Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-52751 State: PUBLISHED Published: 2024-05-21T15:30:40.226Z Last Updated: 2025-05-04T07:42:28.989Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2_query_info_compound() The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options 'multichannel,max_channels=2,vers=3.1.1,mfsymlinks,noperm' BUG: KASAN: slab-use-after-free in smb2_query_info_compound+0x423/0x6d0 [cifs] Read of size 8 at addr ffff888014941048 by task xfs_io/27534 CPU: 0 PID: 27534 Comm: xfs_io Not tainted 6.6.0-rc7 #1 Hardware name: QEMU Standa
ffff888014941048 by task xfs_io/27534 CPU: 0 PID: 27534 Comm: xfs_io Not tainted 6.6.0-rc7 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Call Trace: dump_stack_lvl+0x4a/0x80 print_report+0xcf/0x650 ? srso_alias_return_thunk+0x5/0x7f ? srso_alias_return_thunk+0x5/0x7f ? __phys_addr+0x46/0x90 kasan_report+0xda/0x110 ? smb2_query_info_compound+0x423/0x6d0 [cifs] ? smb2_query_info_compound+0x423/0x6d0 [cifs] smb2_query_info_compound+0x423/0x6d0 [cifs] ? __pfx_smb2_query_info_compound+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0x7f ? __stack_depot_save+0x39/0x480 ? kasan_save_stack+0x33/0x60 ? kasan_set_track+0x25/0x30 ? ___
ias_return_thunk+0x5/0x7f ? __stack_depot_save+0x39/0x480 ? kasan_save_stack+0x33/0x60 ? kasan_set_track+0x25/0x30 ? ____kasan_slab_free+0x126/0x170 smb2_queryfs+0xc2/0x2c0 [cifs] ? __pfx_smb2_queryfs+0x10/0x10 [cifs] ? __pfx___lock_acquire+0x10/0x10 smb311_queryfs+0x210/0x220 [cifs] ? __pfx_smb311_queryfs+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0x7f ? __lock_acquire+0x480/0x26c0 ? lock_release+0x1ed/0x640 ? srso_alias_return_thunk+0x5/0x7f ? do_raw_spin_unlock+0x9b/0x100 cifs_statfs+0x18c/0x4b0 [cifs] statfs_by_dentry+0x9b/0xf0 fd_statfs+0x4e/0xb0 __do_sys_fstatfs+0x7f/0xe0 ? __pfx___do_sys_fstatfs+0x10/0x10 ? srso_alias_return_thunk+0x5/0x7f ? lockdep_hardirqs_on_prepare+0x136/0x200
x7f/0xe0 ? __pfx___do_sys_fstatfs+0x10/0x10 ? srso_alias_return_thunk+0x5/0x7f ? lockdep_hardirqs_on_prepare+0x136/0x200 ? srso_alias_return_thunk+0x5/0x7f do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Allocated by task 27534: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x8f/0xa0 open_cached_dir+0x71b/0x1240 [cifs] smb2_query_info_compound+0x5c3/0x6d0 [cifs] smb2_queryfs+0xc2/0x2c0 [cifs] smb311_queryfs+0x210/0x220 [cifs] cifs_statfs+0x18c/0x4b0 [cifs] statfs_by_dentry+0x9b/0xf0 fd_statfs+0x4e/0xb0 __do_sys_fstatfs+0x7f/0xe0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 27534: kasan_save_stack+0x33/0x60 kasan_set_tr
scall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 27534: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50 ____kasan_slab_free+0x126/0x170 slab_free_freelist_hook+0xd0/0x1e0 __kmem_cache_free+0x9d/0x1b0 open_cached_dir+0xff5/0x1240 [cifs] smb2_query_info_compound+0x5c3/0x6d0 [cifs] smb2_queryfs+0xc2/0x2c0 [cifs] This is a race between open_cached_dir() and cached_dir_lease_break() where the cache entry for the open directory handle receives a lease break while creating it. And before returning from open_cached_dir(), we put the last reference of the new @cfid because of !@cfid->has_lease. Besides the UAF, while running xfstests a lot
