deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7967
Published: 2024-08-21
Description: Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787, CWE-122
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/355731798
CVE: CVE-2024-7968
Published: 2024-08-21
Description: Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/349253666
CVE: CVE-2024-7969
Published: 2024-08-21
Description: Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/351865302
CVE: CVE-2024-7971
Published: 2024-08-21
Description: Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-843, CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/360700873; https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/
CVE: CVE-2024-7972
Published: 2024-08-21
Description: Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/345960102
CVE: CVE-2024-7973
Published: 2024-08-21
Description: Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/345518608
CVE: CVE-2024-7974
Published: 2024-08-21
Description: Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/339141099
CVE: CVE-2024-7975
Published: 2024-08-21
Description: Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/347588491
CVE: CVE-2024-7976
Published: 2024-08-21
Description: Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/339654392
CVE: CVE-2024-7977
Published: 2024-08-21
Description: Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/324770940
CVE: CVE-2024-7978
Published: 2024-08-21
Description: Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/40060358
CVE: CVE-2024-7979
Published: 2024-08-21
Description: Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)
CVSS Score: 7.8 (HIGH)
CWE: CWE-345, CWE-345
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/356064205
CVE: CVE-2024-7980
Published: 2024-08-21
Description: Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)
CVSS Score: 7.8 (HIGH)
CWE: CWE-345, CWE-20
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/356328460
CVE: CVE-2024-7981
Published: 2024-08-21
Description: Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/40067456
CVE: CVE-2024-8033
Published: 2024-08-21
Description: Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker who convinced a user to install a malicious application to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/350256139
CVE: CVE-2024-8034
Published: 2024-08-21
Description: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/353858776
CVE: CVE-2024-8035
Published: 2024-08-21
Description: Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/40059470
CVE: CVE-2024-28987
Published: 2024-08-21
Description: The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2; https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987; https://www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd/
CVE: CVE-2024-42056
Published: 2024-08-22
Description: Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered (by an authenticated attacker) via the /api/resources endpoint. The earliest affected version is 3.18.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-352
References: https://docs.retool.com/disclosures/cve-2024-42056; https://docs.retool.com/releases
CVE: CVE-2024-43033
Published: 2024-08-22
Description: JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.
CVSS Score: 8.8 (HIGH)
CWE: CWE-69
References: https://cwe.mitre.org/data/definitions/69.html; https://github.com/JPressProjects/jpress/issues/188; https://github.com/lazy-forever/CVE-Reference/tree/main/2024/43033
CVE: CVE-2021-4441
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()

In zynq_qspi_exec_mem_op(), kzalloc() is directly used in memset(),
which could lead to a NULL pointer dereference on failure of
kzalloc().

Fix this bug by adding a check of tmpbuf.

This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.

Builds with CONFIG_SPI_ZYNQ_QSPI=m show no new warnings,
and our static analyzer no longer warns about this code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2efece1368aeee2d2552c7ec36aeb676c4d4c95f; https://git.kernel.org/stable/c/3c32405d6474a21f7d742828e73c13e326dcae82; https://git.kernel.org/stable/c/ab3824427b848da10e9fe2727f035bbeecae6ff4
CVE: CVE-2022-48900
Published: 2024-08-22
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-48904
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Fix I/O page table memory leak

The current logic updates the I/O page table mode for the domain
before calling the logic to free memory used for the page table.
This results in IOMMU page table memory leak, and can be observed
when launching VM w/ pass-through devices.

Fix by freeing the memory used for page table before updating the mode.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/378e2fe1eb58d5c2ed55c8fe5e11f9db5033cdd6; https://git.kernel.org/stable/c/6b0b2d9a6a308bcd9300c2d83000a82812c56cea; https://git.kernel.org/stable/c/c78627f757e37c2cf386b59c700c4e[PII_REDACTED]
CVE: CVE-2022-48905
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

ibmvnic: free reset-work-item when flushing

Fix a tiny memory leak when flushing the reset work queue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/39738a2346b270e8f72f88d8856de2c167bd2899; https://git.kernel.org/stable/c/4c26745e4576cec224092e6cc12e37829333b183; https://git.kernel.org/stable/c/58b07100c20e95c78b8cb4d6d28ca53eb9ef81f2
CVE: CVE-2022-48906
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

mptcp: Correctly set DATA_FIN timeout when number of retransmits is large

Syzkaller with UBSAN uncovered a scenario where a large number of
DATA_FIN retransmits caused a shift-out-of-bounds in the DATA_FIN
timeout calculation:

