Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-52551 State: PUBLISHED Published: 2024-04-08T08:57:32.246Z Last Updated: 2024-11-01T18:41:43.394Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-120 Description: Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/3/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202403-0000001667644725
CVE ID: CVE-2023-52552 State: PUBLISHED Published: 2024-04-08T08:58:38.190Z Last Updated: 2024-08-20T20:00:53.549Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-20 Description: Input verification vulnerability in the power module. Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/3/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202403-0000001667644725
CVE ID: CVE-2023-52553 State: PUBLISHED Published: 2024-04-08T09:00:03.869Z Last Updated: 2024-11-05T16:04:10.630Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-362 Description: Race condition vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/3/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202403-0000001667644725
CVE ID: CVE-2023-52554 State: PUBLISHED Published: 2024-04-08T09:01:09.572Z Last Updated: 2024-11-05T20:04:07.961Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Permissions, Privileges, and Access Controls Description: Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/3/ - https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202403-0000001667644725
CVE ID: CVE-2023-52555 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-29T15:31:46.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mongo-express/mongo-express/issues/1338
CVE ID: CVE-2023-52556 State: PUBLISHED Published: 2024-03-01T16:08:49.203Z Last Updated: 2024-11-14T19:47:00.394Z Vendors: OpenBSD Products: OpenBSD Problem Types: CWE-367 Description: In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/009_pf.patch.sig - https://github.com/openbsd/src/commit/9d9f4dc6c833cb79d13f836581e3a781d06842e7
CVE ID: CVE-2023-52557 State: PUBLISHED Published: 2024-03-01T16:14:56.065Z Last Updated: 2024-08-02T23:03:20.647Z Vendors: OpenBSD Products: OpenBSD Problem Types: CWE-131 Description: In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/016_npppd.patch.sig - https://github.com/openbsd/src/commit/abf3a29384c582c807a621e7fc6e7c68d0cafe9b
CVE ID: CVE-2023-52558 State: PUBLISHED Published: 2024-03-01T16:33:06.604Z Last Updated: 2024-11-19T21:42:52.858Z Vendors: OpenBSD Products: OpenBSD Problem Types: CWE-131 Description: In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/002_msplit.patch.sig - https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/019_msplit.patch.sig - https://github.com/openbsd/src/commit/7b4d35e0a60ba1dd4daf4b1c29
g/pub/OpenBSD/patches/7.3/common/019_msplit.patch.sig - https://github.com/openbsd/src/commit/7b4d35e0a60ba1dd4daf4b1c2932020a22463a89
CVE ID: CVE-2023-52559 State: PUBLISHED Published: 2024-03-02T21:59:33.301Z Last Updated: 2025-05-04T07:38:45.332Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid memory allocation in iommu_suspend() The iommu_suspend() syscore suspend callback is invoked with IRQ disabled. Allocating memory with the GFP_KERNEL flag may re-enable IRQs during the suspend callback, which can cause intermittent suspend/hibernation problems with the following kernel traces: Calling iommu_suspend+0x0/0x1d0 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 15 at kernel/time/timekeeping.c:868 ktime_get+0x9b/0xb0 ... CPU: 0 PID
----[ cut here ]------------ WARNING: CPU: 0 PID: 15 at kernel/time/timekeeping.c:868 ktime_get+0x9b/0xb0 ... CPU: 0 PID: 15 Comm: rcu_preempt Tainted: G U E 6.3-intel #r1 RIP: 0010:ktime_get+0x9b/0xb0 ... Call Trace: <IRQ> tick_sched_timer+0x22/0x90 ? __pfx_tick_sched_timer+0x10/0x10 __hrtimer_run_queues+0x111/0x2b0 hrtimer_interrupt+0xfa/0x230 __sysvec_apic_timer_interrupt+0x63/0x140 sysvec_apic_timer_interrupt+0x7b/0xa0 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1f/0x30 ... ------------[ cut here ]------------ Interrupts enabled after iommu_suspend+0x0/0x1d0 WARNING: CPU: 0 PID: 27420 at drivers/base/syscore.c:68 syscore_suspend+0x147/0x270 CPU: 0 PID: 27420 Comm: rtcwake Tainted: G