we put the last reference of the new @cfid because of !@cfid->has_lease. Besides the UAF, while running xfstests a lot of missed lease breaks have been noticed in tests that run several concurrent statfs(2) calls on those cached fids CIFS: VFS: \\w22-root1.gandalf.test No task to wake, unknown frame... CIFS: VFS: \\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \\w22-root1.gandalf.test smb buf 00000000715bfe83 len 108 CIFS: VFS: Dump pending requests: CIFS: VFS: \\w22-root1.gandalf.test No task to wake, unknown frame... CIFS: VFS: \\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \\w22-root1.gandalf.test smb buf 000000005aa7316e len 108 ... To fix both, in
Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \\w22-root1.gandalf.test smb buf 000000005aa7316e len 108 ... To fix both, in open_cached_dir() ensure that @cfid->has_lease is set right before sending out compounded request so that any potential lease break will be get processed by demultiplex thread while we're still caching @cfid. And, if open failed for some reason, re-check @cfid->has_lease to decide whether or not put lease reference. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6db94d08359c43f2c8fe372811cdee04564a41b9 - https://git.kernel.org/stable/c/93877b9afc2994c89362007aac480a7b150f386f - https://git.kernel.or
e372811cdee04564a41b9 - https://git.kernel.org/stable/c/93877b9afc2994c89362007aac480a7b150f386f - https://git.kernel.org/stable/c/5c86919455c1edec99ebd3338ad213b59271a71b
CVE ID: CVE-2023-52752 State: PUBLISHED Published: 2024-05-21T15:30:40.901Z Last Updated: 2025-11-03T19:28:47.925Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid use-after-free in @ses. This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting [ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816
, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] <TASK> [ 816.260499] ? die_addr+0x36/0x90 [ 816.260762] ? exc_general_protection+0x1b3/0x410 [ 816.261126] ? asm_exc_general_protection+0x26/0x30 [ 816.261502] ? cifs_debug_tcon+0xbd/0x240 [cifs] [ 816.261878] ? cifs_debug_tcon+0xab/0x240 [cifs] [ 816.262249] cifs_debug_data_proc_show+0x516/0xdb0 [cifs] [ 816.262689] ? seq_read_iter+0x379/0x470 [ 816.262995] seq_read_iter+0x118/0x470 [ 816.263291] proc_reg_read_iter+0x53/0x90 [ 816.263596] ? srso_alias_return_thunk+0x5/0x7f [ 816.263945] vfs_read+0x201/0x350 [ 816.264211] ksys_read+0x75/0x100 [ 816.264472] do_sysca
alias_return_thunk+0x5/0x7f [ 816.263945] vfs_read+0x201/0x350 [ 816.264211] ksys_read+0x75/0x100 [ 816.264472] do_syscall_64+0x3f/0x90 [ 816.264750] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2abdf136784b7edaec7ffe0f4b461b63f9c4c4de - https://git.kernel.org/stable/c/336a066990bb3962c46daf574ace596bda9303ce - https://git.kernel.org/stable/c/558817597d5fbd7af31f891b67b0fd20f0d047b7 - https://git.kernel.org/stable/c/89929ea46f9cc11ba66d2c64713aa5d5dc723b09 - https://git.kernel.org/stable/c/0ab6f842452ce2cae04209d4671ac6289d0aef8a - https
29ea46f9cc11ba66d2c64713aa5d5dc723b09 - https://git.kernel.org/stable/c/0ab6f842452ce2cae04209d4671ac6289d0aef8a - https://git.kernel.org/stable/c/d328c09ee9f15ee5a26431f5aad7c9239fa85e62
CVE ID: CVE-2023-52753 State: PUBLISHED Published: 2024-05-21T15:30:41.548Z Last Updated: 2025-07-11T17:19:34.797Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid NULL dereference of timing generator [Why & How] Check whether assigned timing generator is NULL or not before accessing its funcs to prevent NULL dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/09909f515032fa80b921fd3118efe66b185d10fd - https://git.kernel.org/stable/c/eac3e4760aa12159f7f5475d55a67b7933abc195 - https://git.kernel.org/stable/c/79b6a90f4f24333121
