deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-44281
Published: 2024-10-28
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Parsing a file may lead to disclosure of user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44282
Published: 2024-10-28
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Parsing a file may lead to disclosure of user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-44284
Published: 2024-10-28
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Parsing a maliciously crafted file may lead to an unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44285
Published: 2024-10-28
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-44287
Published: 2024-10-28
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44289
Published: 2024-10-28
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to read sensitive location information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44294
Published: 2024-10-28
Description: A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker with root privileges may be able to delete protected system files.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44296
Published: 2024-10-28
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.1, iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
CVSS Score: 5.4 (MEDIUM)
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-44297
Published: 2024-10-28
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing a maliciously crafted message may lead to a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-44301
Published: 2024-10-28
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44302
Published: 2024-10-28
Description: The issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing a maliciously crafted font may result in the disclosure of process memory.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-48107
Published: 2024-10-28
Description: SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF). This vulnerability allows attacks to scan ports on the Intranet or local network where the server resides, attack applications running on the Intranet or local network, or read metadata on the cloud server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://gist.github.com/RMAX2000/ebb654016e5b8a5b55aa6d8a7f2f321a#file-cve-2024-48107; https://gitee.com/sparkshop/sparkshop
CVE: CVE-2024-48177
Published: 2024-10-28
Description: MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/dabaizhizhu/123/issues/9
CVE: CVE-2024-48356
Published: 2024-10-28
Description: LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Jingyi-u/LyLme_Spage/blob/main/README.md
CVE: CVE-2024-48594
Published: 2024-10-28
Description: File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the file upload component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/Aa1b/mycve/blob/main/Readme.md
CVE: CVE-2024-50495
Published: 2024-10-28
Description: Unrestricted Upload of File with Dangerous Type vulnerability in nunomorgadinho Plugin Propagator wp-propagator allows Upload a Web Shell to a Web Server.This issue affects Plugin Propagator: from n/a through <= 0.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wp-propagator/vulnerability/wordpress-plugin-propagator-plugin-0-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50496
Published: 2024-10-28
Description: Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 6.6.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/ar-for-wordpress/vulnerability/wordpress-ar-for-wordpress-plugin-6-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-30106
Published: 2024-10-28
Description: HCL Connections is vulnerable to an information disclosure vulnerability, due to an IBM WebSphere Application Server error, which could allow a user to obtain sensitive information they are not entitled to due to the improper handling of request data.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0116967
CVE: CVE-2024-44145
Published: 2024-10-28
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An attacker with physical access to a macOS device with Sidecar enabled may be able to bypass the Lock Screen.
CVSS Score: 6.1 (MEDIUM)
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121250
CVE: CVE-2024-44216
Published: 2024-10-28
Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44217
Published: 2024-10-28
Description: A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in iOS 18 and iPadOS 18. Password autofill may fill in passwords after failing authentication.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://support.apple.com/en-us/121250
CVE: CVE-2024-44237
Published: 2024-10-28
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Processing a maliciously crafted file may lead to unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-125
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44240
Published: 2024-10-28
Description: The issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing a maliciously crafted font may result in the disclosure of process memory.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-44256
Published: 2024-10-28
Description: The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to break out of its sandbox.
CVSS Score: 8.6 (HIGH)
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44257
Published: 2024-10-28
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44260
Published: 2024-10-28
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious app with root privileges may be able to modify the contents of system files.
CVSS Score: 4.4 (MEDIUM)
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44283
Published: 2024-10-28
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Parsing a maliciously crafted file may lead to an unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-44295
Published: 2024-10-28
Description: This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-51506
Published: 2024-10-28
Description: Tiki through 27.0 allows users who have certain permissions to insert a "Create a Wiki Pages" stored XSS payload in the description.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/r0ck3t1973/xss_payload/issues/8; https://security.tiki.org/Disclose-a-Vulnerability
CVE: CVE-2024-51507
Published: 2024-10-28
Description: Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Name.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/r0ck3t1973/xss_payload/issues/9; https://security.tiki.org/Disclose-a-Vulnerability
CVE: CVE-2024-51508
Published: 2024-10-28
Description: Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Index.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/r0ck3t1973/xss_payload/issues/9; https://security.tiki.org/Disclose-a-Vulnerability
CVE: CVE-2024-51509
Published: 2024-10-28
Description: Tiki through 27.0 allows users who have certain permissions to insert a "Modules" (aka tiki-admin_modules.php) stored XSS payload in the Name.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/r0ck3t1973/xss_payload/issues/10; https://security.tiki.org/Disclose-a-Vulnerability
CVE: CVE-2024-10477
Published: 2024-10-29
Description: A vulnerability classified as problematic was found in LinZhaoguan pb-cms up to 2.0.1. This vulnerability affects unknown code of the file /admin#permissions of the component Permission Management Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://gitee.com/LinZhaoguan/pb-cms/issues/IAYIB9; https://vuldb.com/?ctiid.282088; https://vuldb.com/?id.282088
CVE: CVE-2024-10478
Published: 2024-10-29
Description: A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms up to 2.0.1. This issue affects some unknown processing of the file /admin#article/edit?id=2 of the component Edit Article Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://gitee.com/LinZhaoguan/pb-cms/issues/IAYIAO; https://vuldb.com/?ctiid.282089; https://vuldb.com/?id.282089
CVE: CVE-2024-45656
Published: 2024-10-29
Description: IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.ibm.com/support/pages/node/7174183
CVE: CVE-2024-50068
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/damon/tests/sysfs-kunit.h: fix memory leak in damon_sysfs_test_add_targets()

