Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-27045 State: PUBLISHED Published: 2024-05-01T12:54:18.138Z Last Updated: 2025-05-04T09:03:01.141Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' Tell snprintf() to store at most 10 bytes in the output buffer instead of 30. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1508 dp_dsc_clock_en_read() error: snprintf() is printing too much 30 vs 10 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ff28893c96c5e0927a4da10cd24a3522ca6
am Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ff28893c96c5e0927a4da10cd24a3522ca663515 - https://git.kernel.org/stable/c/440f059837418fac1695b65d3ebc6080d33be877 - https://git.kernel.org/stable/c/d346b3e5b25c95d504478507eb867cd3818775ab - https://git.kernel.org/stable/c/ad76fd30557d6a106c481e4606a981221ca525f7 - https://git.kernel.org/stable/c/eb9327af3621d26b1d83f767c97a3fe8191a3a65 - https://git.kernel.org/stable/c/cf114d8d4a8d78df272116a745bb43b48cef65f4 - https://git.kernel.org/stable/c/4b09715f1504f1b6e8dff0e9643630610bc05141
CVE ID: CVE-2024-27046 State: PUBLISHED Published: 2024-05-01T12:54:21.725Z Last Updated: 2025-05-04T09:03:02.921Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handle acti_netdevs allocation failure The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_netdevs, the null pointer dereference bugs will happen. This patch adds a check to judge whether allocation failure occurs. If it happens, the delayed work will be rescheduled and try again. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - ht
rescheduled and try again. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d746889db75a76aeee95fb705b8e1ac28c684a2e - https://git.kernel.org/stable/c/3b1e8a617eb0f4cdc19def530047a95b5abde07d - https://git.kernel.org/stable/c/928705e341010dd910fdece61ccb974f494a758f - https://git.kernel.org/stable/c/0d387dc503f9a53e6d1f6e9dd0292d38f083eba5 - https://git.kernel.org/stable/c/c9b4e220dd18f79507803f38a55d53b483f6c9c3 - https://git.kernel.org/stable/c/408ba7fd04f959c61b50db79c983484312fea642 - https://git.kernel.org/stable/c/c8df9203bf22c66fa26e8d8c7f8ce181cf88099d - https://git.kernel.org/stable/c/9d8eb1238377cd994829f9162
kernel.org/stable/c/c8df9203bf22c66fa26e8d8c7f8ce181cf88099d - https://git.kernel.org/stable/c/9d8eb1238377cd994829f9162ae396a84ae037b2 - https://git.kernel.org/stable/c/84e95149bd341705f0eca6a7fcb955c548805002
CVE ID: CVE-2024-27047 State: PUBLISHED Published: 2024-05-01T12:54:25.156Z Last Updated: 2025-05-04T09:03:04.406Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: phy: fix phy_get_internal_delay accessing an empty array The phy_get_internal_delay function could try to access to an empty array in the case that the driver is calling phy_get_internal_delay without defining delay_values and rx-internal-delay-ps or tx-internal-delay-ps is defined to 0 in the device-tree. This will lead to "unable to handle kernel NULL pointer dereference at virtual address 0". To avoid this kernel oops, the test should be delay >= 0. As there is
el NULL pointer dereference at virtual address 0". To avoid this kernel oops, the test should be delay >= 0. As there is already delay < 0 test just before, the test could only be size == 0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/06dd21045a7e8bc8701b0ebedcd9a30a6325878b - https://git.kernel.org/stable/c/0e939a002c8a7d66e60bd0ea6b281fb39d713c1a - https://git.kernel.org/stable/c/2a2ff709511617de9c6c072eeee82bcbbdfecaf8 - https://git.kernel.org/stable/c/589ec16174dd9378953b8232ae76fad0a96e1563 - https://git.kernel.org/stable/c/c0691de7df1d51482a52cac93b7fe82fd9dd296b - https://git.kernel.org/stable/c/0307cf443308
https://git.kernel.org/stable/c/c0691de7df1d51482a52cac93b7fe82fd9dd296b - https://git.kernel.org/stable/c/0307cf443308ecc6be9b2ca312bb31bae5e5a7ad - https://git.kernel.org/stable/c/4469c0c5b14a0919f5965c7ceac96b523eb57b79
