ec447ede9da822addf3960a5f4275e3ae76 - https://git.kernel.org/stable/c/88f04bc3e737155e13caddf0ba8ed19db87f0212
CVE ID: CVE-2023-52466 State: REJECTED Published: 2024-02-25T08:16:30.723Z Last Updated: 2024-03-03T07:31:36.406Z Description: No description available.
CVE ID: CVE-2023-52467 State: PUBLISHED Published: 2024-02-25T08:16:31.745Z Last Updated: 2025-05-04T07:37:19.104Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mfd: syscon: Fix null pointer dereference in of_syscon_register() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/927626a2073887ee30ba00633260d4d203f8e875 - https://git.kernel.org/stable/c/c3e3a2144bf50877551138ffce9f7aa6ddfe385b - https://git.kernel.org/stable/c/527e8c5f3d00299822612c495d5adf1f8f43c001
e/c/c3e3a2144bf50877551138ffce9f7aa6ddfe385b - https://git.kernel.org/stable/c/527e8c5f3d00299822612c495d5adf1f8f43c001 - https://git.kernel.org/stable/c/3ef1130deee98997275904d9bfc37af75e1e906c - https://git.kernel.org/stable/c/7f2c410ac470959b88e03dadd94b7a0b71df7973 - https://git.kernel.org/stable/c/41673c66b3d0c09915698fec5c13b24336f18dd1
CVE ID: CVE-2023-52468 State: PUBLISHED Published: 2024-02-25T08:16:32.387Z Last Updated: 2025-05-04T07:37:20.416Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: class: fix use-after-free in class_register() The lock_class_key is still registered and can be found in lock_keys_hash hlist after subsys_private is freed in error handler path.A task who iterate over the lock_keys_hash later may cause use-after-free.So fix that up and unregister the lock_class_key before kfree(cp). On our platform, a driver fails to kset_register because of creating duplicate filename '/class/xxx'.With Kasan enabled, it prints a invalid-access bug re
kset_register because of creating duplicate filename '/class/xxx'.With Kasan enabled, it prints a invalid-access bug report. KASAN bug report: BUG: KASAN: invalid-access in lockdep_register_key+0x19c/0x1bc Write of size 8 at addr 15ffff808b8c0368 by task modprobe/252 Pointer tag: [15], memory tag: [fe] CPU: 7 PID: 252 Comm: modprobe Tainted: G W 6.6.0-mainline-maybe-dirty #1 Call trace: dump_backtrace+0x1b0/0x1e4 show_stack+0x2c/0x40 dump_stack_lvl+0xac/0xe0 print_report+0x18c/0x4d8 kasan_report+0xe8/0x148 __hwasan_store8_noabort+0x88/0x98 lockdep_register_key+0x19c/0x1bc class_register+0x94/0x1ec init_module+0xbc/0xf48 [rfkill] do_one_initcall+0x17c/0x72c do_init_module+0x19c/0x3f8 ... Mem
class_register+0x94/0x1ec init_module+0xbc/0xf48 [rfkill] do_one_initcall+0x17c/0x72c do_init_module+0x19c/0x3f8 ... Memory state around the buggy address: ffffff808b8c0100: 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a ffffff808b8c0200: 8a 8a 8a 8a 8a 8a 8a 8a fe fe fe fe fe fe fe fe >ffffff808b8c0300: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ ffffff808b8c0400: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 As CONFIG_KASAN_GENERIC is not set, Kasan reports invalid-access not use-after-free here.In this case, modprobe is manipulating the corrupted lock_keys_hash hlish where lock_class_key is already freed before. It's worth noting that this only can happen if lockdep is enabled, w
hlish where lock_class_key is already freed before. It's worth noting that this only can happen if lockdep is enabled, which is not true for normal system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b57196a5ec5e4c0ffecde8348b085b778c7dce04 - https://git.kernel.org/stable/c/0f1486dafca3398c4c46b9f6e6452fa27e73b559 - https://git.kernel.org/stable/c/93ec4a3b76404bce01bd5c9032bef5df6feb1d62
