deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5613
Published: 2024-06-08
Description: The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'quality_customizer_notify_dismiss_action' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://themes.trac.wordpress.org/browser/formula/0.5.1/inc/customizer/customizer-notice/formula-customizer-notify.php?rev=229770#L143; https://themes.trac.wordpress.org/changeset/230569/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bf391432-d569-4458-947f-fe4a2ebcf8f1?source=cve
CVE: CVE-2024-5638
Published: 2024-06-08
Description: The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ti_customizer_notify_dismiss_recommended_plugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://themes.trac.wordpress.org/browser/formula/0.5.1/inc/customizer/customizer-notice/formula-customizer-notify.php?rev=229770#L184; https://themes.trac.wordpress.org/changeset/230569/; https://www.wordfence.com/threat-intel/vulnerabilities/id/193eeb92-f0af-4c6a-ac44-3166023a3006?source=cve
CVE: CVE-2024-5091
Published: 2024-06-08
Description: The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Age Gate and Creative Slider widgets in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79, CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3098599/skt-addons-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8d63ee-4929-4940-bc6a-931524e20272?source=cve; https://plugins.trac.wordpress.org/changeset/3098599/skt-addons-for-elementor
CVE: CVE-2024-5758
Published: 2024-06-08
Description: Rejected reason: ** REJECT ** Duplicate of CVE-2024-4305. Please use CVE-2024-4305 instead.
CVE: CVE-2024-4468
Published: 2024-06-08
Description: The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with subscriber access or higher to modify plugin settings and view discount codes intended for other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-280, CWE-862
References: https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLB_Discount/Admin/ExportDiscountsCsv.php#L10; https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLB_Discount/Admin/ExportDiscountsCsv.php#L16; https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLB_Discount/Admin/ExportDiscountsCsv.php#L7
CVE: CVE-2024-5654
Published: 2024-06-08
Description: The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site configuration settings, including WP_DEBUG, WP_DEBUG_LOG, SCRIPT_DEBUG, and SAVEQUERIES.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/cf7-google-sheets-connector/trunk/includes/class-gs-service.php#L52; https://plugins.trac.wordpress.org/changeset/3099184/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c0da4d55-5025-47cf-9f45-377d8943fc94?source=cve
CVE: CVE-2024-35753
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TemplatesNext TemplatesNext OnePager allows Stored XSS.This issue affects TemplatesNext OnePager: from n/a through 1.3.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/templatesnext-onepager/wordpress-templatesnext-onepager-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/templatesnext-onepager/wordpress-templatesnext-onepager-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35755
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in El tiempo Weather Widget Pro allows Stored XSS.This issue affects Weather Widget Pro: from n/a through 1.1.40.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/weather-in-any-city-widget/wordpress-weather-widget-pro-plugin-1-1-40-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/weather-in-any-city-widget/wordpress-weather-widget-pro-plugin-1-1-40-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35756
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CeiKay Tooltip CK tooltip-ck allows Stored XSS.This issue affects Tooltip CK: from n/a through 2.2.15.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/tooltip-ck/wordpress-tooltip-ck-plugin-2-2-15-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tooltip-ck/wordpress-tooltip-ck-plugin-2-2-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-5766
Published: 2024-06-08
Description: A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin of the component Merchandise Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-267449 was assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://gitee.com/likeshop_gitee/likeshop/issues/I9TAHP; https://vuldb.com/?ctiid.267449; https://vuldb.com/?id.267449
CVE: CVE-2024-35730
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in realmag777 Active Products Tables for WooCommerce allows Reflected XSS.This issue affects Active Products Tables for WooCommerce: from n/a through 1.0.6.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/profit-products-tables-for-woocommerce/wordpress-active-products-tables-for-woocommerce-plugin-1-0-6-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profit-products-tables-for-woocommerce/wordpress-active-products-tables-for-woocommerce-plugin-1-0-6-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35731
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Moose Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor allows Stored XSS.This issue affects Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor: from n/a through 1.3.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/kenta-blocks/wordpress-kenta-gutenberg-blocks-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/kenta-blocks/wordpress-kenta-gutenberg-blocks-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35732
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH Custom Login yith-custom-login.This issue affects YITH Custom Login: from n/a through <= 1.7.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/yith-custom-login/vulnerability/wordpress-yith-custom-login-plugin-1-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yith-custom-login/wordpress-yith-custom-login-plugin-1-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35733
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RLDD Auto Coupons for WooCommerce allows Reflected XSS.This issue affects Auto Coupons for WooCommerce: from n/a through 3.0.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-auto-coupons/wordpress-auto-coupons-for-woocommerce-plugin-3-0-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-auto-coupons/wordpress-auto-coupons-for-woocommerce-plugin-3-0-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35734
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodePeople WP Time Slots Booking Form allows Stored XSS.This issue affects WP Time Slots Booking Form: from n/a through 1.2.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-2-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-2-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35736
Published: 2024-06-08
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer.This issue affects Visualizer: from n/a through 3.11.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/visualizer/wordpress-visualizer-plugin-3-11-1-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/visualizer/wordpress-visualizer-plugin-3-11-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-35737
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.This issue affects WP Visitors Tracker: from n/a through 2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp_visitorstracker/wordpress-wp-visitors-tracker-plugin-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp_visitorstracker/wordpress-wp-visitors-tracker-plugin-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35738
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kognetiks Kognetiks Chatbot for WordPress allows Stored XSS.This issue affects Kognetiks Chatbot for WordPress: from n/a through 1.9.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/chatbot-chatgpt/wordpress-kognetiks-chatbot-for-wordpress-plugin-1-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chatbot-chatgpt/wordpress-kognetiks-chatbot-for-wordpress-plugin-1-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35739
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/the-post-grid/vulnerability/wordpress-the-post-grid-plugin-7-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/the-post-grid/wordpress-the-post-grid-plugin-7-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35740
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Pixgraphy allows Stored XSS.This issue affects Pixgraphy: from n/a through 1.3.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pixgraphy/wordpress-pixgraphy-theme-1-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pixgraphy/wordpress-pixgraphy-theme-1-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35750
Published: 2024-06-08
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/gallery-album/wordpress-gallery-image-and-video-gallery-with-thumbnails-plugin-2-0-3-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gallery-album/wordpress-gallery-image-and-video-gallery-with-thumbnails-plugin-2-0-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-35751
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Creative Motion, Will Bontrager Software, LLC Woody ad snippets allows Stored XSS.This issue affects Woody ad snippets: from n/a through 2.4.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/insert-php/wordpress-woody-code-snippets-plugin-2-4-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/insert-php/wordpress-woody-code-snippets-plugin-2-4-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35752
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Enea Overclokk Stellissimo Text Box allows Stored XSS.This issue affects Stellissimo Text Box: from n/a through 1.1.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/stellissimo-text-box/wordpress-stellissimo-text-box-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stellissimo-text-box/wordpress-stellissimo-text-box-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-36965
Published: 2024-06-08
Description: In the Linux kernel, the following vulnerability has been resolved:

