Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-49017 State: PUBLISHED Published: 2024-10-21T20:06:25.971Z Last Updated: 2025-05-04T08:28:09.328Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tipc: re-fetch skb cb after tipc_msg_validate As the call trace shows, the original skb was freed in tipc_msg_validate(), and dereferencing the old skb cb would cause an use-after-free crash. BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Call Trace: <IRQ> tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] ... Allocated by task 47078: kmem_cache_alloc_node+0x158/0x4d0 __alloc_skb+0
/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] ... Allocated by task 47078: kmem_cache_alloc_node+0x158/0x4d0 __alloc_skb+0x1c1/0x270 tipc_buf_acquire+0x1e/0xe0 [tipc] tipc_msg_create+0x33/0x1c0 [tipc] tipc_link_build_proto_msg+0x38a/0x2100 [tipc] tipc_link_timeout+0x8b8/0xef0 [tipc] tipc_node_timeout+0x2a1/0x960 [tipc] call_timer_fn+0x2d/0x1c0 ... Freed by task 47078: tipc_msg_validate+0x7b/0x440 [tipc] tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] This patch fixes it by re-fetching the skb cb from the new allocated skb after calling tipc_msg_validate(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.
ted skb after calling tipc_msg_validate(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a1ba595e35aa3afbe417ff0af353afb9f65559c0 - https://git.kernel.org/stable/c/1daec0815655e110c6f206c5e777a4af8168ff58 - https://git.kernel.org/stable/c/e128190adb2edfd5042105b5d1ed4553f295f5ef - https://git.kernel.org/stable/c/3067bc61fcfe3081bf4807ce65560f499e895e77
CVE ID: CVE-2022-49018 State: PUBLISHED Published: 2024-10-21T20:06:26.627Z Last Updated: 2025-05-04T12:44:10.838Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix sleep in atomic at close time Matt reported a splat at msk close time: BUG: sleeping function called from invalid context at net/mptcp/protocol.c:2877 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 155, name: packetdrill preempt_count: 201, expected: 0 RCU nest depth: 0, expected: 0 4 locks held by packetdrill/155: #0: ffff888001536990 (&sb->s_type->i_mutex_key#6){+.+.}-{3:3}, at: __sock_release (net/socket.c:650) #1: ffff88800b498130 (sk_lock-AF_INE
990 (&sb->s_type->i_mutex_key#6){+.+.}-{3:3}, at: __sock_release (net/socket.c:650) #1: ffff88800b498130 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close (net/mptcp/protocol.c:2973) #2: ffff88800b49a130 (sk_lock-AF_INET/1){+.+.}-{0:0}, at: __mptcp_close_ssk (net/mptcp/protocol.c:2363) #3: ffff88800b49a0b0 (slock-AF_INET){+...}-{2:2}, at: __lock_sock_fast (include/net/sock.h:1820) Preemption disabled at: 0x0 CPU: 1 PID: 155 Comm: packetdrill Not tainted 6.1.0-rc5 #365 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) __might_resched.cold (kernel/sched/core.c:9891) __mptcp_destroy_sock (inclu
lvl (lib/dump_stack.c:107 (discriminator 4)) __might_resched.cold (kernel/sched/core.c:9891) __mptcp_destroy_sock (include/linux/kernel.h:110) __mptcp_close (net/mptcp/protocol.c:2959) mptcp_subflow_queue_clean (include/net/sock.h:1777) __mptcp_close_ssk (net/mptcp/protocol.c:2363) mptcp_destroy_common (net/mptcp/protocol.c:3170) mptcp_destroy (include/net/sock.h:1495) __mptcp_destroy_sock (net/mptcp/protocol.c:2886) __mptcp_close (net/mptcp/protocol.c:2959) mptcp_close (net/mptcp/protocol.c:2974) inet_release (net/ipv4/af_inet.c:432) __sock_release (net/socket.c:651) sock_close (net/socket.c:1367) __fput (fs/file_table.c:320) task_work_run (kernel/task_work.c:181 (discriminator 1)) exit_to_