: CPU: 0 PID: 27420 at drivers/base/syscore.c:68 syscore_suspend+0x147/0x270 CPU: 0 PID: 27420 Comm: rtcwake Tainted: G U W E 6.3-intel #r1 RIP: 0010:syscore_suspend+0x147/0x270 ... Call Trace: <TASK> hibernation_snapshot+0x25b/0x670 hibernate+0xcd/0x390 state_store+0xcf/0xe0 kobj_attr_store+0x13/0x30 sysfs_kf_write+0x3f/0x50 kernfs_fop_write_iter+0x128/0x200 vfs_write+0x1fd/0x3c0 ksys_write+0x6f/0xf0 __x64_sys_write+0x1d/0x30 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Given that only 4 words memory is needed, avoid the memory allocation in iommu_suspend(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/s
nd(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/29298c85a81abdc512e87537515ed4b1a9601d0e - https://git.kernel.org/stable/c/c12ef025add77ca3a0902e8719d552b6d47b4282 - https://git.kernel.org/stable/c/496c591f0b389eb782f36d9d4c2564b9a865eed0 - https://git.kernel.org/stable/c/59df44bfb0ca4c3ee1f1c3c5d0ee8e314844799e
CVE ID: CVE-2023-52560 State: PUBLISHED Published: 2024-03-02T21:59:34.084Z Last Updated: 2025-05-04T07:38:46.798Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() When CONFIG_DAMON_VADDR_KUNIT_TEST=y and making CONFIG_DEBUG_KMEMLEAK=y and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak is detected. Since commit 9f86d624292c ("mm/damon/vaddr-test: remove unnecessary variables"), the damon_destroy_ctx() is removed, but still call damon_new_target() and damon_new_region(), the damon_region which is allocated by kmem_cache_alloc() in damon_new_regio
damon_new_target() and damon_new_region(), the damon_region which is allocated by kmem_cache_alloc() in damon_new_region() and the damon_target which is allocated by kmalloc in damon_new_target() are not freed. And the damon_region which is allocated in damon_new_region() in damon_set_regions() is also not freed. So use damon_destroy_target to free all the damon_regions and damon_target. unreferenced object 0xffff888107c9a940 (size 64): comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk 60 c7 9c 07 81 88 ff ff f8 cb 9c 07 81 88 ff ff `............... backtrace: [<ffffffff817e0167>] k
b 6b ............kkkk 60 c7 9c 07 81 88 ff ff f8 cb 9c 07 81 88 ff ff `............... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff8881079cc740 (size 56): comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s) hex dump (first 32 bytes): 05 00 00 00 00 00 0
56): comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff888107c9ac40 (size 64): comm "kunit_try
/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff888107c9ac40 (size 64): comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk a0 cc 9c 07 81 88 ff ff 78 a1 76 07 81 88 ff ff ........x.v..... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097
ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff8881079ccc80 (size 56): comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260 [<ffffffff829fce6a>] ku
_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffff ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9a4fe81a8644b717d57d81ce5849e16583b13fe8 - https://git.kernel.org/stable/c/6b522001693aa113d97a985abc5f6932972e8e86 - https://git.kernel.org/stable/c/45120b15743fa7c0aa53d5db6dfb4c8f87be4abd
CVE ID: CVE-2023-52561 State: PUBLISHED Published: 2024-03-02T21:59:34.865Z Last Updated: 2025-09-19T15:21:31.084Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved Adding a reserved memory region for the framebuffer memory (the splash memory region set up by the bootloader). It fixes a kernel panic (arm-smmu: Unhandled context fault at this particular memory region) reported on DB845c running v5.10.y. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/dc1ab6577475b0460ba4261cd9caec37bd
Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/dc1ab6577475b0460ba4261cd9caec37bd62ca0b - https://git.kernel.org/stable/c/82dacd0ca0d9640723824026d6fdf773c02de1d2 - https://git.kernel.org/stable/c/110e70fccce4f22b53986ae797d665ffb1950aa6