The sysfs_target->regions allocated in damon_sysfs_regions_alloc() is not
freed in damon_sysfs_test_add_targets(), which cause the following memory
leak, free it to fix it.

	unreferenced object 0xffffff80c2a8db80 (size 96):
	  comm "kunit_try_catch", pid 187, jiffies[PII_REDACTED]
	  hex dump (first 32 bytes):
	    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
	    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
	  backtrace (crc 0):
	    [<[PII_REDACTED]e3714d>] kmemleak_alloc+0x34/0x40
	    [<000000008e6835c1>] __kmalloc_cache_noprof+0x26c/0x2f4
	    [<[PII_REDACTED]86d9f8>] damon_sysfs_test_add_targets+0x1cc/0x738
	    [<[PII_REDACTED]ef8f77>] kunit_try_run_case+0x13c/0x3ac
	    [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec
	    [<00000000adf936cf>] kthread+0x2e8/0x374
	    [<[PII_REDACTED]bb1628>] ret_from_fork+0x10/0x20
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/05d43455f6bffa6abc7b937ca58be00452e6973f; https://git.kernel.org/stable/c/2d6a1c835685de3b0c8e8dc871f60f4ef92ab01a
CVE: CVE-2024-50069
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

pinctrl: apple: check devm_kasprintf() returned value

devm_kasprintf() can return a NULL pointer on failure but this returned
value is not checked. Fix this lack and check the returned value.

Found by code review.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/0a4d4dbef622ac8796a6665e0080da2685f9220a; https://git.kernel.org/stable/c/4d2296fb7c80fdc9925d29a8e85d617cad08731a; https://git.kernel.org/stable/c/665a58fe663ac7a9ea618dc0b[PII_REDACTED]4b116
CVE: CVE-2024-50070
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

pinctrl: stm32: check devm_kasprintf() returned value

devm_kasprintf() can return a NULL pointer on failure but this returned
value is not checked. Fix this lack and check the returned value.

Found by code review.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1f266957ae1207b0717c2d69096bc70654ae9fcb; https://git.kernel.org/stable/c/3b36bb1fca2b87f6292ca2a8593f297c5e9fab41; https://git.kernel.org/stable/c/a8d52de0a6c6b091b2771bcb98ce408cf9d69fe3
CVE: CVE-2024-50071
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func()

'new_map' is allocated using devm_* which takes care of freeing the
allocated data on device removal, call to

	.dt_free_map = pinconf_generic_dt_free_map

double frees the map as pinconf_generic_dt_free_map() calls
pinctrl_utils_free_map().

