Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
2e1ee148b7c9ba2b538 - https://git.kernel.org/stable/c/ed6e955f3b7e0e622c080f4bcb5427a5e1af4c2a - https://git.kernel.org/stable/c/ed14e5903638f6eb868e3e2b4e610985e6a6c876
CVE ID: CVE-2022-48956 State: PUBLISHED Published: 2024-10-21T20:05:42.379Z Last Updated: 2025-05-04T08:26:53.995Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid use-after-free in ip6_fragment() Blamed commit claimed rcu_read_lock() was held by ip6_fragment() callers. It seems to not be always true, at least for UDP stack. syzbot reported: BUG: KASAN: use-after-free in ip6_dst_idev include/net/ip6_fib.h:245 [inline] BUG: KASAN: use-after-free in ip6_fragment+0x2724/0x2770 net/ipv6/ip6_output.c:951 Read of size 8 at addr ffff88801d403e80 by task syz-executor.3/7618 CPU: 1 PID: 7618 Comm: syz-executor.3 Not tainted 6.
Read of size 8 at addr ffff88801d403e80 by task syz-executor.3/7618 CPU: 1 PID: 7618 Comm: syz-executor.3 Not tainted 6.1.0-rc6-syzkaller-00012-g4312098baf37 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15e/0x45d mm/kasan/report.c:395 kasan_report+0xbf/0x1f0 mm/kasan/report.c:495 ip6_dst_idev include/net/ip6_fib.h:245 [inline] ip6_fragment+0x2724/0x2770 net/ipv6/ip6_output.c:951 __ip6_finish_output net/ipv6/ip6_output.c:193 [inline] ip6_finish_output+0x9a3/0x1170 net/
770 net/ipv6/ip6_output.c:951 __ip6_finish_output net/ipv6/ip6_output.c:193 [inline] ip6_finish_output+0x9a3/0x1170 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip6_output+0x1f1/0x540 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:445 [inline] ip6_local_out+0xb3/0x1a0 net/ipv6/output_core.c:161 ip6_send_skb+0xbb/0x340 net/ipv6/ip6_output.c:1966 udp_v6_send_skb+0x82a/0x18a0 net/ipv6/udp.c:1286 udp_v6_push_pending_frames+0x140/0x200 net/ipv6/udp.c:1313 udpv6_sendmsg+0x18da/0x2c80 net/ipv6/udp.c:1606 inet6_sendmsg+0x9d/0xe0 net/ipv6/af_inet6.c:665 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xd3/0x120 net/socket.c:734 sock_write_iter+0x295/
inet6.c:665 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xd3/0x120 net/socket.c:734 sock_write_iter+0x295/0x3d0 net/socket.c:1108 call_write_iter include/linux/fs.h:2191 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x9ed/0xdd0 fs/read_write.c:584 ksys_write+0x1ec/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fde3588c0d9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:
ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fde365b6168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fde359ac050 RCX: 00007fde3588c0d9 RDX: 000000000000ffdc RSI: 00000000200000c0 RDI: 000000000000000a RBP: 00007fde358e7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fde35acfb1f R14: 00007fde365b6300 R15: 0000000000022000 </TASK> Allocated by task 7618: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x82/0x90 mm/kasan/common.c:325 kasan_slab_
ommon.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x82/0x90 mm/kasan/common.c:325 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slub.c:3398 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc+0x2b4/0x3d0 mm/slub.c:3422 dst_alloc+0x14a/0x1f0 net/core/dst.c:92 ip6_dst_alloc+0x32/0xa0 net/ipv6/route.c:344 ip6_rt_pcpu_alloc net/ipv6/route.c:1369 [inline] rt6_make_pcpu_route net/ipv6/route.c:1417 [inline] ip6_pol_route+0x901/0x1190 net/ipv6/route.c:2254 pol_lookup_func include/net/ip6_fib.h:582 [inline] fib6_rule_lookup+0x52e/0x6f0 net/ipv6/fib6_r
90 net/ipv6/route.c:2254 pol_lookup_func include/net/ip6_fib.h:582 [inline] fib6_rule_lookup+0x52e/0x6f0 net/ipv6/fib6_rules.c:121 ip6_route_output_flags_noref+0x2e6/0x380 net/ipv6/route.c:2625 ip6_route_output_flags+0x76/0x320 net/ipv6/route.c:2638 ip6_route_output include/net/ip6_route.h:98 [inline] ip6_dst_lookup_tail+0x5ab/0x1620 net/ipv6/ip6_output.c:1092 ip6_dst_lookup_flow+0x90/0x1d0 net/ipv6/ip6_output.c:1222 ip6_sk_dst_lookup_flow+0x553/0x980 net/ipv6/ip6_output.c:1260 udpv6_sendmsg+0x151d/0x2c80 net/ipv6/udp.c:1554 inet6_sendmsg+0x9d/0xe0 net/ipv6/af_inet6.c:665 sock_sendmsg_nosec n ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.
