deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4432
Published: 2024-05-18
Description: The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.4.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/piotnet-addons-for-elementor/trunk/widgets/pafe-before-after-image-comparison-slider.php#L195; https://plugins.trac.wordpress.org/browser/piotnet-addons-for-elementor/trunk/widgets/pafe-table.php#L195; https://plugins.trac.wordpress.org/changeset/3087322/
CVE: CVE-2024-5088
Published: 2024-05-18
Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/widgets/skills/widget.php#L360; https://plugins.trac.wordpress.org/changeset/3087575/happy-elementor-addons/trunk/widgets/skills/widget.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/203ab09f-7344-4cab-86bf-0c1ec545d78f?source=cve
CVE: CVE-2024-3745
Published: 2024-05-18
Description: MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://fluidattacks.com/advisories/gershwin/; https://forums.guru3d.com/threads/msi-ab-rtss-development-news-thread.412822/page-227#post-6231456; https://forums.guru3d.com/threads/msi-ab-rtss-development-news-thread.412822/page-227#post-6231768
CVE: CVE-2024-31879
Published: 2024-05-18
Description: IBM i 7.2, 7.3, and 7.4 could allow a remote attacker to execute arbitrary code leading to a denial of service of network ports on the system, caused by the deserialization of untrusted data.  IBM X-Force ID:  287539.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287539; https://www.ibm.com/support/pages/node/7154380; https://exchange.xforce.ibmcloud.com/vulnerabilities/287539
CVE: CVE-2024-34083
Published: 2024-05-18
Description: aiosmptd is  a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-349
References: https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda; https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8; https://nostarttls.secvuln.info
CVE: CVE-2024-5093
Published: 2024-05-18
Description: A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265072.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/House%20Rental%20Management%20System/House%20Rental%20Management%20System%20-%20Authentication%20Bypass.md; https://vuldb.com/?ctiid.265072; https://vuldb.com/?id.265072
CVE: CVE-2024-36043
Published: 2024-05-18
Description: question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/surveyjs/survey-library/commit/b25fbf0efd4486dc55f836240bebc2305803b96d; https://github.com/surveyjs/survey-library/issues/8286; https://github.com/surveyjs/survey-library/commit/b25fbf0efd4486dc55f836240bebc2305803b96d
CVE: CVE-2024-5094
Published: 2024-05-18
Description: A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This issue affects some unknown processing of the file view_payment.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265073 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/House%20Rental%20Management%20System/House%20Rental%20Management%20System%20-%20SQL%20Injection%20-%202.md; https://vuldb.com/?ctiid.265073; https://vuldb.com/?id.265073
CVE: CVE-2024-36048
Published: 2024-05-18
Description: QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-335
References: https://codereview.qt-project.org/c/qt/qtnetworkauth/+/560317; https://codereview.qt-project.org/c/qt/qtnetworkauth/+/560368; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGB6KUPJFQWUBKXVDPJUMAD6KNJJEWPW/
CVE: CVE-2024-28063
Published: 2024-05-18
Description: Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.objectif-securite.ch/advisories/totemomail-reflected-xss.txt; https://www.objectif-securite.ch/advisories/totemomail-reflected-xss.txt
CVE: CVE-2024-28064
Published: 2024-05-18
Description: Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-26
References: https://www.objectif-securite.ch/advisories/totemomail-path-traversal.txt; https://www.objectif-securite.ch/advisories/totemomail-path-traversal.txt
CVE: CVE-2024-36050
Published: 2024-05-18
Description: Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker-controlled source code by luring a maintainer into accepting a malicious pull request.
CVSS Score: 4.3 (MEDIUM)
References: https://discourse.nixos.org/t/nixpkgs-supply-chain-security-project/34345; https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017/26; https://github.com/NixOS/nix/issues/969
CVE: CVE-2024-5095
Published: 2024-05-19
Description: A vulnerability classified as problematic has been found in Victor Zsviot Camera 8.26.31. This affects an unknown part of the component MQTT Packet Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265077 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://github.com/kzLiu2017/Tuya_Cam_CVE_Doc/blob/main/zsviot%20camera.pdf; https://vuldb.com/?ctiid.265077; https://vuldb.com/?id.265077
CVE: CVE-2024-5096
Published: 2024-05-19
Description: A vulnerability classified as problematic was found in Hipcam Device up to 20240511. This vulnerability affects unknown code of the file /log/wifi.mac of the component MAC Address Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-265078 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://netsecfish.notion.site/Unauthorized-Access-to-MAC-Address-in-Hipcam-Device-a9a8daeeda954e83af847eb27805dc99?pvs=4; https://vuldb.com/?ctiid.265078; https://vuldb.com/?id.265078
CVE: CVE-2024-5097
Published: 2024-05-19
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Simple Inventory System 1.0. Affected is an unknown function of the file /tableedit.php#page=editprice. The manipulation of the argument itemnumber leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265080.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20CSRF.md; https://vuldb.com/?ctiid.265080; https://vuldb.com/?id.265080
CVE: CVE-2024-5098
Published: 2024-05-19
Description: A vulnerability has been found in SourceCodester Simple Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-265081 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20Sql%20Inject-1.md; https://vuldb.com/?ctiid.265081; https://vuldb.com/?id.265081
CVE: CVE-2024-5099
Published: 2024-05-19
Description: A vulnerability was found in SourceCodester Simple Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file updateprice.php. The manipulation of the argument ITEM leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-265082 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20Sql%20Inject-2.md; https://vuldb.com/?ctiid.265082; https://vuldb.com/?id.265082
CVE: CVE-2024-35860
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: support deferring bpf_link dealloc to after RCU grace period