CVE ID: CVE-2023-52562 State: PUBLISHED Published: 2024-03-02T21:59:35.568Z Last Updated: 2025-05-04T12:49:13.970Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() After the commit in Fixes:, if a module that created a slab cache does not release all of its allocated objects before destroying the cache (at rmmod time), we might end up releasing the kmem_cache object without removing it from the slab_caches list thus corrupting the list as kmem_cache_destroy() ignores the return value from shutdown_cache(), which in turn never removes the kmem_cache object
kmem_cache_destroy() ignores the return value from shutdown_cache(), which in turn never removes the kmem_cache object from slabs_list in case __kmem_cache_shutdown() fails to release all of the cache's slabs. This is easily observable on a kernel built with CONFIG_DEBUG_LIST=y as after that ill release the system will immediately trip on list_add, or list_del, assertions similar to the one shown below as soon as another kmem_cache gets created, or destroyed: [ 1041.213632] list_del corruption. next->prev should be ffff89f596fb5768, but was 52f1e5016aeee75d. (next=ffff89f595a1b268) [ 1041.219165] ------------[ cut here ]------------ [ 1041.221517] kernel BUG at lib/list_debug.c:62! [ 1041.2
95a1b268) [ 1041.219165] ------------[ cut here ]------------ [ 1041.221517] kernel BUG at lib/list_debug.c:62! [ 1041.223452] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 1041.225408] CPU: 2 PID: 1852 Comm: rmmod Kdump: loaded Tainted: G B W OE 6.5.0 #15 [ 1041.228244] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc37 05/24/2023 [ 1041.231212] RIP: 0010:__list_del_entry_valid+0xae/0xb0 Another quick way to trigger this issue, in a kernel with CONFIG_SLUB=y, is to set slub_debug to poison the released objects and then just run cat /proc/slabinfo after removing the module that leaks slab objects, in which case the kernel will panic: [ 50.954843] general protection f
fter removing the module that leaks slab objects, in which case the kernel will panic: [ 50.954843] general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 [#1] PREEMPT SMP PTI [ 50.961545] CPU: 2 PID: 1495 Comm: cat Kdump: loaded Tainted: G B W OE 6.5.0 #15 [ 50.966808] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc37 05/24/2023 [ 50.972663] RIP: 0010:get_slabinfo+0x42/0xf0 This patch fixes this issue by properly checking shutdown_cache()'s return value before taking the kmem_cache_release() branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a5569bb187521
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a5569bb187521432f509b69dda7d29f78b2d38b0 - https://git.kernel.org/stable/c/51988be187b041e5355245957b0b9751fa382e0d - https://git.kernel.org/stable/c/46a9ea6681907a3be6b6b0d43776dccc62cad6cf
CVE ID: CVE-2023-52563 State: PUBLISHED Published: 2024-03-02T21:59:36.220Z Last Updated: 2025-05-04T07:38:50.545Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/meson: fix memory leak on ->hpd_notify callback The EDID returned by drm_bridge_get_edid() needs to be freed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/66cb6d74f5a1b6eafe3370b56bf2cb575a91acbc - https://git.kernel.org/stable/c/ee335e0094add7fc2c7034e0534e1920d61d2078 - https://git.kernel.org/stable/c/43b63e088887a8b82750e16762f77100ffa76cba - https://git.kernel.org/stable/c/099f0af9d982
https://git.kernel.org/stable/c/43b63e088887a8b82750e16762f77100ffa76cba - https://git.kernel.org/stable/c/099f0af9d98231bb74956ce92508e87cbcb896be
CVE ID: CVE-2023-52564 State: PUBLISHED Published: 2024-03-02T21:59:36.867Z Last Updated: 2025-05-04T12:49:15.207Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239. The commit above is reverted as it did not solve the original issue. gsm_cleanup_mux() tries to free up the virtual ttys by calling gsm_dlci_release() for each available DLCI. There, dlci_put() is called to decrease the reference counter for the DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked i
he DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() as done in the reverted commit. The commit introduces a null pointer dereference: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x156/0x420 ? search_exception_tables+0x37/0x50 ? fixup_exception+0x21/0x310 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? tty_port_put+0x19/0xa0 gsmtty_cleanup+0x29/0x80 [n_gsm] release_one_tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ?
tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> The actual issue is that nothing guards dlci_put() from being called multiple times while the tty driver was triggered but did not yet finished calling gsm_dlci_free(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6d5c8862932d31a810b6545f7d69ecc124402c6e - https://git.kernel.org/stable/c/a48d2bcd23f2c98d575bc2f9b7a3fbd16aeea9eb - https://git.kernel.org/stable/c/c61d0b87a7028c2c10faffc524d7
nel.org/stable/c/a48d2bcd23f2c98d575bc2f9b7a3fbd16aeea9eb - https://git.kernel.org/stable/c/c61d0b87a7028c2c10faffc524d748334c7b9827 - https://git.kernel.org/stable/c/2bff660e0ff349dee84dc4f6f6d10da4497f5b28 - https://git.kernel.org/stable/c/29346e217b8ab8a52889b88f00b268278d6b7668
CVE ID: CVE-2023-52565 State: PUBLISHED Published: 2024-03-02T21:59:37.505Z Last Updated: 2025-05-04T12:49:16.299Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix OOB read If the index provided by the user is bigger than the mask size, we might do an out of bound read. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/09635bf4cdd4adf2160198a6041bcc7ca46c0558 - https://git.kernel.org/stable/c/8bcf70d787f7d53a3b85ad394f926cfef3eed023 - https://git.kernel.org/stable/c/41ebaa5e0eebea4c3bac96b72f9f8ae0d77c0bdb
CVE ID: CVE-2023-52566 State: PUBLISHED Published: 2024-03-02T21:59:38.167Z Last Updated: 2025-05-04T07:38:53.975Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page
t, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke@gmail.com: NOTE added to the commit log] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fb1084e63ee56958b0a56e17a50a4fd86445b9
nrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fb1084e63ee56958b0a56e17a50a4fd86445b9c1 - https://git.kernel.org/stable/c/bb61224f6abc8e71bfdf06d7c984e23460875f5b - https://git.kernel.org/stable/c/193b5a1c6c67c36b430989dc063fe7ea4e200a33 - https://git.kernel.org/stable/c/7130a87ca32396eb9bf48b71a2d42259ae44c6c7 - https://git.kernel.org/stable/c/3936e8714907cd55e37c7cc50e50229e4a9042e8 - https://git.kernel.org/stable/c/980663f1d189eedafd18d80053d9cf3e2ceb5c8c - https://git.kernel.org/stable/c/28df4646ad8b433340772edc90ca709cdefc53e2 - https://git.kernel.org/stable/c/7ee29facd8a9c5a26079148e36bcf07141b3a6bc
CVE ID: CVE-2023-52567 State: PUBLISHED Published: 2024-03-02T21:59:38.815Z Last Updated: 2025-05-04T12:49:17.520Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: Check IRQ data before use In case the leaf driver wants to use IRQ polling (irq = 0) and IIR register shows that an interrupt happened in the 8250 hardware the IRQ data can be NULL. In such a case we need to skip the wake event as we came to this path from the timer interrupt and quite likely system is already awake. Without this fix we have got an Oops: serial8250: ttyS0 at I/O 0x3f8 (irq = 0, base_baud = 115200) is a 16550A ... BUG: kernel NULL poi
x we have got an Oops: serial8250: ttyS0 at I/O 0x3f8 (irq = 0, base_baud = 115200) is a 16550A ... BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:serial8250_handle_irq+0x7c/0x240 Call Trace: ? serial8250_handle_irq+0x7c/0x240 ? __pfx_serial8250_timeout+0x10/0x10 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ee5732caaffba3a37e753fdb89b4958db9a61847 - https://git.kernel.org/stable/c/c334650150c29234b0923476f51573ae1b2f252a - https://git.kernel.org/stable/c/bf3c728e3692cc6d998874f0f27d433117348742 - https://git.kernel.org/stable/c/e14afa4450cb7e4cf93e993a765801203d41d014 - https://git.kernel.
98874f0f27d433117348742 - https://git.kernel.org/stable/c/e14afa4450cb7e4cf93e993a765801203d41d014 - https://git.kernel.org/stable/c/2b837f13a818f96304736453ac53b66a70aaa4f2 - https://git.kernel.org/stable/c/e14f68a48fd445a083ac0750fafcb064df5f18f7 - https://git.kernel.org/stable/c/3345cc5f02f1fb4c4dcb114706f2210d879ab933 - https://git.kernel.org/stable/c/cce7fc8b29961b64fadb1ce398dc5ff32a79643b