ock_sendmsg_nosec n ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b3d7ff8c04a83279fb7641fc4d5aa82a602df7c0 - https://git.kernel.org/stable/c/7e0dcd5f3ade221a6126278aca60c8ab4cc3bce9 - https://git.kernel.org/stable/c/6b6d3be3661bff2746cab26147bd629aa034e094 - https://git.kernel.org/stable/c/8208d7e56b1e579320b9ff3712739ad2e63e1f86 - https://git.kernel.org/stable/c/7390c70bd431cbfa6951477e2c80a301643e284b - https://git.kernel.org/stable/c/9b1a468a455d8319041528778d0e684a4c062792 - https://git.kernel.org/stable/c/803e84867de59a1e5d126666d25eb4860cfd2ebe
CVE ID: CVE-2022-48957 State: PUBLISHED Published: 2024-10-21T20:05:43.107Z Last Updated: 2025-05-04T08:26:55.130Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() The cmd_buff needs to be freed when error happened in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/54d830e24247fa8361b016dd2069362866f45cb6 - https://git.kernel.org/stable/c/785ee7a82297e1512d9061aae91699212ed65796 - https://git.kernel.org/stable/c/4fad22a1
b6 - https://git.kernel.org/stable/c/785ee7a82297e1512d9061aae91699212ed65796 - https://git.kernel.org/stable/c/4fad22a1281c500f15b172c9d261eff347ca634b
CVE ID: CVE-2022-48958 State: PUBLISHED Published: 2024-10-21T20:05:43.778Z Last Updated: 2025-05-04T08:26:56.189Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ethernet: aeroflex: fix potential skb leak in greth_init_rings() The greth_init_rings() function won't free the newly allocated skb when dma_mapping_error() returns error, so add dev_kfree_skb() to fix it. Compile tested only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/223654e2e2c8d05347cd8e300f8d1ec6023103dd - https://git.kernel.org/stable/c/cb1e293f858e5e1152b8791047ed4bdaaf392189 - https://git.kernel.org/stable/c
ec6023103dd - https://git.kernel.org/stable/c/cb1e293f858e5e1152b8791047ed4bdaaf392189 - https://git.kernel.org/stable/c/bfaa8f6c5b84b295dd73b0138b57c5555ca12b1c - https://git.kernel.org/stable/c/99669d94ce145389f1d6f197e6e18ed50d43fb76 - https://git.kernel.org/stable/c/87277bdf2c370ab2d07cfe77dfa9b37f82bbe1e5 - https://git.kernel.org/stable/c/c7adcbd0fd3fde1b19150c3e955fb4a30c5bd9b7 - https://git.kernel.org/stable/c/dd62867a6383f78f75f07039394aac25924a3307 - https://git.kernel.org/stable/c/063a932b64db3317ec020c94466fe52923a15f60
CVE ID: CVE-2022-48959 State: PUBLISHED Published: 2024-10-21T20:05:44.447Z Last Updated: 2025-05-04T08:26:57.263Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() When dsa_devlink_region_create failed in sja1105_setup_devlink_regions(), priv->regions is not released. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4be43e46c3f945fc7dd9e23c73a7a66927a3b814 - https://git.kernel.org/stable/c/f3b5dda26cd0535aac09ed09c5d83f19b979ec9f - https://git.kernel.org/stable/c/e5e59629654b8826f0167dae480d0e3fa0f8f038 - https://
a26cd0535aac09ed09c5d83f19b979ec9f - https://git.kernel.org/stable/c/e5e59629654b8826f0167dae480d0e3fa0f8f038 - https://git.kernel.org/stable/c/78a9ea43fc1a7c06a420b132d2d47cbf4344a5df
CVE ID: CVE-2022-48960 State: PUBLISHED Published: 2024-10-21T20:05:45.167Z Last Updated: 2025-05-04T08:26:58.343Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/179499e7a240b2ef590f05eb379c810c26bbc8a4 - https://git.kernel.org/stable/c/8067cd244cea2c332f8326842fd10158fa2cb64f - https://git.kernel.org/stable/c/3a4eddd1cb023a71df4152fcc76092953e6fe
table/c/8067cd244cea2c332f8326842fd10158fa2cb64f - https://git.kernel.org/stable/c/3a4eddd1cb023a71df4152fcc76092953e6fe95a - https://git.kernel.org/stable/c/1b6360a093ab8969c91a30bb58b753282e2ced4c - https://git.kernel.org/stable/c/93aaa4bb72e388f6a4887541fd3d18b84f1b5ddc - https://git.kernel.org/stable/c/b8ce0e6f9f88a6bb49d291498377e61ea27a5387 - https://git.kernel.org/stable/c/b6307f7a2fc1c5407b6176f2af34a95214a8c262 - https://git.kernel.org/stable/c/433c07a13f59856e4585e89e86b7d4cc59348fab