BPF link for some program types is passed as a "context" which can be
used by those BPF programs to look up additional information. E.g., for
multi-kprobes and multi-uprobes, link is used to fetch BPF cookie values.

Because of this runtime dependency, when bpf_link refcnt drops to zero
there could still be active BPF programs running accessing link data.

This patch adds generic support to defer bpf_link dealloc callback to
after RCU GP, if requested. This is done by exposing two different
deallocation callbacks, one synchronous and one deferred. If deferred
one is provided, bpf_link_free() will schedule dealloc_deferred()
callback to happen after RCU GP.

BPF is using two flavors of RCU: "classic" non-sleepable one and RCU
tasks trace one. The latter is used when sleepable BPF programs are
used. bpf_link_free() accommodates that by checking underlying BPF
program's sleepable flag, and goes either through normal RCU GP only for
non-sleepable, or through RCU tasks trace GP *and* then normal RCU GP
(taking into account rcu_trace_implies_rcu_gp() optimization), if BPF
program is sleepable.

We use this for multi-kprobe and multi-uprobe links, which dereference
link during program run. We also preventively switch raw_tp link to use
deferred dealloc callback, as upcoming changes in bpf-next tree expose
raw_tp link data (specifically, cookie value) to BPF program at runtime
as well.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce; https://git.kernel.org/stable/c/5d8d447777564b35f67000e7838e7ccb64d525c8; https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97
CVE: CVE-2024-35861
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/2cfff21732132e363b4cc275d63ea98f1af726c1; https://git.kernel.org/stable/c/7e8360ac8774e19b0b25f44fff84a105bb2417e4; https://git.kernel.org/stable/c/e0e50401cc3921c9eaf1b0e667db174519ea939f
CVE: CVE-2024-35862
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_is_network_name_deleted()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/63981561ffd2d4987807df4126f96a11e18b0c1d; https://git.kernel.org/stable/c/aa582b33f94453fdeaff1e7d0aa252c505975e01; https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645
CVE: CVE-2024-35863
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in is_valid_oplock_break()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0a15ba88a32fa7a516aff7ffd27befed5334dff2; https://git.kernel.org/stable/c/16d58c6a7db5050b[PII_REDACTED]b63fc05f951825; https://git.kernel.org/stable/c/494c91e1e9413b407d12166a61b84200d4d54fac
CVE: CVE-2024-35864
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_is_valid_lease_break()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/705c76fbf726c7a2f6ff9143d4013b18daaaebf1; https://git.kernel.org/stable/c/a8344e2b69bde63f713b0aa796d70dbeadffddfb; https://git.kernel.org/stable/c/c868cabdf6fdd61bea54532271f4708254e57fc5
CVE: CVE-2024-35865
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_is_valid_oplock_break()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/21fed37d2bdcde33453faf61d3d4d96c355f04bd; https://git.kernel.org/stable/c/22863485a4626ec6ecf297f4cc0aef709bc862e4; https://git.kernel.org/stable/c/3dba0e5276f131e36d6d8043191d856f49238628
CVE: CVE-2024-35866
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in cifs_dump_full_key()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/10e17ca4000ec34737bde002a13435c38ace2682; https://git.kernel.org/stable/c/3103163ccd3be4adcfa37e15608fb497be044113; https://git.kernel.org/stable/c/58acd1f497162e7d282077f816faa519487be045
CVE: CVE-2024-35867
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in cifs_stats_proc_show()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0865ffefea197b437ba78b5dd8d8e256253efd65; https://git.kernel.org/stable/c/16b7d785775eb[PII_REDACTED]9415055e367398f49; https://git.kernel.org/stable/c/1e12f0d5c66f07c[PII_REDACTED]51973a116fa13c7
CVE: CVE-2024-35868
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in cifs_stats_proc_write()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/5b5475ce69f02ecc1b13ea23106e5b89c690429b; https://git.kernel.org/stable/c/8fefd166fcb368c5fcf48238e3f7c8af829e0a72; https://git.kernel.org/stable/c/cf03020c56d3ed28c[PII_REDACTED]a007b5e9544f7
CVE: CVE-2024-35869
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: guarantee refcounted children from parent session

Avoid potential use-after-free bugs when walking DFS referrals,
mounting and performing DFS failover by ensuring that all children
from parent @tcon->ses are also refcounted.  They're all needed across
the entire DFS mount.  Get rid of @tcon->dfs_ses_list while we're at
it, too.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a; https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc; https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79
CVE: CVE-2024-35870
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix UAF in smb2_reconnect_server()

The UAF bug is due to smb2_reconnect_server() accessing a session that
is already being teared down by another thread that is executing
__cifs_put_smb_ses().  This can happen when (a) the client has
connection to the server but no session or (b) another thread ends up
setting @ses->ses_status again to something different than
SES_EXITING.