================================================================================
UBSAN: shift-out-of-bounds in net/mptcp/protocol.c:470:29
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 1 PID: 13059 Comm: kworker/1:0 Not tainted 5.17.0-rc2-00630-g5fbf21c90c60 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: events mptcp_worker
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds.cold+0xb2/0x20e lib/ubsan.c:330
 mptcp_set_datafin_timeout net/mptcp/protocol.c:470 [inline]
 __mptcp_retrans.cold+0x72/0x77 net/mptcp/protocol.c:2445
 mptcp_worker+0x58a/0xa70 net/mptcp/protocol.c:2528
 process_one_work+0x9df/0x16d0 kernel/workqueue.c:2307
 worker_thread+0x95/0xe10 kernel/workqueue.c:2454
 kthread+0x2f4/0x3b0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
================================================================================

This change limits the maximum timeout by limiting the size of the
shift, which keeps all intermediate values in-bounds.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/03ae283bd71f761feae3f402668d698b393b0e79; https://git.kernel.org/stable/c/0c3f34beb459753f9f80d0cc14c1b50ab615c631; https://git.kernel.org/stable/c/877d11f0332cd2160e19e3313e262754c321fa36
CVE: CVE-2022-48907
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

auxdisplay: lcd2s: Fix memory leak in ->remove()

Once allocated the struct lcd2s_data is never freed.
Fix the memory leak by switching to devm_kzalloc().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3585ed5f9b11a6094dd991d76a1541e5d03b986a; https://git.kernel.org/stable/c/5d53cd33f4253aa4cf02bf7e670b3c6a99674351; https://git.kernel.org/stable/c/898c0a15425a5bcaa8d44bd436eae5afd2483796
CVE: CVE-2022-48908
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()

During driver initialization, the pointer of card info, i.e. the
variable 'ci' is required. However, the definition of
'com20020pci_id_table' reveals that this field is empty for some
devices, which will cause null pointer dereference when initializing
these devices.

The following log reveals it:

[    3.973806] KASAN: null-ptr-deref in range [0x[PII_REDACTED]000028-0x[PII_REDACTED]00002f]
[    3.973819] RIP: 0010:com20020pci_probe+0x18d/0x13e0 [com20020_pci]
[    3.975181] Call Trace:
[    3.976208]  local_pci_probe+0x13f/0x210
[    3.977248]  pci_device_probe+0x34c/0x6d0
[    3.977255]  ? pci_uevent+0x470/0x470
[    3.978265]  really_probe+0x24c/0x8d0
[    3.978273]  __driver_probe_device+0x1b3/0x280
[    3.979288]  driver_probe_device+0x50/0x370

Fix this by checking whether the 'ci' is a null pointer first.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/5f394102ee27dbf051a4e283390cd8d1759dacea; https://git.kernel.org/stable/c/8e3bc7c5bbf87e86e9cd652ca2a9166942d86206; https://git.kernel.org/stable/c/b1ee6b9340a38bdb9e5c90f0eac5b22b122c3049
CVE: CVE-2022-48909
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix connection leak

There's a potential leak issue under following execution sequence :

smc_release  				smc_connect_work
if (sk->sk_state == SMC_INIT)
					send_clc_confirim
	tcp_abort();
					...
					sk.sk_state = SMC_ACTIVE
smc_close_active
switch(sk->sk_state) {
...
case SMC_ACTIVE:
	smc_close_final()
	// then wait peer closed

Unfortunately, tcp_abort() may discard CLC CONFIRM messages that are
still in the tcp send buffer, in which case our connection token cannot
be delivered to the server side, which means that we cannot get a
passive close message at all. Therefore, it is impossible for the to be
disconnected at all.