://git.kernel.org/stable/c/eac3e4760aa12159f7f5475d55a67b7933abc195 - https://git.kernel.org/stable/c/79b6a90f4f2433312154cd68452b0ba501fa74db - https://git.kernel.org/stable/c/4e497f1acd99075b13605b2e7fa0cba721a2cfd9 - https://git.kernel.org/stable/c/8a06894666e0b462c9316b26ab615cefdd0d676c - https://git.kernel.org/stable/c/6d8653b1a7a8dc938b566ae8c4f373b36e792c68 - https://git.kernel.org/stable/c/df8bc953eed72371e43ca407bd063507f760cf89 - https://git.kernel.org/stable/c/b1904ed480cee3f9f4036ea0e36d139cb5fee2d6
CVE ID: CVE-2023-52754 State: PUBLISHED Published: 2024-05-21T15:30:42.198Z Last Updated: 2025-05-04T07:42:32.430Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: imon: fix access to invalid resource for the second interface imon driver probes two USB interfaces, and at the probe of the second interface, the driver assumes blindly that the first interface got bound with the same imon driver. It's usually true, but it's still possible that the first interface is bound with another driver via a malformed descriptor. Then it may lead to a memory corruption, as spotted by syzkaller; imon driver accesses the data from drvdata
escriptor. Then it may lead to a memory corruption, as spotted by syzkaller; imon driver accesses the data from drvdata as struct imon_context object although it's a completely different one that was assigned by another driver. This patch adds a sanity check -- whether the first interface is really bound with the imon driver or not -- for avoiding the problem above at the probe time. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0f5068519f89d928d6c51100e4b274479123829f - https://git.kernel.org/stable/c/5e0b788fb96be36d1baf1a5c88d09c7c82a0452a - https://git.kernel.org/stable/c/b083aaf5db2eeca9e362723258e5d8698f7dd84e
e/c/5e0b788fb96be36d1baf1a5c88d09c7c82a0452a - https://git.kernel.org/stable/c/b083aaf5db2eeca9e362723258e5d8698f7dd84e - https://git.kernel.org/stable/c/10ec5a97f8f5a772a1a42b4eb27196b447cd3aa9 - https://git.kernel.org/stable/c/2a493a34bd6e496c55fabedd82b957193ace178f - https://git.kernel.org/stable/c/a1766a4fd83befa0b34d932d532e7ebb7fab1fa7
CVE ID: CVE-2023-52755 State: PUBLISHED Published: 2024-05-21T15:30:42.898Z Last Updated: 2025-05-04T07:42:33.718Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab out of bounds write in smb_inherit_dacl() slab out-of-bounds write is caused by that offsets is bigger than pntsd allocation size. This patch add the check to validate 3 offsets using allocation size. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/aaf0a07d60887d6c36fc46a24de0083744f07819 - https://git.kernel.org/stable/c/8387c94d73ec66eb597c7a23a8d9eadf64bfbafa - https://git.kern
6c36fc46a24de0083744f07819 - https://git.kernel.org/stable/c/8387c94d73ec66eb597c7a23a8d9eadf64bfbafa - https://git.kernel.org/stable/c/09d9d8b40a3338193619c14ed4dc040f4f119e70 - https://git.kernel.org/stable/c/712e01f32e577e7e48ab0adb5fe550646a3d93cb - https://git.kernel.org/stable/c/eebff19acaa35820cb09ce2ccb3d21bee2156ffb
CVE ID: CVE-2023-52756 State: REJECTED Published: 2024-05-21T15:30:43.574Z Last Updated: 2024-06-08T11:37:10.679Z Description: No description available.