To fix this, we need to make sure to unconditionally set
@ses->ses_status to SES_EXITING and prevent any other threads from
setting a new status while we're still tearing it down.

The following can be reproduced by adding some delay to right after
the ipc is freed in __cifs_put_smb_ses() - which will give
smb2_reconnect_server() worker a chance to run and then accessing
@ses->ipc:

kinit ...
mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10
[disconnect srv]
ls /mnt/1 &>/dev/null
sleep 30
kdestroy
[reconnect srv]
sleep 10
umount /mnt/1
...
CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed
CIFS: VFS: \\srv Send error in SessSetup = -126
CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed
CIFS: VFS: \\srv Send error in SessSetup = -126
general protection fault, probably for non-canonical address
0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI
CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39
04/01/2014
Workqueue: cifsiod smb2_reconnect_server [cifs]
RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0
Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad
de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75
7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8
RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83
RAX: dead[PII_REDACTED]22 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b
RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800
RBP: ffff88810da53800 R08: [PII_REDACTED] R09: [PII_REDACTED]
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: ffff88810c064000
R13: [PII_REDACTED] R14: ffff88810c064000 R15: ffff8881039cc000
FS: [PII_REDACTED](0000) GS:ffff888157c00000(0000)
knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4:[PII_REDACTED]750ef0
PKRU: 55555554
Call Trace:
 <TASK>
 ? die_addr+0x36/0x90
 ? exc_general_protection+0x1c1/0x3f0
 ? asm_exc_general_protection+0x26/0x30
 ? __list_del_entry_valid_or_report+0x33/0xf0
 __cifs_put_smb_ses+0x1ae/0x500 [cifs]
 smb2_reconnect_server+0x4ed/0x710 [cifs]
 process_one_work+0x205/0x6b0
 worker_thread+0x191/0x360
 ? __pfx_worker_thread+0x10/0x10
 kthread+0xe2/0x110
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x34/0x50
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1a/0x30
 </TASK>
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/24a9799aa8efecd0eb55a75e35f9d8e6400063aa; https://git.kernel.org/stable/c/45f2beda1f1bc3d962ec07db1ccc3197c25499a5; https://git.kernel.org/stable/c/6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0
CVE: CVE-2024-35871
Published: 2024-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv: process: Fix kernel gp leakage

childregs represents the registers which are active for the new thread
in user context. For a kernel thread, childregs->gp is never used since
the kernel gp is not touched by switch_to. For a user mode helper, the
gp value can be observed in user space after execve or possibly by other
means.

[From the email thread]

The /* Kernel thread */ comment is somewhat inaccurate in that it is also used
for user_mode_helper threads, which exec a user process, e.g. /sbin/init or
when /proc/sys/kernel/core_pattern is a pipe. Such threads do not have
PF_KTHREAD set and are valid targets for ptrace etc. even before they exec.

childregs is the *user* context during syscall execution and it is observable
from userspace in at least five ways:

1. kernel_execve does not currently clear integer registers, so the starting
   register state for PID 1 and other user processes started by the kernel has
   sp = user stack, gp = kernel __global_pointer$, all other integer registers
   zeroed by the memset in the patch comment.

   This is a bug in its own right, but I'm unwilling to bet that it is the only
   way to exploit the issue addressed by this patch.

2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread
   before it execs, but ptrace requires SIGSTOP to be delivered which can only
   happen at user/kernel boundaries.

3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for
   user_mode_helpers before the exec completes, but gp is not one of the
   registers it returns.

4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel
   addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses
   are also exposed via PERF_SAMPLE_REGS_USER which is permitted under
   LOCKDOWN_PERF. I have not attempted to write exploit code.

5. Much of the tracing infrastructure allows access to user registers. I have
   not attempted to determine which forms of tracing allow access to user
   registers without already allowing access to kernel registers.
CVSS Score: 7.1 (HIGH)
References: https://git.kernel.org/stable/c/00effef72c98294edb1efa87ffa0f6cfb61b36a4; https://git.kernel.org/stable/c/9abc3e6f1116adb7a2d4fbb8ce20c37916976bf5; https://git.kernel.org/stable/c/d14fa1fcf69db9d070e75f1c4425211fa619dfc8