This patch tries a very simple way to avoid this issue, once the state
has changed to SMC_ACTIVE after tcp_abort(), we can actively abort the
smc connection, considering that the state is SMC_INIT before
tcp_abort(), abandoning the complete disconnection process should not
cause too much problem.

In fact, this problem may exist as long as the CLC CONFIRM message is
not received by the server. Whether a timer should be added after
smc_close_final() needs to be discussed in the future. But even so, this
patch provides a faster release for connection in above case, it should
also be valuable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2e8d465b83db307f04ad265848f8ab3f78f6918f; https://git.kernel.org/stable/c/80895b6f9154fb22d36fab311ccbb75503a2c87b; https://git.kernel.org/stable/c/9f1c50cf39167ff71dc5953a3234f3f6eeb8fcb5
CVE: CVE-2022-48910
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: ensure we call ipv6_mc_down() at most once

There are two reasons for addrconf_notify() to be called with NETDEV_DOWN:
either the network device is actually going down, or IPv6 was disabled
on the interface.

If either of them stays down while the other is toggled, we repeatedly
call the code for NETDEV_DOWN, including ipv6_mc_down(), while never
calling the corresponding ipv6_mc_up() in between. This will cause a
new entry in idev->mc_tomb to be allocated for each multicast group
the interface is subscribed to, which in turn leaks one struct ifmcaddr6
per nontrivial multicast group the interface is subscribed to.

The following reproducer will leak at least $n objects:

ip addr add ff2e::4242/32 dev eth0 autojoin
sysctl -w net.ipv6.conf.eth0.disable_ipv6=1
for i in $(seq 1 $n); do
	ip link set up eth0; ip link set down eth0
done

Joining groups with IPV6_ADD_MEMBERSHIP (unprivileged) or setting the
sysctl net.ipv6.conf.eth0.forwarding to 1 (=> subscribing to ff02::2)
can also be used to create a nontrivial idev->mc_list, which will the
leak objects with the right up-down-sequence.

Based on both sources for NETDEV_DOWN events the interface IPv6 state
should be considered:

 - not ready if the network interface is not ready OR IPv6 is disabled
   for it
 - ready if the network interface is ready AND IPv6 is enabled for it

The functions ipv6_mc_up() and ipv6_down() should only be run when this
state changes.

Implement this by remembering when the IPv6 state is ready, and only
run ipv6_mc_down() if it actually changed from ready to not ready.

The other direction (not ready -> ready) already works correctly, as:

 - the interface notification triggered codepath for NETDEV_UP /
   NETDEV_CHANGE returns early if ipv6 is disabled, and
 - the disable_ipv6=0 triggered codepath skips fully initializing the
   interface as long as addrconf_link_ready(dev) returns false
 - calling ipv6_mc_up() repeatedly does not leak anything
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/[PII_REDACTED]4cfa410de62d8abb5df95c3b67455d; https://git.kernel.org/stable/c/72124e65a70b84e6303a5cd21b0ac1f27d7d61a4; https://git.kernel.org/stable/c/9588ac2eddc2f223ebcebf6e9f5caed84d32922b
CVE: CVE-2022-48911
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_queue: fix possible use-after-free

Eric Dumazet says:
  The sock_hold() side seems suspect, because there is no guarantee
  that sk_refcnt is not already 0.

On failure, we cannot queue the packet and need to indicate an
error.  The packet will be dropped by the caller.

v2: split skb prefetch hunk into separate change
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/21b27b2baa27423286e9b8d3f0b194d587083d95; https://git.kernel.org/stable/c/34dc4a6a7f261736ef7183868a5bddad31c7f9e3; https://git.kernel.org/stable/c/43c25da41e3091b31a906651a43e80a2719aa1ff
CVE: CVE-2022-48914
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: destroy queues before real_num_tx_queues is zeroed

xennet_destroy_queues() relies on info->netdev->real_num_tx_queues to
delete queues. Since d7dac083414eb5bb99a6d2ed53dc2c1b405224e5
("net-sysfs: update the queue counts in the unregistration path"),
unregister_netdev() indirectly sets real_num_tx_queues to 0. Those two
facts together means, that xennet_destroy_queues() called from
xennet_remove() cannot do its job, because it's called after
unregister_netdev(). This results in kfree-ing queues that are still
linked in napi, which ultimately crashes:

    BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    PGD 0 P4D 0
    Oops: 0000 [#1] PREEMPT SMP PTI
    CPU: 1 PID: 52 Comm: xenwatch Tainted: G        W         5.16.10-1.32.fc32.qubes.x86_64+ #226
    RIP: 0010:free_netdev+0xa3/0x1a0
    Code: ff 48 89 df e8 2e e9 00 00 48 8b 43 50 48 8b 08 48 8d b8 a0 fe ff ff 48 8d a9 a0 fe ff ff 49 39 c4 75 26 eb 47 e8 ed c1 66 ff <48> 8b 85 60 01 00 00 48 8d 95 60 01 00 00 48 89 ef 48 2d 60 01 00
    RSP: 0000:ffffc90000bcfd00 EFLAGS: 00010286
    RAX: [PII_REDACTED] RBX: ffff88800edad000 RCX: [PII_REDACTED]
    RDX: [PII_REDACTED] RSI: ffffc90000bcfc30 RDI: 00000000ffffffff
    RBP: fffffffffffffea0 R08: [PII_REDACTED] R09: [PII_REDACTED]
    R10: [PII_REDACTED] R11: [PII_REDACTED] R12: ffff88800edad050
    R13: ffff8880065f8f88 R14: [PII_REDACTED] R15: ffff8880066c6680
    FS:  [PII_REDACTED](0000) GS:ffff8880f3300000(0000) knlGS:[PII_REDACTED]
    CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
    CR2: [PII_REDACTED] CR3: 00000000e998c006 CR4:[PII_REDACTED]3706e0
    Call Trace:
     <TASK>
     xennet_remove+0x13d/0x300 [xen_netfront]
     xenbus_dev_remove+0x6d/0xf0
     __device_release_driver+0x17a/0x240
     device_release_driver+0x24/0x30
     bus_remove_device+0xd8/0x140
     device_del+0x18b/0x410
     ? _raw_spin_unlock+0x16/0x30
     ? klist_iter_exit+0x14/0x20
     ? xenbus_dev_request_and_reply+0x80/0x80
     device_unregister+0x13/0x60
     xenbus_dev_changed+0x18e/0x1f0
     xenwatch_thread+0xc0/0x1a0
     ? do_wait_intr_irq+0xa0/0xa0
     kthread+0x16b/0x190
     ? set_kthread_struct+0x40/0x40
     ret_from_fork+0x22/0x30
     </TASK>

Fix this by calling xennet_destroy_queues() from xennet_uninit(),
when real_num_tx_queues is still available. This ensures that queues are
destroyed when real_num_tx_queues is set to 0, regardless of how
unregister_netdev() was called.

Originally reported at
https://github.com/QubesOS/qubes-issues/issues/7257
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/198cdc287769c717dafff5887c6125cb7a373bf3; https://git.kernel.org/stable/c/47e2f166ed9fe17f24561d6315be2228f6a90209; https://git.kernel.org/stable/c/a1753d5c29a6fb9a8966dcf04cb4f3b71e303ae8
CVE: CVE-2022-48915
Published: 2024-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

thermal: core: Fix TZ_GET_TRIP NULL pointer dereference

Do not call get_trip_hyst() from thermal_genl_cmd_tz_get_trip() if
the thermal zone does not define one.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1c0b51e62a50e9291764d022ed44549e65d6ab9c; https://git.kernel.org/stable/c/3dafbf915c05f83469e791949b5590da2aca2afb; https://git.kernel.org/stable/c/4c294285cec3964b3291772ac0642c2bf440bd1b
CVE: CVE-2022-48917
Published: 2024-08-22
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.