CVE ID: CVE-2023-52757 State: PUBLISHED Published: 2024-05-21T15:30:44.248Z Last Updated: 2025-11-03T19:28:49.329Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when releasing mids All release_mid() callers seem to hold a reference of @mid so there is no need to call kref_put(&mid->refcount, __release_mid) under @server->mid_lock spinlock. If they don't, then an use-after-free bug would have occurred anyways. By getting rid of such spinlock also fixes a potential deadlock as shown below CPU 0 CPU 1 ------------------------------------------------------------------ cifs_demultiplex_thread() c
s shown below CPU 0 CPU 1 ------------------------------------------------------------------ cifs_demultiplex_thread() cifs_debug_data_proc_show() release_mid() spin_lock(&server->mid_lock); spin_lock(&cifs_tcp_ses_lock) spin_lock(&server->mid_lock) __release_mid() smb2_find_smb_tcon() spin_lock(&cifs_tcp_ses_lock) *deadlock* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/99f476e27aad5964ab13777d84fda67d1356dec1 - https://git.kernel.org/stable/c/ce49569079a9d4cad26c0f1d4653382fd9a5ca7a - https://git.kernel.org/stable/c/9eb44db68c5b7f5aa22b8fc7de74a3e2e08d1f29 - https://git.kernel.org/stable/c/b9bb9607b1fc12fca51f5632d
kernel.org/stable/c/9eb44db68c5b7f5aa22b8fc7de74a3e2e08d1f29 - https://git.kernel.org/stable/c/b9bb9607b1fc12fca51f5632da25b36975f599bf - https://git.kernel.org/stable/c/c1a5962f1462b64fe7b69f20a4b6af8067bc2d26 - https://git.kernel.org/stable/c/e6322fd177c6885a21dd4609dc5e5c973d1a2eb7
CVE ID: CVE-2023-52758 State: REJECTED Published: 2024-05-21T15:30:45.122Z Last Updated: 2024-05-24T15:27:25.169Z Description: No description available.
CVE ID: CVE-2023-52759 State: REJECTED Published: 2024-05-21T15:30:45.773Z Last Updated: 2024-12-19T11:08:07.187Z Description: No description available.
CVE ID: CVE-2023-52760 State: PUBLISHED Published: 2024-05-21T15:30:46.427Z Last Updated: 2025-11-03T21:50:24.860Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in gfs2_qd_dealloc In gfs2_put_super(), whether withdrawn or not, the quota should be cleaned up by gfs2_quota_cleanup(). Otherwise, struct gfs2_sbd will be freed before gfs2_qd_dealloc (rcu callback) has run for all gfs2_quota_data objects, resulting in use-after-free. Also, gfs2_destroy_threads() and gfs2_quota_cleanup() is already called by gfs2_make_fs_ro(), so in gfs2_put_super(), after calling gfs2_make_fs_ro(), there is no need to c
) is already called by gfs2_make_fs_ro(), so in gfs2_put_super(), after calling gfs2_make_fs_ro(), there is no need to call them again. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/08a28272faa750d4357ea2cb48d2baefd778ea81 - https://git.kernel.org/stable/c/bdcb8aa434c6d36b5c215d02a9ef07551be25a37
CVE ID: CVE-2023-52761 State: PUBLISHED Published: 2024-05-21T15:30:47.086Z Last Updated: 2025-05-04T07:42:37.274Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: riscv: VMAP_STACK overflow detection thread-safe commit 31da94c25aea ("riscv: add VMAP_STACK overflow detection") added support for CONFIG_VMAP_STACK. If overflow is detected, CPU switches to `shadow_stack` temporarily before switching finally to per-cpu `overflow_stack`. If two CPUs/harts are racing and end up in over flowing kernel stack, one or both will end up corrupting each other state because `shadow_stack` is not per-cpu. This patch optimizes per-cpu overflow s
h will end up corrupting each other state because `shadow_stack` is not per-cpu. This patch optimizes per-cpu overflow stack switch by directly picking per-cpu `overflow_stack` and gets rid of `shadow_stack`. Following are the changes in this patch - Defines an asm macro to obtain per-cpu symbols in destination register. - In entry.S, when overflow is detected, per-cpu overflow stack is located using per-cpu asm macro. Computing per-cpu symbol requires a temporary register. x31 is saved away into CSR_SCRATCH (CSR_SCRATCH is anyways zero since we're in kernel). Please see Links for additional relevant disccussion and alternative solution. Tested by `echo EXHAUST_STACK > /sys/kernel/debug/prov