close (net/socket.c:1367) __fput (fs/file_table.c:320) task_work_run (kernel/task_work.c:181 (discriminator 1)) exit_to_user_mode_prepare (include/linux/resume_user_mode.h:49) syscall_exit_to_user_mode (kernel/entry/common.c:130) do_syscall_64 (arch/x86/entry/common.c:87) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) We can't call mptcp_close under the 'fast' socket lock variant, replace it with a sock_lock_nested() as the relevant code is already under the listening msk socket lock protection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d8e6c5500dbf0f3e87aace90d4beba6ae928e866 - https://git.kernel.org/stable/c/b4f166651d0
- https://git.kernel.org/stable/c/d8e6c5500dbf0f3e87aace90d4beba6ae928e866 - https://git.kernel.org/stable/c/b4f166651d03b5484fa179817ba8ad4899a5a6ac
CVE ID: CVE-2022-49019 State: PUBLISHED Published: 2024-10-21T20:06:27.306Z Last Updated: 2025-05-04T08:28:11.934Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: nixge: fix NULL dereference In function nixge_hw_dma_bd_release() dereference of NULL pointer priv->rx_bd_v is possible for the case of its allocation failure in nixge_hw_dma_bd_init(). Move for() loop with priv->rx_bd_v dereference under the check for its validity. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/910c0264b64ef2dad8887714a7c5
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/910c0264b64ef2dad8887714a7c56c93e39a0ed3 - https://git.kernel.org/stable/c/45752af0247589e6d3dede577415bfe117b4392c - https://git.kernel.org/stable/c/9c584d6d9cfb935dce8fc81a4c26debac0a3049b - https://git.kernel.org/stable/c/80e82f7b440b65cf131dce10f487dc73a7046e6b - https://git.kernel.org/stable/c/9256db4e45e8b497b0e993cc3ed4ad08eb2389b6
CVE ID: CVE-2022-49020 State: PUBLISHED Published: 2024-10-21T20:06:27.976Z Last Updated: 2025-05-04T08:28:13.138Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/9p: Fix a potential socket leak in p9_socket_open Both p9_fd_create_tcp() and p9_fd_create_unix() will call p9_socket_open(). If the creation of p9_trans_fd fails, p9_fd_create_tcp() and p9_fd_create_unix() will return an error directly instead of releasing the cscoket, which will result in a socket leak. This patch adds sock_release() to fix the leak issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0396227f4da
leak issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0396227f4daf4792a6a8aaa3b7771dc25c4cd443 - https://git.kernel.org/stable/c/ded893965b895b2dccd3d1436d8d3daffa23ea64 - https://git.kernel.org/stable/c/8b14bd0b500aec1458b51cb621c8e5fab3304260 - https://git.kernel.org/stable/c/2d24d91b9f44620824fc37b766f7cae00ca32748 - https://git.kernel.org/stable/c/e01c1542379fb395e7da53706df598f38905dfbf - https://git.kernel.org/stable/c/8782b32ef867de7981bbe9e86ecb90e92e8780bd - https://git.kernel.org/stable/c/aa08323fe18cb7cf95317ffa2d54ca1de8e74ebd - https://git.kernel.org/stable/c/dcc14cfd7debe11b825cb077e75d91d2575b4cb8
CVE ID: CVE-2022-49021 State: PUBLISHED Published: 2024-10-21T20:06:28.608Z Last Updated: 2025-05-04T08:28:14.303Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: phy: fix null-ptr-deref while probe() failed I got a null-ptr-deref report as following when doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000000058 Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G B N 6.1.0-rc3+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:klist_put+0x2d/0xd0 Call Trace: <TASK> klist_remove+0xf1/0x1c0 device_release_drive