CVE ID: CVE-2023-52469 State: PUBLISHED Published: 2024-02-25T08:16:33.016Z Last Updated: 2025-05-04T07:37:21.786Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers/amd/pm: fix a use-after-free in kv_parse_power_table When ps allocated by kzalloc equals to NULL, kv_parse_power_table frees adev->pm.dpm.ps that allocated before. However, after the control flow goes through the following call chains: kv_parse_power_table |-> kv_dpm_init |-> kv_dpm_sw_init |-> kv_dpm_fini The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its first free in kv_parse_power_table and causes a use-after-free bug. Additional Analyst N
r loop of kv_dpm_fini after its first free in kv_parse_power_table and causes a use-after-free bug. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8a27d9d9fc9b5564b8904c3a77a7dea482bfa34e - https://git.kernel.org/stable/c/8b55b06e737feb2a645b0293ea27e38418876d63 - https://git.kernel.org/stable/c/520e213a0b97b64735a13950e9371e0a5d7a5dc3 - https://git.kernel.org/stable/c/b6dcba02ee178282e0d28684d241e0b8462dea6a - https://git.kernel.org/stable/c/35fa2394d26e919f63600ce631e6aefc95ec2706 - https://git.kernel.org/stable/c/95084632a65d5c0d682a83b55935560bdcd2a1e3 - https://git.kernel.org/stable/c/3426f059eacc33ecc676b0d66539
nel.org/stable/c/95084632a65d5c0d682a83b55935560bdcd2a1e3 - https://git.kernel.org/stable/c/3426f059eacc33ecc676b0d66539297e1cfafd02 - https://git.kernel.org/stable/c/28dd788382c43b330480f57cd34cde0840896743
CVE ID: CVE-2023-52470 State: PUBLISHED Published: 2024-02-25T08:16:33.636Z Last Updated: 2025-05-04T07:37:22.890Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() check the alloc_workqueue return value in radeon_crtc_init() to avoid null-ptr-deref. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/21b1645660717d6126dd4866c850fcc5c4703a41 - https://git.kernel.org/stable/c/5d12c5d75f7c78b83a738025947651ec5c95b4d4 - https://git.kernel.org/stable/c/57ca7984806d79b38af528de88fd803babf27feb -
/c/5d12c5d75f7c78b83a738025947651ec5c95b4d4 - https://git.kernel.org/stable/c/57ca7984806d79b38af528de88fd803babf27feb - https://git.kernel.org/stable/c/14bbfaa5df273b26cde6707f6e655585700e6fe1 - https://git.kernel.org/stable/c/c4ff55408187f2595066967047363ca84e76db85 - https://git.kernel.org/stable/c/0b813a6a0087451cb702b6eb841f10856f49d088 - https://git.kernel.org/stable/c/fb2d8bc9b5e55848b8a7c3c028e2ee8d49f28f97 - https://git.kernel.org/stable/c/7a2464fac80d42f6f8819fed97a553e9c2f43310
CVE ID: CVE-2023-52471 State: PUBLISHED Published: 2024-02-25T08:16:34.350Z Last Updated: 2025-05-04T07:37:24.291Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ice: Fix some null pointer dereference issues in ice_ptp.c devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3cd9b9bee33f39f6c6d52360fe381b89a7b12695 - https://git.kernel.org/stable/c/3027e7b15b02d2d37e3f82d6b8404f6d37e3b8cf
CVE ID: CVE-2023-52472 State: PUBLISHED Published: 2024-02-25T08:16:34.968Z Last Updated: 2025-05-04T07:37:25.705Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: rsa - add a check for allocation failure Static checkers insist that the mpi_alloc() allocation can fail so add a check to prevent a NULL dereference. Small allocations like this can't actually fail in current kernels, but adding a check is very simple and makes the static checkers happy. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2831f4d3bfa68e64c5f83e96688be779c87b3511 - https://gi
E Program Container: References: - https://git.kernel.org/stable/c/2831f4d3bfa68e64c5f83e96688be779c87b3511 - https://git.kernel.org/stable/c/95ad8b6879e2e49d02e3bfc0e1fb46421633fe2a - https://git.kernel.org/stable/c/d872ca165cb67112f2841ef9c37d51ef7e63d1e4
CVE ID: CVE-2023-52473 State: PUBLISHED Published: 2024-02-25T08:16:35.551Z Last Updated: 2025-05-04T07:37:26.795Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix NULL pointer dereference in zone registration error path If device_register() in thermal_zone_device_register_with_trips() returns an error, the tz variable is set to NULL and subsequently dereferenced in kfree(tz->tzp). Commit adc8749b150c ("thermal/drivers/core: Use put_device() if device_register() fails") added the tz = NULL assignment in question to avoid a possible double-free after dropping the reference to the zone device. However, after comm