CVE ID: CVE-2022-48961 State: PUBLISHED Published: 2024-10-21T20:05:45.849Z Last Updated: 2025-05-04T08:26:59.413Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix unbalanced fwnode reference count in mdio_device_release() There is warning report about of_node refcount leak while probing mdio device: OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /spi/soc@0/mdio@710700c0/ethernet@4 In of_mdiobus_register_device(), we increase fwnode refcount by fwnode_handle_get() before associating the of_node with mdio device, but it has n
vice(), we increase fwnode refcount by fwnode_handle_get() before associating the of_node with mdio device, but it has never been decreased in normal path. Since that, in mdio_device_release(), it needs to call fwnode_handle_put() in addition instead of calling kfree() directly. After above, just calling mdio_device_free() in the error handle path of of_mdiobus_register_device() is enough to keep the refcount balanced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/16854177745a5648f8ec322353b432e18460f43a - https://git.kernel.org/stable/c/a5c6de1a6656b8cc6bce7cb3d9874dd7df4968c3 - https://git.kernel.org/stable/c/cb37617687f2bfa5b675df7779f869
l.org/stable/c/a5c6de1a6656b8cc6bce7cb3d9874dd7df4968c3 - https://git.kernel.org/stable/c/cb37617687f2bfa5b675df7779f869147c9002bd
CVE ID: CVE-2022-48962 State: PUBLISHED Published: 2024-10-21T20:05:46.514Z Last Updated: 2025-05-04T08:27:00.793Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3501da8eb6d0f5f114a09ec953c54423f6f35885 - https://git.kernel.org/stable/c/196e12671cb629d9f3b77b4d8bec854fc445533a - https://git.kernel.org/stable/c/aceec8ab752428d8e151321479e82cc1a4
g/stable/c/196e12671cb629d9f3b77b4d8bec854fc445533a - https://git.kernel.org/stable/c/aceec8ab752428d8e151321479e82cc1a40fee2e - https://git.kernel.org/stable/c/e71a46cc8c9ad75f3bb0e4b361e81f79c0214cca - https://git.kernel.org/stable/c/296a50aa8b2982117520713edc1375777a9f8506 - https://git.kernel.org/stable/c/6f4798ac9c9e98f41553c4f5e6c832c8860a6942 - https://git.kernel.org/stable/c/8595a2db8eb0ffcbb466eb9f4a7507a5ba06ebb9 - https://git.kernel.org/stable/c/4640177049549de1a43e9bc49265f0cdfce08cfd
CVE ID: CVE-2022-48963 State: PUBLISHED Published: 2024-10-21T20:05:47.161Z Last Updated: 2025-05-04T08:27:01.895Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix memory leak in ipc_mux_init() When failed to alloc ipc_mux->ul_adb.pp_qlt in ipc_mux_init(), ipc_mux is not released. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e21478d0054f63eec7ce833296cf9788764a0ec7 - https://git.kernel.org/stable/c/23353efc26e98b61b925274ecbb8f0610f69a8aa
CVE ID: CVE-2022-48964 State: PUBLISHED Published: 2024-10-21T20:05:47.835Z Last Updated: 2025-05-04T08:27:02.956Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ravb: Fix potential use-after-free in ravb_rx_gbeth() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e63c681494dcc0527c625a0a4f59bf10259f5ee0 - https://git.kernel.org/stable/c/5a5a3e564de6a8db987410c5c2f4748d50ea82b8
CVE ID: CVE-2022-48965 State: PUBLISHED Published: 2024-10-21T20:05:48.483Z Last Updated: 2025-05-04T08:27:04.068Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gpio/rockchip: fix refcount leak in rockchip_gpiolib_register() The node returned by of_get_parent() with refcount incremented, of_node_put() needs be called when finish using it. So add it in the end of of_pinctrl_get(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5cb8f1a784fd6115be58282fe15105572319d8be - https://git.kernel.org/stable/c/033c79b7ee8a7bf1c1a13ac3addc91184425cbae - https://git.kernel.org/stable/c/63ff
19d8be - https://git.kernel.org/stable/c/033c79b7ee8a7bf1c1a13ac3addc91184425cbae - https://git.kernel.org/stable/c/63ff545af73f759d1bd04198af8ed8577fb739fc