13.0-1ubuntu1.1 04/01/2014 RIP: 0010:klist_put+0x2d/0xd0 Call Trace: <TASK> klist_remove+0xf1/0x1c0 device_release_driver_internal+0x23e/0x2d0 bus_remove_device+0x1bd/0x240 device_del+0x357/0x770 phy_device_remove+0x11/0x30 mdiobus_unregister+0xa5/0x140 release_nodes+0x6a/0xa0 devres_release_all+0xf8/0x150 device_unbind_cleanup+0x19/0xd0 //probe path: phy_device_register() device_add() phy_connect phy_attach_direct() //set device driver probe() //it's failed, driver is not bound device_bind_driver() // probe failed, it's not called //remove path: phy_device_remove() device_del() device_release_driver_internal() __device_release_driver() //dev->drv is not NULL klist_remove() <- knode_driver i
del() device_release_driver_internal() __device_release_driver() //dev->drv is not NULL klist_remove() <- knode_driver is not added yet, cause null-ptr-deref In phy_attach_direct(), after setting the 'dev->driver', probe() fails, device_bind_driver() is not called, so the knode_driver->n_klist is not set, then it causes null-ptr-deref in __device_release_driver() while deleting device. Fix this by setting dev->driver to NULL in the error path in phy_attach_direct(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8aaafe0f71314f46a066382a047ba8bb3840d273 - https://git.kernel.org/stable/c/51d7f6b20fae8bae64ad1136f1e30d1fd5ba78f7 - https://git.ke
4f46a066382a047ba8bb3840d273 - https://git.kernel.org/stable/c/51d7f6b20fae8bae64ad1136f1e30d1fd5ba78f7 - https://git.kernel.org/stable/c/0744c7be4de564db03e24527b2e096b7e0e20972 - https://git.kernel.org/stable/c/3e21f85d87c836462bb52ef2078ea561260935c1 - https://git.kernel.org/stable/c/fe6bc99c27c21348f548966118867ed26a9a372c - https://git.kernel.org/stable/c/7730904f50c7187dd16c76949efb56b5fb55cd57 - https://git.kernel.org/stable/c/eaa5722549ac2604ffa56c2e946acc83226f130c - https://git.kernel.org/stable/c/369eb2c9f1f72adbe91e0ea8efb130f0a2ba11a6
CVE ID: CVE-2022-49022 State: PUBLISHED Published: 2024-10-21T20:06:29.239Z Last Updated: 2025-05-04T08:28:15.655Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration Fix possible out-of-bound access in ieee80211_get_rate_duration routine as reported by the following UBSAN report: UBSAN: array-index-out-of-bounds in net/mac80211/airtime.c:455:47 index 15 is out of range for type 'u16 [12]' CPU: 2 PID: 217 Comm: kworker/u32:10 Not tainted 6.1.0-060100rc3-generic Hardware name: Acer Aspire TC-281/Aspire TC-281, BIOS R01-A2 07/18/2017 Workqueue: mt76 mt76u_tx_status_
0100rc3-generic Hardware name: Acer Aspire TC-281/Aspire TC-281, BIOS R01-A2 07/18/2017 Workqueue: mt76 mt76u_tx_status_data [mt76_usb] Call Trace: <TASK> show_stack+0x4e/0x61 dump_stack_lvl+0x4a/0x6f dump_stack+0x10/0x18 ubsan_epilogue+0x9/0x43 __ubsan_handle_out_of_bounds.cold+0x42/0x47 ieee80211_get_rate_duration.constprop.0+0x22f/0x2a0 [mac80211] ? ieee80211_tx_status_ext+0x32e/0x640 [mac80211] ieee80211_calc_rx_airtime+0xda/0x120 [mac80211] ieee80211_calc_tx_airtime+0xb4/0x100 [mac80211] mt76x02_send_tx_status+0x266/0x480 [mt76x02_lib] mt76x02_tx_status_data+0x52/0x80 [mt76x02_lib] mt76u_tx_status_data+0x67/0xd0 [mt76_usb] process_one_work+0x225/0x400 worker_thread+0x50/0x3e0 ? process_
[mt76x02_lib] mt76u_tx_status_data+0x67/0xd0 [mt76_usb] process_one_work+0x225/0x400 worker_thread+0x50/0x3e0 ? process_one_work+0x400/0x400 kthread+0xe9/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0184ede0ec61b9cd075babfaa45081b1bf322234 - https://git.kernel.org/stable/c/59b54f0563b6546c94bdb6823d3b382c75407019 - https://git.kernel.org/stable/c/f0fcad4c7201ecfaa17357f4ce0c50b4708df22d - https://git.kernel.org/stable/c/3e8f7abcc3473bc9603323803aeaed4ffcc3a2ab