nks for additional relevant disccussion and alternative solution. Tested by `echo EXHAUST_STACK > /sys/kernel/debug/provoke-crash/DIRECT` Kernel crash log below Insufficient stack space to handle exception!/debug/provoke-crash/DIRECT Task stack: [0xff20000010a98000..0xff20000010a9c000] Overflow stack: [0xff600001f7d98370..0xff600001f7d99370] CPU: 1 PID: 205 Comm: bash Not tainted 6.1.0-rc2-00001-g328a1f96f7b9 #34 Hardware name: riscv-virtio,qemu (DT) epc : __memset+0x60/0xfc ra : recursive_loop+0x48/0xc6 [lkdtm] epc : ffffffff808de0e4 ra : ffffffff0163a752 sp : ff20000010a97e80 gp : ffffffff815c0330 tp : ff600000820ea280 t0 : ff20000010a97e88 t1 : 000000000000002e t2 : 3233206874706564 s0 :
7e80 gp : ffffffff815c0330 tp : ff600000820ea280 t0 : ff20000010a97e88 t1 : 000000000000002e t2 : 3233206874706564 s0 : ff20000010a982b0 s1 : 0000000000000012 a0 : ff20000010a97e88 a1 : 0000000000000000 a2 : 0000000000000400 a3 : ff20000010a98288 a4 : 0000000000000000 a5 : 0000000000000000 a6 : fffffffffffe43f0 a7 : 00007fffffffffff s2 : ff20000010a97e88 s3 : ffffffff01644680 s4 : ff20000010a9be90 s5 : ff600000842ba6c0 s6 : 00aaaaaac29e42b0 s7 : 00fffffff0aa3684 s8 : 00aaaaaac2978040 s9 : 0000000000000065 s10: 00ffffff8a7cad10 s11: 00ffffff8a76a4e0 t3 : ffffffff815dbaf4 t4 : ffffffff815dbaf4 t5 : ffffffff815dbab8 t6 : ff20000010a9bb48 status: 0000000200000120 badaddr: ff20000010a97e88 cause:
: ffffffff815dbaf4 t5 : ffffffff815dbab8 t6 : ff20000010a9bb48 status: 0000000200000120 badaddr: ff20000010a97e88 cause: 000000000000000f Kernel panic - not syncing: Kernel stack overflow CPU: 1 PID: 205 Comm: bash Not tainted 6.1.0-rc2-00001-g328a1f96f7b9 #34 Hardware name: riscv-virtio,qemu (DT) Call Trace: [<ffffffff80006754>] dump_backtrace+0x30/0x38 [<ffffffff808de798>] show_stack+0x40/0x4c [<ffffffff808ea2a8>] dump_stack_lvl+0x44/0x5c [<ffffffff808ea2d8>] dump_stack+0x18/0x20 [<ffffffff808dec06>] panic+0x126/0x2fe [<ffffffff800065ea>] walk_stackframe+0x0/0xf0 [<ffffffff0163a752>] recursive_loop+0x48/0xc6 [lkdtm] SMP: stopping secondary CPUs ---[ end Kernel panic - not syncing: Kernel s
ff0163a752>] recursive_loop+0x48/0xc6 [lkdtm] SMP: stopping secondary CPUs ---[ end Kernel panic - not syncing: Kernel stack overflow ]--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1493baaf09e3c1899959c8a107cd1207e16d1788 - https://git.kernel.org/stable/c/eff53aea3855f71992c043cebb1c00988c17ee20 - https://git.kernel.org/stable/c/be97d0db5f44c0674480cb79ac6f5b0529b84c76
CVE ID: CVE-2023-52762 State: PUBLISHED Published: 2024-05-21T15:30:47.724Z Last Updated: 2025-05-04T07:42:38.396Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: virtio-blk: fix implicit overflow on virtio_max_dma_size The following codes have an implicit conversion from size_t to u32: (u32)max_size = (size_t)virtio_max_dma_size(vdev); This may lead overflow, Ex (size_t)4G -> (u32)0. Once virtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX instead. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/72775cad7f572bb2501f9ea609e1d20e68f0b38b - htt
r: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/72775cad7f572bb2501f9ea609e1d20e68f0b38b - https://git.kernel.org/stable/c/472bd4787406bef2e8b41ee4c74d960a06a49a48 - https://git.kernel.org/stable/c/017278f141141367f7d14b203e930b45b6ffffb9 - https://git.kernel.org/stable/c/d667fe301dcbcb12d1d6494fc4b8abee2cb75d90 - https://git.kernel.org/stable/c/fafb51a67fb883eb2dde352539df939a251851be