CVE ID: CVE-2022-48966 State: PUBLISHED Published: 2024-10-21T20:05:49.126Z Last Updated: 2025-05-04T08:27:05.157Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: mvneta: Prevent out of bounds read in mvneta_config_rss() The pp->indir[0] value comes from the user. It is passed to: if (cpu_online(pp->rxq_def)) inside the mvneta_percpu_elect() function. It needs bounds checkeding to ensure that it is not beyond the end of the cpu bitmap. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3ceffb8f410b93553fb16fe7e84aa0d35b3ba79b - https://git.kernel.org/stable/c/47a1a2f6cd5ec3a4f8a
//git.kernel.org/stable/c/3ceffb8f410b93553fb16fe7e84aa0d35b3ba79b - https://git.kernel.org/stable/c/47a1a2f6cd5ec3a4f8a2d9bfa1e0605347cdb92c - https://git.kernel.org/stable/c/5a142486a0db6b0b85031f22d69acd0cdcf8f72b - https://git.kernel.org/stable/c/eec1fc21edc2bb99c9e66cf66f0b5d4d643fbb50 - https://git.kernel.org/stable/c/146ebee8fcdb349d7ec0e49915e6cdafb92544ae - https://git.kernel.org/stable/c/a6b30598fec84f8809f5417cde73071ca43e8471 - https://git.kernel.org/stable/c/6ca0a506dddc3e1d636935eef339576b263bf3d8 - https://git.kernel.org/stable/c/e8b4fc13900b8e8be48debffd0dfd391772501f7
CVE ID: CVE-2022-48967 State: PUBLISHED Published: 2024-10-21T20:05:49.740Z Last Updated: 2025-05-04T08:27:06.188Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Bounds check struct nfc_target arrays While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported: memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18) This appears to be a legitimate lack of bounds checking in nci_add_new_protocol(). Add the missing checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6b37f0dc0638d13a006f2f24d2f6ca61e83b
alyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6b37f0dc0638d13a006f2f24d2f6ca61e83bc714 - https://git.kernel.org/stable/c/dbdcfb9f6748218a149f62468d6297ce3f014e9c - https://git.kernel.org/stable/c/cff35329070b96b4484d23f9f48a5ca2c947e750 - https://git.kernel.org/stable/c/6778434706940b8fad7ef35f410d2b9929f256d2 - https://git.kernel.org/stable/c/27eb2d7a1b9987b6d0429b7716b1ff3b82c4ffc9 - https://git.kernel.org/stable/c/908b2da426fe9c3ce74cf541ba40e7a4251db191 - https://git.kernel.org/stable/c/f41547546db9af99da2c34e3368664d7a79cefae - https://git.kernel.org/stable/c/e329e71013c9b5a4535b099208493c7826ee4a64
CVE ID: CVE-2022-48968 State: PUBLISHED Published: 2024-10-21T20:05:50.402Z Last Updated: 2025-05-04T08:27:07.244Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix potential memory leak in otx2_init_tc() In otx2_init_tc(), if rhashtable_init() failed, it does not free tc->tc_entries_bitmap which is allocated in otx2_tc_alloc_ent_bitmap(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/eefd8953a74822cb72006632b9ee9dd95f92c146 - https://git.kernel.org/stable/c/db5ec358cf4ef0ab382ee733d05f018e8bef9462 - https://git.kernel.org/stable/c/fbf33f5ac76f2cdb47ad9763f620026
.org/stable/c/db5ec358cf4ef0ab382ee733d05f018e8bef9462 - https://git.kernel.org/stable/c/fbf33f5ac76f2cdb47ad9763f620026d5cfa57ce
CVE ID: CVE-2022-48969 State: PUBLISHED Published: 2024-10-21T20:05:51.051Z Last Updated: 2025-05-04T08:27:08.316Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Fix NULL sring after live migration A NAPI is setup for each network sring to poll data to kernel The sring with source host is destroyed before live migration and new sring with target host is setup after live migration. The NAPI for the old sring is not deleted until setup new sring with target host after migration. With busy_poll/busy_read enabled, the NAPI can be polled before got deleted when resume VM. BUG: unable to handle kernel NULL pointer deref
_read enabled, the NAPI can be polled before got deleted when resume VM. BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI Call Trace: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 event_hist_trigger+0x14a/0x260 finish_task_switch+0x71/0x230 __schedule+0x256/0x890 recalc_sigpending+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 ring_buffer_lock_reserve+0x123/0x3d0 event_triggers_call+0x87/0xb0 trace_event_buffer