CVE ID: CVE-2022-49023 State: PUBLISHED Published: 2024-10-21T20:06:29.901Z Last Updated: 2025-05-04T08:28:16.767Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix buffer overflow in elem comparison For vendor elements, the code here assumes that 5 octets are present without checking. Since the element itself is already checked to fit, we only need to check the length. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f5c2ec288a865dbe3706b09bed12302e9f6d696b - https://git.kernel.org/stable/c/9e6b79a3cd17620d467311b30d56f2648f6880aa - https://git.kernel.org/stable/
302e9f6d696b - https://git.kernel.org/stable/c/9e6b79a3cd17620d467311b30d56f2648f6880aa - https://git.kernel.org/stable/c/88a6fe3707888bd1893e9741157a7035c4159ab6 - https://git.kernel.org/stable/c/391cb872553627bdcf236c03ee7d5adb275e37e1 - https://git.kernel.org/stable/c/9f16b5c82a025cd4c864737409234ddc44fb166a
CVE ID: CVE-2022-49024 State: PUBLISHED Published: 2024-10-21T20:06:30.544Z Last Updated: 2025-05-04T08:28:17.801Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods In m_can_pci_remove() and error handling path of m_can_pci_probe(), m_can_class_free_dev() should be called to free resource allocated by m_can_class_allocate_dev(), otherwise there will be memleak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ea8dc27bb044e19868155e500ce397007be98656 - https://git.kernel.org/stable/c/0bbb88651ef6b7fbb1bf75ec7b
ernel.org/stable/c/ea8dc27bb044e19868155e500ce397007be98656 - https://git.kernel.org/stable/c/0bbb88651ef6b7fbb1bf75ec7ba69add632e834b - https://git.kernel.org/stable/c/1eca1d4cc21b6d0fc5f9a390339804c0afce9439
CVE ID: CVE-2022-49025 State: PUBLISHED Published: 2024-10-21T20:06:31.189Z Last Updated: 2025-05-04T08:28:19.128Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free when reverting termination table When having multiple dests with termination tables and second one or afterwards fails the driver reverts usage of term tables but doesn't reset the assignment in attr->dests[num_vport_dests].termtbl which case a use-after-free when releasing the rule. Fix by resetting the assignment of termtbl to null. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0a2d73a77
mtbl to null. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0a2d73a77060c3cbdc6e801cd5d979d674cd404b - https://git.kernel.org/stable/c/0d2f9d95d9fbe993f3c4bafb87d59897b0325aff - https://git.kernel.org/stable/c/372eb550faa0757349040fd43f59483cbfdb2c0b - https://git.kernel.org/stable/c/e6d2d26a49c3a9cd46b232975e45236304810904 - https://git.kernel.org/stable/c/52c795af04441d76f565c4634f893e5b553df2ae
CVE ID: CVE-2022-49026 State: PUBLISHED Published: 2024-10-21T20:06:31.876Z Last Updated: 2025-05-04T08:28:20.354Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: e100: Fix possible use after free in e100_xmit_prepare In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will resend the skb. But the skb is already freed, which will cause UAF bug when the upper layer resends the skb. Remove the harmful free. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b775f37d943966f6f77dca402f5a9dedce502c25 - h
tes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b775f37d943966f6f77dca402f5a9dedce502c25 - https://git.kernel.org/stable/c/9fc27d22cdb9b1fcd754599d216a8992fed280cd - https://git.kernel.org/stable/c/b46f6144ab89d3d757ead940759c505091626a7d - https://git.kernel.org/stable/c/45605c75c52c7ae7bfe902214343aabcfe5ba0ff