ignment in question to avoid a possible double-free after dropping the reference to the zone device. However, after commit 4649620d9404 ("thermal: core: Make thermal_zone_device_unregister() return after freeing the zone"), that assignment has become redundant, because dropping the reference to the zone device does not cause the zone object to be freed any more. Drop it to address the NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/335176dd8ebaca6493807dceea33c478305667fa - https://git.kernel.org/stable/c/02871710b93058eb1249d5847c0b2d1c2c3c98ae - https://git.kernel.org/stable/c/04e6ccfc93c5a1
ttps://git.kernel.org/stable/c/02871710b93058eb1249d5847c0b2d1c2c3c98ae - https://git.kernel.org/stable/c/04e6ccfc93c5a1aa1d75a537cf27e418895e20ea
CVE ID: CVE-2023-52474 State: PUBLISHED Published: 2024-02-26T17:20:22.790Z Last Updated: 2025-05-04T07:37:28.185Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests hfi1 user SDMA request processing has two bugs that can cause data corruption for user SDMA requests that have multiple payload iovecs where an iovec other than the tail iovec does not run up to the page boundary for the buffer pointed to by that iovec.a Here are the specific bugs: 1. user_sdma_txadd() does not use struct user_sdma_iovec->iov.iov_len. Rather, user_sdma_txadd() will add up to PAGE_S
: 1. user_sdma_txadd() does not use struct user_sdma_iovec->iov.iov_len. Rather, user_sdma_txadd() will add up to PAGE_SIZE bytes from iovec to the packet, even if some of those bytes are past iovec->iov.iov_len and are thus not intended to be in the packet. 2. user_sdma_txadd() and user_sdma_send_pkts() fail to advance to the next iovec in user_sdma_request->iovs when the current iovec is not PAGE_SIZE and does not contain enough data to complete the packet. The transmitted packet will contain the wrong data from the iovec pages. This has not been an issue with SDMA packets from hfi1 Verbs or PSM2 because they only produce iovecs that end short of PAGE_SIZE as the tail iovec of an SDMA requ
s from hfi1 Verbs or PSM2 because they only produce iovecs that end short of PAGE_SIZE as the tail iovec of an SDMA request. Fixing these bugs exposes other bugs with the SDMA pin cache (struct mmu_rb_handler) that get in way of supporting user SDMA requests with multiple payload iovecs whose buffers do not end at PAGE_SIZE. So this commit fixes those issues as well. Here are the mmu_rb_handler bugs that non-PAGE_SIZE-end multi-iovec payload user SDMA requests can hit: 1. Overlapping memory ranges in mmu_rb_handler will result in duplicate pinnings. 2. When extending an existing mmu_rb_handler entry (struct mmu_rb_node), the mmu_rb code (1) removes the existing entry under a lock, (2) releas
sting mmu_rb_handler entry (struct mmu_rb_node), the mmu_rb code (1) removes the existing entry under a lock, (2) releases that lock, pins the new pages, (3) then reacquires the lock to insert the extended mmu_rb_node. If someone else comes in and inserts an overlapping entry between (2) and (3), insert in (3) will fail. The failure path code in this case unpins _all_ pages in either the original mmu_rb_node or the new mmu_rb_node that was inserted between (2) and (3). 3. In hfi1_mmu_rb_remove_unless_exact(), mmu_rb_node->refcount is incremented outside of mmu_rb_handler->lock. As a result, mmu_rb_node could be evicted by another thread that gets mmu_rb_handler->lock and checks mmu_rb_node->