0x20 __rb_reserve_next+0x12d/0x140 ring_buffer_lock_reserve+0x123/0x3d0 event_triggers_call+0x87/0xb0 trace_event_buffer_commit+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ end trace f8601785b354351c ]--- xen frontend should remove the NAPIs for the old srings before live migration as the bond srings are destroyed There is a tiny window between the srings are set to NULL and the NAPIs are disabled, It is safe as the NAPI threads are still frozen at that time Additional Analys
e set to NULL and the NAPIs are disabled, It is safe as the NAPI threads are still frozen at that time Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/99859947517e446058ad7243ee81d2f9801fa3dd - https://git.kernel.org/stable/c/ed773dd798bf720756d20021b8d8a4a3d7184bda - https://git.kernel.org/stable/c/e6860c889f4ad50b6ab696f5ea154295d72cf27a - https://git.kernel.org/stable/c/e6e897d4fe2f89c0bd94600a40bedf5e6e75e050 - https://git.kernel.org/stable/c/f2dd60fd3fe98bd36a91b0c6e10bfe9d66258f84 - https://git.kernel.org/stable/c/d50b7914fae04d840ce36491d22133070b18cca9
CVE ID: CVE-2022-48970 State: PUBLISHED Published: 2024-10-21T20:05:51.703Z Last Updated: 2025-05-04T08:27:09.345Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: af_unix: Get user_ns from in_skb in unix_diag_get_exact(). Wei Chen reported a NULL deref in sk_user_ns() [0][1], and Paolo diagnosed the root cause: in unix_diag_get_exact(), the newly allocated skb does not have sk. [2] We must get the user_ns from the NETLINK_CB(in_skb).sk and pass it to sk_diag_fill(). [0]: BUG: kernel NULL pointer dereference, address: 0000000000000270 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 12bbce
dress: 0000000000000270 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 12bbce067 P4D 12bbce067 PUD 12bc40067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 27942 Comm: syz-executor.0 Not tainted 6.1.0-rc5-next-20221118 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 RIP: 0010:sk_user_ns include/net/sock.h:920 [inline] RIP: 0010:sk_diag_dump_uid net/unix/diag.c:119 [inline] RIP: 0010:sk_diag_fill+0x77d/0x890 net/unix/diag.c:170 Code: 89 ef e8 66 d4 2d fd c7 44 24 40 00 00 00 00 49 8d 7c 24 18 e8 54 d7 2d fd 49 8b 5c 24 18 48 8d bb 70 02 00 00 e8 43 d7 2d fd <48> 8b 9b 70 02 00 00
40 00 00 00 00 49 8d 7c 24 18 e8 54 d7 2d fd 49 8b 5c 24 18 48 8d bb 70 02 00 00 e8 43 d7 2d fd <48> 8b 9b 70 02 00 00 48 8d 7b 10 e8 33 d7 2d fd 48 8b 5b 10 48 8d RSP: 0018:ffffc90000d67968 EFLAGS: 00010246 RAX: ffff88812badaa48 RBX: 0000000000000000 RCX: ffffffff840d481d RDX: 0000000000000465 RSI: 0000000000000000 RDI: 0000000000000270 RBP: ffffc90000d679a8 R08: 0000000000000277 R09: 0000000000000000 R10: 0001ffffffffffff R11: 0001c90000d679a8 R12: ffff88812ac03800 R13: ffff88812c87c400 R14: ffff88812ae42210 R15: ffff888103026940 FS: 00007f08b4e6f700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000270 CR3: 000000012
00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000270 CR3: 000000012c58b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> unix_diag_get_exact net/unix/diag.c:285 [inline] unix_diag_handler_dump+0x3f9/0x500 net/unix/diag.c:317 __sock_diag_cmd net/core/sock_diag.c:235 [inline] sock_diag_rcv_msg+0x237/0x250 net/core/sock_diag.c:266 netlink_rcv_skb+0x13e/0x250 net/netlink/af_netlink.c:2564 sock_diag_rcv+0x24/0x40 net/core/sock_diag.c:277 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline] netlink_unicast+0x5e9
v+0x24/0x40 net/core/sock_diag.c:277 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline] netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1356 netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1932 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2476 ___sys_sendmsg net/socket.c:2530 [inline] __sys_sendmsg+0x197/0x230 net/socket.c:2559 __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x