CVE ID: CVE-2022-49027 State: PUBLISHED Published: 2024-10-21T20:06:32.560Z Last Updated: 2025-05-04T08:28:21.885Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iavf: Fix error handling in iavf_init_module() The iavf_init_module() won't destroy workqueue when pci_register_driver() failed. Call destroy_workqueue() when pci_register_driver() failed to prevent the resource leak. Similar to the handling of u132_hcd_init in commit f276e002793c ("usb: u132-hcd: fix resource leak") Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/971c55f0763b480e63ceb7a22beb19be2509e5ed - https://git.ke
DP Vulnrichment: References: - https://git.kernel.org/stable/c/971c55f0763b480e63ceb7a22beb19be2509e5ed - https://git.kernel.org/stable/c/0d9f5bd54b913018031c5b964fc1f9a31f5f6cb5 - https://git.kernel.org/stable/c/bd477b891a4fa084561234eed4afacb3001dd359 - https://git.kernel.org/stable/c/227d8d2f7f2278b8468c5531b0cd0f2a905b4486
CVE ID: CVE-2022-49028 State: PUBLISHED Published: 2024-10-21T20:06:33.205Z Last Updated: 2025-05-04T08:28:23.255Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ixgbevf: Fix resource leak in ixgbevf_init_module() ixgbevf_init_module() won't destroy the workqueue created by create_singlethread_workqueue() when pci_register_driver() failed. Add destroy_workqueue() in fail path to prevent the resource leak. Similar to the handling of u132_hcd_init in commit f276e002793c ("usb: u132-hcd: fix resource leak") Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f166c62cad798c53300b4b327e44
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f166c62cad798c53300b4b327e44300c73ec492d - https://git.kernel.org/stable/c/7109e941099244cc876a4b3cb7a3ec79f104374a - https://git.kernel.org/stable/c/c99671d4699dcf90d6939923c8fe8a8918e140b2 - https://git.kernel.org/stable/c/8cfa238a48f34038464b99d0b4825238c2687181
CVE ID: CVE-2022-49029 State: PUBLISHED Published: 2024-10-21T20:06:33.918Z Last Updated: 2025-05-04T08:28:24.683Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Smatch report warning as follows: drivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn: '&data->list' not removed from list If ibmpex_find_sensors() fails in ibmpex_register_bmc(), data will be freed, but data->list will not be removed from driver_data.bmc_data, then list traversal may cause UAF. Fix by removeing it from driver_data.bmc_data before free(). Additional Analyst Notes: - CISA ADP Vulnrichme
cause UAF. Fix by removeing it from driver_data.bmc_data before free(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f2a13196ad41c6c2ab058279dffe6c97292e753a - https://git.kernel.org/stable/c/798198273bf86673b970b51acdb35e57f42b3fcb - https://git.kernel.org/stable/c/24b9633f7db7f4809be7053df1d2e117e7c2de10 - https://git.kernel.org/stable/c/7b2b67fe1339389e0bf3c37c7a677a004ac0e4e3 - https://git.kernel.org/stable/c/90907cd4d11351ff76c9a447bcb5db0e264c47cd - https://git.kernel.org/stable/c/45f6e81863747c0d7bc6a95ec51129900e71467a - https://git.kernel.org/stable/c/e65cfd1f9cd27d9c27ee5cb88128a9f79f25d863 - https://git.kernel.org/stable/c/e2a87
1467a - https://git.kernel.org/stable/c/e65cfd1f9cd27d9c27ee5cb88128a9f79f25d863 - https://git.kernel.org/stable/c/e2a87785aab0dac190ac89be6a9ba955e2c634f2
CVE ID: CVE-2022-49030 State: PUBLISHED Published: 2024-10-21T20:06:34.571Z Last Updated: 2025-05-04T08:28:25.737Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 * max_entries will overflow u32 when mapping producer page and data pages. Only casting max_entries to size_t is not enough, because for 32-bits application on 64-bits kernel the size of read-only mmap region also could overflow size_t. So fixing it by casting the size of read-only mmap region into a __u64 and checking whether or not there will be overflow during mmap.