ock. As a result, mmu_rb_node could be evicted by another thread that gets mmu_rb_handler->lock and checks mmu_rb_node->refcount before mmu_rb_node->refcount is incremented. 4. Related to #2 above, SDMA request submission failure path does not check mmu_rb_node->refcount before freeing mmu_rb_node object. If there are other SDMA requests in progress whose iovecs have pointers to the now-freed mmu_rb_node(s), those pointers to the now-freed mmu_rb nodes will be dereferenced when those SDMA requests complete. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9c4c6512d7330b743c4ffd18bd999a86ca26db0d - https://git.kernel.org
ichment: References: - https://git.kernel.org/stable/c/9c4c6512d7330b743c4ffd18bd999a86ca26db0d - https://git.kernel.org/stable/c/a2bd706ab63509793b5cd5065e685b7ef5cba678 - https://git.kernel.org/stable/c/dce59b5443700fbd0d2433ec6e4d4cf063448844 - https://git.kernel.org/stable/c/c76cb8f4bdf26d04cfa5485a93ce297dba5e6a80 - https://git.kernel.org/stable/c/7e6010f79b58f45b204cf18aa58f4b73c3f30adc - https://git.kernel.org/stable/c/00cbce5cbf88459cd1aa1d60d0f1df15477df127
CVE ID: CVE-2023-52475 State: PUBLISHED Published: 2024-02-29T05:43:08.838Z Last Updated: 2025-05-04T07:37:29.354Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free in powermate_config_complete syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconn
exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8677575c4f39d65bf0d719b5d20e8042e550ccb9 - https://git.kernel.org/stable/c/67cace72606baf1758fd60feb358f4c6be92e1cc - https://git.kernel.org/stable/c/5aa514100aaf59868d745196258269a16737c7bd - https://git.kernel.org/stable/c/cd2fbfd8b922b7fdd50732e47d797754ab59cb06 - https://git.kernel.org/stable/c/6a4a396386404e62fb59bc3bde48871a64a82b4f - https://git.kernel.org/stable/c/2efe67c581
- https://git.kernel.org/stable/c/6a4a396386404e62fb59bc3bde48871a64a82b4f - https://git.kernel.org/stable/c/2efe67c581a2a6122b328d4bb6f21b3f36f40d46 - https://git.kernel.org/stable/c/e528b1b9d60743e0b26224e3fe7aa74c24b8b2f8 - https://git.kernel.org/stable/c/5c15c60e7be615f05a45cd905093a54b11f461bc
CVE ID: CVE-2023-52476 State: PUBLISHED Published: 2024-02-29T05:43:09.475Z Last Updated: 2025-05-04T07:37:30.581Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf/x86/lbr: Filter vsyscall addresses We found that a panic can occur when a vsyscall is made while LBR sampling is active. If the vsyscall is interrupted (NMI) for perf sampling, this call sequence can occur (most recent at top): __insn_get_emulate_prefix() insn_get_emulate_prefix() insn_get_prefixes() insn_get_opcode() decode_branch_type() get_branch_type() intel_pmu_lbr_filter() intel_pmu_handle_irq() perf_event_nmi_handler() Within __insn_get_emulate_prefix() at
nch_type() intel_pmu_lbr_filter() intel_pmu_handle_irq() perf_event_nmi_handler() Within __insn_get_emulate_prefix() at frame 0, a macro is called: peek_nbyte_next(insn_byte_t, insn, i) Within this macro, this dereference occurs: (insn)->next_byte Inspecting registers at this point, the value of the next_byte field is the address of the vsyscall made, for example the location of the vsyscall version of gettimeofday() at 0xffffffffff600000. The access to an address in the vsyscall region will trigger an oops due to an unhandled page fault. To fix the bug, filtering for vsyscalls can be done when determining the branch type. This patch will return a "none" branch if a kernel address if found t
alls can be done when determining the branch type. This patch will return a "none" branch if a kernel address if found to lie in the vsyscall region. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/403d201d1fd144cb249836dafb222f6375871c6c - https://git.kernel.org/stable/c/3863989497652488a50f00e96de4331e5efabc6c - https://git.kernel.org/stable/c/f71edacbd4f99c0e12fe4a4007ab4d687d0688db - https://git.kernel.org/stable/c/e53899771a02f798d436655efbd9d4b46c0f9265