CVE ID: CVE-2024-27048 State: PUBLISHED Published: 2024-05-01T12:54:28.644Z Last Updated: 2025-05-04T09:03:05.639Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmk_op allocation failure The kzalloc() in brcmf_pmksa_v3_op() will return null if the physical memory has run out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Return -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails for pmk_op. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/df62e22c2e27420e8990a4f09e30d7bf56c2036f - http
: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/df62e22c2e27420e8990a4f09e30d7bf56c2036f - https://git.kernel.org/stable/c/9975908315c13bae2f2ed5ba92870fa935180b0e - https://git.kernel.org/stable/c/6138a82f3bccfc67ed7ac059493579fc326c02e5 - https://git.kernel.org/stable/c/b4152222e04cb8afeeca239c90e3fcaf4c553b42
CVE ID: CVE-2024-27049 State: PUBLISHED Published: 2024-05-01T12:54:32.122Z Last Updated: 2025-05-04T09:03:06.880Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925e: fix use-after-free in free_irq() From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For this case, let's apply MT76_REMOVED flag to indicate the device was removed and do not run into the resource access anymore. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/s
more. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/84470b48af03a818039d587478b415cbcb264ff5 - https://git.kernel.org/stable/c/6d9930096e1f13cf6d9aabfbf95d0e05fb04144f - https://git.kernel.org/stable/c/a5a5f4413d91f395cb2d89829d376d7393ad48b9
CVE ID: CVE-2024-27050 State: PUBLISHED Published: 2024-05-01T12:54:35.555Z Last Updated: 2025-05-04T09:03:08.161Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: libbpf: Use OPTS_SET() macro in bpf_xdp_query() When the feature_flags and xdp_zc_max_segs fields were added to the libbpf bpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro. This causes libbpf to write to those fields unconditionally, which means that programs compiled against an older version of libbpf (with a smaller size of the bpf_xdp_query_opts struct) will have its stack corrupted by libbpf writing out of bounds. The patch adding the feat
the bpf_xdp_query_opts struct) will have its stack corrupted by libbpf writing out of bounds. The patch adding the feature_flags field has an early bail out if the feature_flags field is not part of the opts struct (via the OPTS_HAS) macro, but the patch adding xdp_zc_max_segs does not. For consistency, this fix just changes the assignments to both fields to use the OPTS_SET() macro. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c - https://git.kernel.org/stable/c/682ddd62abd4bdcee7584246903e7a2df005fe0d - https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e
le/c/682ddd62abd4bdcee7584246903e7a2df005fe0d - https://git.kernel.org/stable/c/cd3be9843247edb8fc6fcd8d8237cbce2bc19f5e - https://git.kernel.org/stable/c/92a871ab9fa59a74d013bc04f321026a057618e7
CVE ID: CVE-2024-27051 State: PUBLISHED Published: 2024-05-01T12:54:39.024Z Last Updated: 2025-05-04T09:03:09.536Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it and return 0 in case of error. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9127599c075caff234359950117018a010dd01db - https://git.kernel.org/stable/c/d951cf510fb0df91d3abac0121a59ebbc63c
stable/c/9127599c075caff234359950117018a010dd01db - https://git.kernel.org/stable/c/d951cf510fb0df91d3abac0121a59ebbc63c0567 - https://git.kernel.org/stable/c/e72160cb6e23b78b41999d6885a34ce8db536095 - https://git.kernel.org/stable/c/b25b64a241d769e932a022e5c780cf135ef56035 - https://git.kernel.org/stable/c/74b84d0d71180330efe67c82f973a87f828323e5 - https://git.kernel.org/stable/c/e6e3e51ffba0784782b1a076d7441605697ea3c6 - https://git.kernel.org/stable/c/f661017e6d326ee187db24194cabb013d81bc2a6
CVE ID: CVE-2024-27052 State: PUBLISHED Published: 2024-05-01T12:54:42.547Z Last Updated: 2025-05-04T09:03:10.748Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/dddedfa3b29a63c2ca4336663806a6128b8545b4 - https://git.kernel.org/stable/c/ac512507ac89c01ed6cd4ca53032f52cdb23ea59 - https://git.kernel.org/stable/c/3518cea83