y casting the size of read-only mmap region into a __u64 and checking whether or not there will be overflow during mmap. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8a549ab6724520aa3c07f47e0eba820293551490 - https://git.kernel.org/stable/c/0140e079a42064680394fff1199a7b5483688dec - https://git.kernel.org/stable/c/535a25ab4f9a45f74ba38ab71de95e97474922ed - https://git.kernel.org/stable/c/927cbb478adf917e0a142b94baa37f06279cc466
CVE ID: CVE-2022-49031 State: PUBLISHED Published: 2024-10-21T20:06:35.214Z Last Updated: 2025-05-04T08:28:26.837Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4403: Fix oob read in afe4403_read_raw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4403_read_raw+0x42e/0x4c0 Read of size 4 at addr ffffffffc02ac638 by task cat/279 Call Trace: afe4403_read_raw iio_read_channel_info dev_attr_show The buggy address belongs to the variable: afe4403_channel_leds+0x18/0xffffffffffffe9e0 This issue can be reproduced by singe command: $ cat /sys/bus/spi/devices/spi0.0/iio\:device0/in_int
/0xffffffffffffe9e0 This issue can be reproduced by singe command: $ cat /sys/bus/spi/devices/spi0.0/iio\:device0/in_intensity6_raw The array size of afe4403_channel_leds is less than channels, so access with chan->address cause OOB read in afe4403_read_raw. Fix it by moving access before use it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/98afcb5f3be645d330c74c5194ba0d80e26f95e0 - https://git.kernel.org/stable/c/c9268df36818ee4eaaaeadc80009b442a5ca69c9 - https://git.kernel.org/stable/c/726fa3e4ab97dcff1c745bdc4fb137366cb8d3df - https://git.kernel.org/stable/c/2d6a437064ffbe685c67ddb16dfc0946074c6c3f - https://git.kernel.org/stable/c/b1756
8d3df - https://git.kernel.org/stable/c/2d6a437064ffbe685c67ddb16dfc0946074c6c3f - https://git.kernel.org/stable/c/b1756af172fb80a3edc143772d49e166ec691b6c - https://git.kernel.org/stable/c/e7e76a77aabef8989cbc0a8417af1aa040620867 - https://git.kernel.org/stable/c/06c6ce21cec77dfa860d57e7a006000a57812efb - https://git.kernel.org/stable/c/58143c1ed5882c138a3cd2251a336fc8755f23d9
CVE ID: CVE-2022-49032 State: PUBLISHED Published: 2024-10-21T20:06:35.864Z Last Updated: 2025-05-04T08:28:28.046Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e4658 by task cat/278 Call Trace: afe4404_read_raw iio_read_channel_info dev_attr_show The buggy address belongs to the variable: afe4404_channel_leds+0x18/0xffffffffffffe9c0 This issue can be reproduce by singe command: $ cat /sys/bus/i2c/devices/0-0058/iio\:device0
eds+0x18/0xffffffffffffe9c0 This issue can be reproduce by singe command: $ cat /sys/bus/i2c/devices/0-0058/iio\:device0/in_intensity6_raw The array size of afe4404_channel_leds and afe4404_channel_offdacs are less than channels, so access with chan->address cause OOB read in afe4404_[read|write]_raw. Fix it by moving access before use them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/68de7da092f38395dde523f2e5db26eba6c23e28 - https://git.kernel.org/stable/c/113c08030a89aaf406f8a1d4549d758a67c2afba - https://git.kernel.org/stable/c/f5575041ec15310bdc50c42b8b22118cc900226e - https://git.kernel.org/stable/c/3f566b626029ca8598d48e5074e56bb373