CVE ID: CVE-2023-52763 State: PUBLISHED Published: 2024-05-21T15:30:48.369Z Last Updated: 2025-05-04T07:42:39.473Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data. The `i3c_master_bus_init` function may attach the I2C devices before the I3C bus initialization. In this flow, the DAT `alloc_entry`` will be used before the DAT `init`. Additionally, if the `i3c_master_bus_init` fails, the DAT `cleanup` will execute before the device is detached, which will execue DAT `free_entry` function. The above scenario can cause the driver to use DAT_data when it is NULL. Add
hich will execue DAT `free_entry` function. The above scenario can cause the driver to use DAT_data when it is NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/39c71357e68e2f03766f9321b9f4882e49ff1442 - https://git.kernel.org/stable/c/e64d23dc65810be4e3395d72df0c398f60c991f9 - https://git.kernel.org/stable/c/3cb79a365e7cce8f121bba91312e2ddd206b9781 - https://git.kernel.org/stable/c/eed74230435c61eeb58abaa275b1820e6a4b7f02 - https://git.kernel.org/stable/c/b53e9758a31c683fc8615df930262192ed5f034b
CVE ID: CVE-2023-52764 State: PUBLISHED Published: 2024-05-21T15:30:49.032Z Last Updated: 2025-05-04T07:42:40.597Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: gspca: cpia1: shift-out-of-bounds in set_flicker Syzkaller reported the following issue: UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too large for 32-bit type 'int' When the value of the variable "sd->params.exposure.gain" exceeds the number of bits in an integer, a shift-out-of-bounds error is reported. It is triggered because the variable "currentexp" cannot be left-shifted by more than the number of bits in an i
ported. It is triggered because the variable "currentexp" cannot be left-shifted by more than the number of bits in an integer. In order to avoid invalid range during left-shift, the conditional expression is added. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/69bba62600bd91d6b7c1e8ca181faf8ac64f7060 - https://git.kernel.org/stable/c/2eee8edfff90e22980a6b22079d238c3c9d323bb - https://git.kernel.org/stable/c/8f83c85ee88225319c52680792320c02158c2a9b - https://git.kernel.org/stable/c/c6b6b8692218da73b33b310d7c1df90f115bdd9a - https://git.kernel.org/stable/c/09cd8b561aa9796903710a1046957f2b112c8f26 - https://git.kernel.
33b310d7c1df90f115bdd9a - https://git.kernel.org/stable/c/09cd8b561aa9796903710a1046957f2b112c8f26 - https://git.kernel.org/stable/c/a647f27a7426d2fe1b40da7c8fa2b81354a51177 - https://git.kernel.org/stable/c/93bddd6529f187f510eec759f37d0569243c9809 - https://git.kernel.org/stable/c/e2d7149b913d14352c82624e723ce1c211ca06d3 - https://git.kernel.org/stable/c/099be1822d1f095433f4b08af9cc9d6308ec1953
CVE ID: CVE-2023-52765 State: PUBLISHED Published: 2024-05-21T15:30:49.690Z Last Updated: 2025-05-04T07:42:41.696Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mfd: qcom-spmi-pmic: Fix revid implementation The Qualcomm SPMI PMIC revid implementation is broken in multiple ways. First, it assumes that just because the sibling base device has been registered that means that it is also bound to a driver, which may not be the case (e.g. due to probe deferral or asynchronous probe). This could trigger a NULL-pointer dereference when attempting to access the driver data of the unbound device. Second, it accesses driver data of a sib
er dereference when attempting to access the driver data of the unbound device. Second, it accesses driver data of a sibling device directly and without any locking, which means that the driver data may be freed while it is being accessed (e.g. on driver unbind). Third, it leaks a struct device reference to the sibling device which is looked up using the spmi_device_from_of() every time a function (child) device is calling the revid function (e.g. on probe). Fix this mess by reimplementing the revid lookup so that it is done only at probe of the PMIC device; the base device fetches the revid info from the hardware, while any secondary SPMI device fetches the information from the base device