4 - https://git.kernel.org/stable/c/ac512507ac89c01ed6cd4ca53032f52cdb23ea59 - https://git.kernel.org/stable/c/3518cea837de4d106efa84ddac18a07b6de1384e - https://git.kernel.org/stable/c/156012667b85ca7305cb363790d3ae8519a6f41e - https://git.kernel.org/stable/c/7059cdb69f8e1a2707dd1e2f363348b507ed7707 - https://git.kernel.org/stable/c/58fe3bbddfec10c6b216096d8c0e517cd8463e3a - https://git.kernel.org/stable/c/1213acb478a7181cd73eeaf00db430f1e45b1361
CVE ID: CVE-2024-27053 State: PUBLISHED Published: 2024-05-01T12:54:45.964Z Last Updated: 2025-05-04T09:03:12.080Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ #333 Not tainted ----------------------------- drivers/net/wireless/microchip/wilc1000/hif.c:386 suspicious rcu_dereference_check() usage! [...] stack backtrace: CPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333 Hardware name: Atme
() usage! [...] stack backtrace: CPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333 Hardware name: Atmel SAMA5 unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x48 dump_stack_lvl from wilc_parse_join_bss_param+0x7dc/0x7f4 wilc_parse_join_bss_param from connect+0x2c4/0x648 connect from cfg80211_connect+0x30c/0xb74 cfg80211_connect from nl80211_connect+0x860/0xa94 nl80211_connect from genl_rcv_msg+0x3fc/0x59c genl_rcv_msg from netlink_rcv_skb+0xd0/0x1f8 netlink_rcv_skb from genl_rcv+0x2c/0x3c genl_rcv from netlink_unicast+0x3b0/0x550 netlink_unicast from netlink_sendmsg+0x368/0x688 netlink_sendmsg from ____sys_sendmsg+0x190/0x430 ____sys_sendmsg
0x550 netlink_unicast from netlink_sendmsg+0x368/0x688 netlink_sendmsg from ____sys_sendmsg+0x190/0x430 ____sys_sendmsg from ___sys_sendmsg+0x110/0x158 ___sys_sendmsg from sys_sendmsg+0xe8/0x150 sys_sendmsg from ret_fast_syscall+0x0/0x1c This warning is emitted because in the connect path, when trying to parse target BSS parameters, we dereference a RCU pointer whithout being in RCU critical section. Fix RCU dereference usage by moving it to a RCU read critical section. To avoid wrapping the whole wilc_parse_join_bss_param under the critical section, just use the critical section to copy ies data Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:
ection to copy ies data Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e556006de4ea93abe2b46cba202a2556c544b8b2 - https://git.kernel.org/stable/c/b4bbf38c350acb6500cbe667b1e2e68f896e4b38 - https://git.kernel.org/stable/c/d80fc436751cfa6b02a8eda74eb6cce7dadfe5a2 - https://git.kernel.org/stable/c/745003b5917b610352f52fe0d11ef658d6471ec2 - https://git.kernel.org/stable/c/4bfd20d5f5c62b5495d6c0016ee6933bd3add7ce - https://git.kernel.org/stable/c/5800ec78775c0cd646f71eb9bf8402fb794807de - https://git.kernel.org/stable/c/dd50d3ead6e3707bb0a5df7cc832730c93ace3a7 - https://git.kernel.org/stable/c/205c50306acf58a335eb19fa84e40
el.org/stable/c/dd50d3ead6e3707bb0a5df7cc832730c93ace3a7 - https://git.kernel.org/stable/c/205c50306acf58a335eb19fa84e40140f4fe814f
CVE ID: CVE-2024-27054 State: PUBLISHED Published: 2024-05-01T12:54:49.441Z Last Updated: 2025-05-04T09:03:13.672Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix double module refcount decrement Once the discipline is associated with the device, deleting the device takes care of decrementing the module's refcount. Doing it manually on this error path causes refcount to artificially decrease on each error while it should just stay the same. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9fe0562179d8fa960afca0eaed6d4ba4122a3cc6 - https://git
Program Container: References: - https://git.kernel.org/stable/c/9fe0562179d8fa960afca0eaed6d4ba4122a3cc6 - https://git.kernel.org/stable/c/edbdb0d94143db46edd373cc93e433832d29fe19 - https://git.kernel.org/stable/c/ad999aa18103fa038787b6a8a55020abcf34df1a - https://git.kernel.org/stable/c/ec09bcab32fc4765e0cc97e1b72cdd067135f37e - https://git.kernel.org/stable/c/fa18aa507ea71d8914b6acb2c94db311c757c650 - https://git.kernel.org/stable/c/ebc5a3bd79e54f98c885c26f0862a27a02c487c5 - https://git.kernel.org/stable/c/c3116e62ddeff79cae342147753ce596f01fcf06
CVE ID: CVE-2024-27055 State: REJECTED Published: 2024-05-01T12:54:52.938Z Last Updated: 2025-03-10T07:42:46.766Z Description: No description available.
