deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-20034
Published: 2024-03-04
Description: In battery, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08488849; Issue ID: ALPS08488849.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20036
Published: 2024-03-04
Description: In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08509508; Issue ID: ALPS08509508.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20037
Published: 2024-03-04
Description: In pq, there is a possible write-what-where condition due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08495937; Issue ID: ALPS08495937.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-754
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2024-20038
Published: 2024-03-04
Description: In pq, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08495932; Issue ID: ALPS08495932.
CVSS Score: 3.4 (LOW)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/March-2024; https://corp.mediatek.com/product-security-bulletin/March-2024
CVE: CVE-2023-25176
Published: 2024-03-04
Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
CVSS Score: 2.9 (LOW)
CWE: CWE-125, CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md
CVE: CVE-2023-46708
Published: 2024-03-04
Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md
CVE: CVE-2023-49602
Published: 2024-03-04
Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through type confusion.
CVSS Score: 2.9 (LOW)
CWE: CWE-125, CWE-843, CWE-843
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md
CVE: CVE-2024-21816
Published: 2024-03-04
Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through improper preservation of permissions.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md
CVE: CVE-2024-21826
Published: 2024-03-04
Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker cause sensitive information leak through insecure storage.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md
CVE: CVE-2024-26622
Published: 2024-03-04
Description: In the Linux kernel, the following vulnerability has been resolved:

tomoyo: fix UAF write bug in tomoyo_write_control()

Since tomoyo_write_control() updates head->write_buf when write()
of long lines is requested, we need to fetch head->write_buf after
head->io_sem is held.  Otherwise, concurrent write() requests can
cause use-after-free-write and double-free problems.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/2caa605079488da9601099fbda460cfc1702839f; https://git.kernel.org/stable/c/2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815; https://git.kernel.org/stable/c/3bfe04c1273d30b866f4c7c238331ed3b08e5824
CVE: CVE-2023-4479
Published: 2024-03-04
Description: Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stored HTML document within limited time period.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://empower.m-files.com/security-advisories/CVE-2023-4479; https://product.m-files.com/security-advisories/cve-2023-4479/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-4479/
CVE: CVE-2023-6143
Published: 2024-03-04
Description: Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race condition to perform improper memory processing operations. If the system’s memory is carefully prepared by the user and the system is under heavy load, then this in turn cause a use-after-free.This issue affects Midgard GPU Kernel Driver: from r13p0 through r32p0; Bifrost GPU Kernel Driver: from r1p0 through r18p0; Valhall GPU Kernel Driver: from r37p0 through r46p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r46p0.


CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2023-28578
Published: 2024-03-04
Description: Memory corruption in Core Services while executing the command for removing a single event listener.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-20, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-28582
Published: 2024-03-04
Description: Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-33066
Published: 2024-03-04
Description: Memory corruption in Audio while processing RT proxy port register driver.
CVSS Score: 8.4 (HIGH)
CWE: CWE-823, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-33078
Published: 2024-03-04
Description: Information Disclosure while processing IOCTL request in FastRPC.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-33084
Published: 2024-03-04
Description: Transient DOS while processing IE fragments from server during DTLS handshake.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-33086
Published: 2024-03-04
Description: Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-33090
Published: 2024-03-04
Description: Transient DOS while processing channel information for speaker protection v2 module in ADSP.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-33095
Published: 2024-03-04
Description: Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-33096
Published: 2024-03-04
Description: Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-33103
Published: 2024-03-04
Description: Transient DOS while processing CAG info IE received from NW.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-33104
Published: 2024-03-04
Description: Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-33105
Published: 2024-03-04
Description: Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-43539
Published: 2024-03-04
Description: Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-43540
Published: 2024-03-04
Description: Memory corruption while processing the IOCTL FM HCI WRITE request.
CVSS Score: 8.4 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-43541
Published: 2024-03-04
Description: Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render.
CVSS Score: 8.4 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-43546
Published: 2024-03-04
Description: Memory corruption while invoking HGSL IOCTL context create.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-43547
Published: 2024-03-04
Description: Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-43548
Published: 2024-03-04
Description: Memory corruption while parsing qcp clip with invalid chunk data size.
CVSS Score: 7.3 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-43549
Published: 2024-03-04
Description: Memory corruption while processing TPC target power table in FTM TPC.
CVSS Score: 8.4 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-43550
Published: 2024-03-04
Description: Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-43552
Published: 2024-03-04
Description: Memory corruption while processing MBSSID beacon containing several subelement IE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-43553
Published: 2024-03-04
Description: Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-823
References: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin
CVE: CVE-2023-6241
Published: 2024-03-04
Description: Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race condition to perform improper memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn cause a use-after-free.This issue affects Midgard GPU Kernel Driver: from r13p0 through r32p0; Bifrost GPU Kernel Driver: from r11p0 through r25p0; Valhall GPU Kernel Driver: from r19p0 through r25p0, from r29p0 through r46p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r46p0.


CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-0155
Published: 2024-03-04
Description: Dell Digital Delivery, versions prior to 5.2.0.0, contain a Use After Free Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to application crash or execution of arbitrary code.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://www.dell.com/support/kbdoc/en-us/000222292/dsa-2024-033; https://www.dell.com/support/kbdoc/en-us/000222292/dsa-2024-033
CVE: CVE-2024-0156
Published: 2024-03-04
Description: Dell Digital Delivery, versions prior to 5.2.0.0, contain a Buffer Overflow Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to arbitrary code execution and/or privilege escalation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-122, CWE-120
References: https://www.dell.com/support/kbdoc/en-us/000222536/dsa-2024-032-security-update-for-dell-digital-delivery-for-a-buffer-overflow-vulnerability; https://www.dell.com/support/kbdoc/en-us/000222536/dsa-2024-032-security-update-for-dell-digital-delivery-for-a-buffer-overflow-vulnerability
CVE: CVE-2024-1788
Published: 2024-03-04
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-2813. Reason: This candidate is a duplicate of CVE-2023-2813. Notes: All CVE users should reference CVE-2023-2813 instead of this candidate.
CVE: CVE-2024-22452
Published: 2024-03-04
Description: Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access control vulnerability. A low privilege user could potentially exploit this vulnerability by modifying files in the installation folder to execute arbitrary code, leading to privilege escalation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: https://www.dell.com/support/kbdoc/en-us/000221414/dsa-2024-056; https://www.dell.com/support/kbdoc/en-us/000221414/dsa-2024-056
CVE: CVE-2024-22463
Published: 2024-03-04
Description: Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading to compromise of confidentiality and integrity of sensitive information
CVSS Score: 7.4 (HIGH)
CWE: CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000222691/dsa-2024-062-security-update-for-dell-powerscale-onefs-for-proprietary-code-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222691/dsa-2024-062-security-update-for-dell-powerscale-onefs-for-proprietary-code-vulnerabilities
CVE: CVE-2024-24901
Published: 2024-03-04
Description: Dell PowerScale OneFS 8.2.x through 9.6.0.x contain an insufficient logging vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability, causing audit messages lost and not recorded for a specific time period.
CVSS Score: 3.0 (LOW)
CWE: CWE-778
References: https://www.dell.com/support/kbdoc/en-us/000222691/dsa-2024-062-security-update-for-dell-powerscale-onefs-for-proprietary-code-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222691/dsa-2024-062-security-update-for-dell-powerscale-onefs-for-proprietary-code-vulnerabilities
CVE: CVE-2024-27684
Published: 2024-03-04
Description: A Cross-site scripting (XSS) vulnerability in dlapn.cgi, dldongle.cgi, dlcfg.cgi, fwup.cgi and seama.cgi in D-Link GORTAC750_A1_FW_v101b03 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1qu4iBQGeAwolTXjVOTXsAAusSHo2ie-Y/view; https://www.dlink.com/en/security-bulletin/; https://drive.google.com/file/d/1qu4iBQGeAwolTXjVOTXsAAusSHo2ie-Y/view
CVE: CVE-2024-0686
Published: 2024-03-04
Description: Rejected reason: Incorrect assignment
CVE: CVE-2024-27668
Published: 2024-03-04
Description: Flusity-CMS v2.33 is affected by: Cross Site Scripting (XSS) in 'Custom Blocks.'
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/LY102483/cms/blob/main/1.md; https://github.com/LY102483/cms/blob/main/1.md
CVE: CVE-2024-27680
Published: 2024-03-04
Description: Flusity-CMS v2.33 is vulnerable to Cross Site Scripting (XSS) in the "Contact form."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xiaolanjing0/cms/blob/main/4.md; https://github.com/xiaolanjing0/cms/blob/main/4.md
CVE: CVE-2022-43890
Published: 2024-03-04
Description: IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks against the system.  IBM X-Force ID:  240453.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240453; https://www.ibm.com/support/pages/node/7108660; https://exchange.xforce.ibmcloud.com/vulnerabilities/240453
CVE: CVE-2023-38362
Published: 2024-03-04
Description: IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses.  IBM X-Force ID:  260814.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260814; https://https://www.ibm.com/support/pages/node/7066430; https://exchange.xforce.ibmcloud.com/vulnerabilities/260814
CVE: CVE-2023-5451
Published: 2024-03-04
Description: Forcepoint
 NGFW Security Management Center Management Server has SMC Downloads 
optional feature to offer standalone Management Client downloads and ECA
 configuration downloads.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS.

This issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.forcepoint.com/s/article/000042395; https://support.forcepoint.com/s/article/000042395
CVE: CVE-2024-27694
Published: 2024-03-04
Description: FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the /system/share/ztree_category_edit.
CVSS Score: 7.4 (HIGH)
CWE: CWE-352
References: https://github.com/sms2056/cms/blob/main/1.md; https://github.com/sms2056/cms/blob/main/1.md
CVE: CVE-2021-47082
Published: 2024-03-04
Description: In the Linux kernel, the following vulnerability has been resolved:

tun: avoid double free in tun_free_netdev

Avoid double free in tun_free_netdev() by moving the
dev->tstats and tun->security allocs to a new ndo_init routine
(tun_net_init()) that will be called by register_netdevice().
ndo_init is paired with the desctructor (tun_free_netdev()),
so if there's an error in register_netdevice() the destructor
will handle the frees.

BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605

CPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1
Hardware name: Red Hat KVM, BIOS
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106
print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247
kasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372
____kasan_slab_free mm/kasan/common.c:346 [inline]
__kasan_slab_free+0x107/0x120 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:1723 [inline]
slab_free_freelist_hook mm/slub.c:1749 [inline]
slab_free mm/slub.c:3513 [inline]
kfree+0xac/0x2d0 mm/slub.c:4561
selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605
security_tun_dev_free_security+0x4f/0x90 security/security.c:2342
tun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215
netdev_run_todo+0x4df/0x840 net/core/dev.c:10627
rtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112
__tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302
tun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/0c0e566f0387490d16f166808c72e9c772027681; https://git.kernel.org/stable/c/158b515f703e75e7d68289bf4d98c664e1d632df; https://git.kernel.org/stable/c/3cb5ae77799e8ed6ec3fec0b6b4cd07f01650cc5
CVE: CVE-2021-47083
Published: 2024-03-04
Description: In the Linux kernel, the following vulnerability has been resolved:

pinctrl: mediatek: fix global-out-of-bounds issue

When eint virtual eint number is greater than gpio number,
it maybe produce 'desc[eint_n]' size globle-out-of-bounds issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d; https://git.kernel.org/stable/c/441d3873664d170982922c5d2fc01fa89d9439ed; https://git.kernel.org/stable/c/f373298e1bf0c6ea097c0bcc558dc43ad53e421f
CVE: CVE-2021-47084
Published: 2024-03-04
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.