remoteproc: mediatek: Make sure IPI buffer fits in L2TCM

The IPI buffer location is read from the firmware that we load to the
System Companion Processor, and it's not granted that both the SRAM
(L2TCM) size that is defined in the devicetree node is large enough
for that, and while this is especially true for multi-core SCP, it's
still useful to check on single-core variants as well.

Failing to perform this check may make this driver perform R/W
operations out of the L2TCM boundary, resulting (at best) in a
kernel panic.

To fix that, check that the IPI buffer fits, otherwise return a
failure and refuse to boot the relevant SCP core (or the SCP at
all, if this is single core).
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf; https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2; https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e
CVE: CVE-2024-36966
Published: 2024-06-08
Description: In the Linux kernel, the following vulnerability has been resolved:

erofs: reliably distinguish block based and fscache mode

When erofs_kill_sb() is called in block dev based mode, s_bdev may not
have been initialised yet, and if CONFIG_EROFS_FS_ONDEMAND is enabled,
it will be mistaken for fscache mode, and then attempt to free an anon_dev
that has never been allocated, triggering the following warning:

============================================
ida_free called for id=0 which is not allocated.
WARNING: CPU: 14 PID: 926 at lib/idr.c:525 ida_free+0x134/0x140
Modules linked in:
CPU: 14 PID: 926 Comm: mount Not tainted 6.9.0-rc3-dirty #630
RIP: 0010:ida_free+0x134/0x140
Call Trace:
 <TASK>
 erofs_kill_sb+0x81/0x90
 deactivate_locked_super+0x35/0x80
 get_tree_bdev+0x136/0x1e0
 vfs_get_tree+0x2c/0xf0
 do_new_mount+0x190/0x2f0
 [...]
============================================

Now when erofs_kill_sb() is called, erofs_sb_info must have been
initialised, so use sbi->fsid to distinguish between the two modes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824
References: https://git.kernel.org/stable/c/7af2ae1b1531feab5d38ec9c8f472dc6cceb4606; https://git.kernel.org/stable/c/dcdd49701e429c55b3644fd70fc58d85745f8cfe; https://git.kernel.org/stable/c/f9b877a7ee312ec8ce17598a7ef85cb820d7c371
CVE: CVE-2024-36967
Published: 2024-06-08
Description: In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix memory leak in tpm2_key_encode()