CVE ID: CVE-2024-27056 State: PUBLISHED Published: 2024-05-01T12:54:56.461Z Last Updated: 2025-11-03T19:29:41.505Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: ensure offloading TID queue exists The resume code path assumes that the TX queue for the offloading TID has been configured. At resume time it then tries to sync the write pointer as it may have been updated by the firmware. In the unusual event that no packets have been send on TID 0, the queue will not have been allocated and this causes a crash. Fix this by ensuring the queue exist at suspend time. Additional Analyst Notes: - CISA ADP Vulnrichme
is causes a crash. Fix this by ensuring the queue exist at suspend time. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4903303f25f48b5a1e34e6324c7fae9ccd6b959a - https://git.kernel.org/stable/c/35afffaddbe8d310dc61659da0b1a337b0d0addc - https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5 - https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f
CVE ID: CVE-2024-27057 State: PUBLISHED Published: 2024-05-01T12:54:59.859Z Last Updated: 2025-05-04T09:03:16.523Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend When the system is suspended while audio is active, the sof_ipc4_pcm_hw_free() is invoked to reset the pipelines since during suspend the DSP is turned off, streams will be re-started after resume. If the firmware crashes during while audio is running (or when we reset the stream before suspend) then the sof_ipc4_set_multi_pipeline_state() will fail with IPC error and the state change is interrupted
efore suspend) then the sof_ipc4_set_multi_pipeline_state() will fail with IPC error and the state change is interrupted. This will cause misalignment between the kernel and firmware state on next DSP boot resulting errors returned by firmware for IPC messages, eventually failing the audio resume. On stream close the errors are ignored so the kernel state will be corrected on the next DSP boot, so the second boot after the DSP panic. If sof_ipc4_trigger_pipelines() is called from sof_ipc4_pcm_hw_free() then state parameter is SOF_IPC4_PIPE_RESET and only in this case. Treat a forced pipeline reset similarly to how we treat a pcm_free by ignoring error on state sending to allow the kernel's s
a forced pipeline reset similarly to how we treat a pcm_free by ignoring error on state sending to allow the kernel's state to be consistent with the state the firmware will have after the next boot. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3cac6eebea9b4bc5f041e157e45c76e212ad6759 - https://git.kernel.org/stable/c/d153e8b154f9746ac969c85a4e6474760453647c - https://git.kernel.org/stable/c/c40aad7c81e5fba34b70123ed7ce3397fa62a4d2
CVE ID: CVE-2024-27058 State: PUBLISHED Published: 2024-05-01T13:00:06.852Z Last Updated: 2025-05-04T09:03:17.639Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tmpfs: fix race on handling dquot rbtree A syzkaller reproducer found a race while attempting to remove dquot information from the rb tree. Fetching the rb_tree root node must also be protected by the dqopt->dqio_sem, otherwise, giving the right timing, shmem_release_dquot() will trigger a warning because it couldn't find a node in the tree, when the real reason was the root node changing before the search starts: Thread 1 Thread 2 - shmem_release_dquot() - shmem_{acqu
real reason was the root node changing before the search starts: Thread 1 Thread 2 - shmem_release_dquot() - shmem_{acquire,release}_dquot() - fetch ROOT - Fetch ROOT - acquire dqio_sem - wait dqio_sem - do something, triger a tree rebalance - release dqio_sem - acquire dqio_sem - start searching for the node, but from the wrong location, missing the node, and triggering a warning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c7077f43f30d817d10a9f8245e51576ac114b2f0 - https://git.kernel.org/stable/c/617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb - https://git.kernel.org/stable/c/f82f184874d2761ebaa60dccf577921a0dbb3810 -