Fix this by using kcalloc() instead of auto-managed devm_kcalloc().
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://git.kernel.org/stable/c/3fd976afe9743110f20a23f93b7ff9693f2be4bf; https://git.kernel.org/stable/c/6441d9c3d71b59c8fd27d4e381c7471a32ac1a68
CVE: CVE-2024-50072
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Use code segment selector for VERW operand

Robert Gill reported below #GP in 32-bit mode when dosemu software was
executing vm86() system call:

  general protection fault: 0000 [#1] PREEMPT SMP
  CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1
  Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010
  EIP: restore_all_switch_stack+0xbe/0xcf
  EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000
  ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc
  DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046
  CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0
  Call Trace:
   show_regs+0x70/0x78
   die_addr+0x29/0x70
   exc_general_protection+0x13c/0x348
   exc_bounds+0x98/0x98
   handle_exception+0x14d/0x14d
   exc_bounds+0x98/0x98
   restore_all_switch_stack+0xbe/0xcf
   exc_bounds+0x98/0x98
   restore_all_switch_stack+0xbe/0xcf

This only happens in 32-bit mode when VERW based mitigations like MDS/RFDS
are enabled. This is because segment registers with an arbitrary user value
can result in #GP when executing VERW. Intel SDM vol. 2C documents the
following behavior for VERW instruction:

  #GP(0) - If a memory operand effective address is outside the CS, DS, ES,
	   FS, or GS segment limit.

CLEAR_CPU_BUFFERS macro executes VERW instruction before returning to user
space. Use %cs selector to reference VERW operand. This ensures VERW will
not #GP for an arbitrary user %ds.

[ mingo: Fixed the SOB chain. ]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/38c5fe74f3bef98f75d16effa49836d50c9b6097; https://git.kernel.org/stable/c/481b477ab63c7245715a3e57ba79eb87c2dc0d02; https://git.kernel.org/stable/c/ada431c6c31a2c8c37991c46089af5caa23a9c6e
CVE: CVE-2024-50073
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

tty: n_gsm: Fix use-after-free in gsm_cleanup_mux

BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0
drivers/tty/n_gsm.c:3160 [n_gsm]
Read of size 8 at addr ffff88815fe99c00 by task poc/3379
CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56
Hardware name: VMware, Inc. VMware Virtual Platform/440BX
Desktop Reference Platform, BIOS 6.00 11/12/2020
Call Trace:
 <TASK>
 gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]
 __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm]
 __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389
 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500
 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846
 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161
 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]
 _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107
 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm]
 ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195
 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79
 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338
 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805
 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818

Allocated by task 65:
 gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm]
 gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm]
 gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm]
 gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm]
 tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391
 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39
 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445
 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229
 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391
 kthread+0x2a3/0x370 kernel/kthread.c:389
 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257

Freed by task 3367:
 kfree+0x126/0x420 mm/slub.c:4580
 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]
 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]
 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818

[Analysis]
gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux
can be freed by multi threads through ioctl,which leads
to the occurrence of uaf. Protect it by gsm tx lock.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/0eec592c6a7460ba795d7de29f3dc95cb5422e62; https://git.kernel.org/stable/c/9462f4ca56e7d2430fdb6dcc8498244acbfc4489; https://git.kernel.org/stable/c/bf171b5e86e41de4c1cf32fb7aefa275c3d7de49
CVE: CVE-2024-50074
Published: 2024-10-29
Description: In the Linux kernel, the following vulnerability has been resolved:

parport: Proper fix for array out-of-bounds access

The recent fix for array out-of-bounds accesses replaced sprintf()
calls blindly with snprintf().  However, since snprintf() returns the
would-be-printed size, not the actually output size, the length
calculation can still go over the given limit.

Use scnprintf() instead of snprintf(), which returns the actually
output letters, for addressing the potential out-of-bounds access
properly.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/02ac3a9ef3a18b58d8f3ea2b6e46de657bf6c4f9; https://git.kernel.org/stable/c/1826b6d69bbb7f9ae8711827facbb2ad7f8d0aaa; https://git.kernel.org/stable/c/2a8b26a09c8e3ea03da1ef3cd0ef6b96e559fba6