'scratch' is never freed. Fix this by calling kfree() in the success, and
in the error case.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/189c768932d435045b1fae12bf63e53866f06a28; https://git.kernel.org/stable/c/1e6914fa8e7798bcf3ce4a5b96ea4ac1d5571cdf; https://git.kernel.org/stable/c/5d91238b590bd883c86ba7707c5c9096469c08b7
CVE: CVE-2024-36968
Published: 2024-06-08
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()

l2cap_le_flowctl_init() can cause both div-by-zero and an integer
overflow since hdev->le_mtu may not fall in the valid range.

Move MTU from hci_dev to hci_conn to validate MTU and stop the connection
process earlier if MTU is invalid.
Also, add a missing validation in read_buffer_size() and make it return
an error value if the validation fails.
Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a
kzalloc failure and invalid MTU value.

divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G        W          6.9.0-rc5+ #20
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci0 hci_rx_work
RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547
Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c
89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d
b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42
RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246
RAX:[PII_REDACTED]0002a0 RBX: [PII_REDACTED] RCX: dffffc[PII_REDACTED]
RDX: [PII_REDACTED] RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f
RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa
R10:[PII_REDACTED]ffaaaa R11: [PII_REDACTED] R12: ffff88810d65a084
R13: dffffc[PII_REDACTED] R14:[PII_REDACTED]0002a0 R15: ffff88810d65a000
FS:  [PII_REDACTED](0000) GS:ffff88811ac00000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: [PII_REDACTED] CR3: [PII_REDACTED] CR4:[PII_REDACTED]770ef0
PKRU: 55555554
Call Trace:
 <TASK>
 l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline]
 l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline]
 l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline]
 l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809
 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506
 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline]
 hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335
 worker_thread+0x926/0xe70 kernel/workqueue.c:3416
 kthread+0x2e3/0x380 kernel/kthread.c:388
 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace [PII_REDACTED] ]---
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-369
References: https://git.kernel.org/stable/c/4d3dbaa252257d20611c3647290e6171f1bbd6c8; https://git.kernel.org/stable/c/a5b862c6a221459d54e494e88965b48dcfa6cc44; https://git.kernel.org/stable/c/ad3f7986c5a0f82b8b66a0afe1cc1f5421e1d674
CVE: CVE-2024-36969
Published: 2024-06-08
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix division by zero in setup_dsc_config

When slice_height is 0, the division by slice_height in the calculation
of the number of slices will cause a division by zero driver crash. This
leaves the kernel in a state that requires a reboot. This patch adds a
check to avoid the division by zero.

The stack trace below is for the 6.8.4 Kernel. I reproduced the issue on
a Z16 Gen 2 Lenovo Thinkpad with a Apple Studio Display monitor
connected via Thunderbolt. The amdgpu driver crashed with this exception
when I rebooted the system with the monitor connected.

kernel: ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447)
kernel: ? do_trap (arch/x86/kernel/traps.c:113 arch/x86/kernel/traps.c:154)
kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu
kernel: ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:175)
kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu
kernel: ? exc_divide_error (arch/x86/kernel/traps.c:194 (discriminator 2))
kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu
kernel: ? asm_exc_divide_error (./arch/x86/include/asm/idtentry.h:548)
kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu
kernel: dc_dsc_compute_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1109) amdgpu

After applying this patch, the driver no longer crashes when the monitor
is connected and the system is rebooted. I believe this is the same
issue reported for 3113.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/stable/c/130afc8a886183a94cf6eab7d24f300014ff87ba; https://git.kernel.org/stable/c/308de6be0c9c7ba36915c0d398e771725c0ea911; https://git.kernel.org/stable/c/7e4f50dfc98c49b3dc6875a35c3112522fb25639
CVE: CVE-2024-36970
Published: 2024-06-08
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: Use request_module_nowait

This appears to work around a deadlock regression that came in
with the LED merge in 6.9.

The deadlock happens on my system with 24 iwlwifi radios, so maybe
it something like all worker threads are busy and some work that needs
to complete cannot complete.

[also remove unnecessary "load_module" var and now-wrong comment]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/3d913719df14c28c4d3819e7e6d150760222bda4; https://git.kernel.org/stable/c/d[PII_REDACTED]9e2fde2deeac[PII_REDACTED]7afdf9e; https://git.kernel.org/stable/c/3d913719df14c28c4d3819e7e6d150760222bda4