c/617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb - https://git.kernel.org/stable/c/f82f184874d2761ebaa60dccf577921a0dbb3810 - https://git.kernel.org/stable/c/0a69b6b3a026543bc215ccc866d0aea5579e6ce2
CVE ID: CVE-2024-27059 State: PUBLISHED Published: 2024-05-01T13:00:10.571Z Last Updated: 2025-05-04T09:03:19.394Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as rep
lues is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer. Protect against this possibility by refusing to bind to the device if either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID information is 0. This requires isd200_Initialization() to return a negative error code when initialization fails; currently it always returns 0 (even when there is an error). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9968c701cba7eda42e5f0052b040349d6222ae34 - https://git.kernel.org/stable/c/eb7b01ca778170654e1c76950024270ba74b121f -
/c/9968c701cba7eda42e5f0052b040349d6222ae34 - https://git.kernel.org/stable/c/eb7b01ca778170654e1c76950024270ba74b121f - https://git.kernel.org/stable/c/284fb1003d5da111019b9e0bf99b084fd71ac133 - https://git.kernel.org/stable/c/6c1f36d92c0a8799569055012665d2bb066fb964 - https://git.kernel.org/stable/c/f42ba916689f5c7b1642092266d2f53cf527aaaa - https://git.kernel.org/stable/c/871fd7b10b56d280990b7e754f43d888382ca325 - https://git.kernel.org/stable/c/3a67d4ab9e730361d183086dfb0ddd8c61f01636 - https://git.kernel.org/stable/c/014bcf41d946b36a8f0b8e9b5d9529efbb822f49
CVE ID: CVE-2024-27060 State: PUBLISHED Published: 2024-05-01T13:00:13.995Z Last Updated: 2025-05-04T09:03:20.748Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() Olliver reported that his system crashes when plugging in Thunderbolt 1 device: BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:tb_port_do_update_credits+0x1b/0x130 [thunderbolt] Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0
10:tb_port_do_update_credits+0x1b/0x130 [thunderbolt] Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? tb_port_do_update_credits+0x1b/0x130 ? tb_switch_update_link_attributes+0x83/0xd0 tb_switch_add+0x7a2/0xfe0 tb_scan_port+0x236/0x6f0 tb_handle_hotplug+0x6db/0x900 process_one_work+0x171/0x340 worker_thread+0x27b/0x3a0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> This is due the fact that some Thunderbolt 1 devices only have one lane adapter. Fix this by checking for the lane 1 before we read its c
act that some Thunderbolt 1 devices only have one lane adapter. Fix this by checking for the lane 1 before we read its credits. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/440fba897c5ae32d7df1f1d609dbb19e2bba7fbb - https://git.kernel.org/stable/c/ce64ba1f6ec3439e4b4d880b4db99673f4507228 - https://git.kernel.org/stable/c/d3d17e23d1a0d1f959b4fa55b35f1802d9c584fa
CVE ID: CVE-2024-27061 State: PUBLISHED Published: 2024-05-01T13:00:17.611Z Last Updated: 2025-05-04T09:03:22.259Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Fix use after free in unprepare sun8i_ce_cipher_unprepare should be called before crypto_finalize_skcipher_request, because client callbacks may immediately free memory, that isn't needed anymore. But it will be used by unprepare after free. Before removing prepare/unprepare callbacks it was handled by crypto engine in crypto_finalize_request. Usually that results in a pointer dereference problem during a in crypto selftest. Unable to handle kernel N