deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-22637
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Cross Site Request Forgery.This issue affects Print PDF Generator and Publisher: from n/a through <= 1.2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/nopeamedia/vulnerability/wordpress-print-pdf-generator-and-publisher-plugin-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-22638
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce allows Stored XSS.This issue affects Product Table For WooCommerce: from n/a through <= 1.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/product-table-for-woocommerce/vulnerability/wordpress-product-table-for-woocommerce-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22640
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in integrationdevpaytm Paytm Payment Donation paytm-donation allows Stored XSS.This issue affects Paytm Payment Donation: from n/a through <= 2.3.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/paytm-donation/vulnerability/wordpress-paytm-payment-donation-plugin-2-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22783
Published: 2025-03-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO squirrly-seo allows SQL Injection.This issue affects SEO Plugin by Squirrly SEO: from n/a through <= 12.4.03.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/squirrly-seo/vulnerability/wordpress-seo-plugin-by-squirrly-seo-plugin-12-4-03-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-25686
Published: 2025-03-27
Description: semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/J1095/fkapfxx
CVE: CVE-2025-26265
Published: 2025-03-27
Description: A segmentation fault in openairinterface5g v2.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted UE Context Modification response.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://anonymous.4open.science/r/Mobicom-ARCANE-36B7/README.md; https://gitlab.eurecom.fr/oai/openairinterface5g; https://www.sigmobile.org/mobicom/2025/
CVE: CVE-2025-26762
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 9.7.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-9-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26909
Published: 2025-03-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows PHP Local File Inclusion.This issue affects Hide My WP Ghost: from n/a through <= 5.4.01.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/hide-my-wp/vulnerability/wordpress-hide-my-wp-ghost-plugin-5-4-01-local-file-inclusion-to-rce-vulnerability?_s_id=cve
CVE: CVE-2025-28135
Published: 2025-03-27
Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28135.md; https://sudsy-eyeliner-a59.notion.site/BufferOverflow-V4-1-2cu-5182_B20[PII_REDACTED]2b8cd95f80808902fac8449fee64; https://sudsy-eyeliner-a59.notion.site/BufferOverflow-V4-1-2cu-5182_B20[PII_REDACTED]2b8cd95f80808902fac8449fee64
CVE: CVE-2025-28138
Published: 2025-03-27
Description: The TOTOLINK A800R V4.1.2cu.5137_B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28138.md; https://sudsy-eyeliner-a59.notion.site/RCE2-1ac72b8cd95f8055a76ee0ca262aac1a?pvs=4; https://sudsy-eyeliner-a59.notion.site/RCE2-1ac72b8cd95f8055a76ee0ca262aac1a?pvs=4
CVE: CVE-2025-29072
Published: 2025-03-27
Description: An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop (and high CPU usage) by submitting a malicious Declare v2/v3 transaction. This results in a denial-of-service condition for affected Starknet full-node implementations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://community.starknet.io/t/starknet-security-update-potential-full-node-vulnerability-recap/115314; https://github.com/NethermindEth/juno/commit/[PII_REDACTED]1aa111c5dd2b41f2ec890a4a15b587
CVE: CVE-2025-2855
Published: 2025-03-27
Description: A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file /api/deploy/upload. The manipulation of the argument servers leads to deserialization. The attack may be launched remotely.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/elunez/eladmin/issues/873; https://vuldb.com/?ctiid.301502; https://vuldb.com/?id.301502
CVE: CVE-2021-4454
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

The conclusion "j1939_session_deactivate() should be called with a
session ref-count of at least 2" is incorrect. In some concurrent
scenarios, j1939_session_deactivate can be called with the session
ref-count less than 2. But there is not any problem because it
will check the session active state before session putting in
j1939_session_deactivate_locked().

Here is the concurrent scenario of the problem reported by syzbot
and my reproduction log.

        cpu0                            cpu1
                                j1939_xtp_rx_eoma
j1939_xtp_rx_abort_one
                                j1939_session_get_by_addr [kref == 2]
j1939_session_get_by_addr [kref == 3]
j1939_session_deactivate [kref == 2]
j1939_session_put [kref == 1]
				j1939_session_completed
				j1939_session_deactivate
				WARN_ON_ONCE(kref < 2)

=====================================================
WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70
CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
RIP: 0010:j1939_session_deactivate+0x5f/0x70
Call Trace:
 j1939_session_deactivate_activate_next+0x11/0x28
 j1939_xtp_rx_eoma+0x12a/0x180
 j1939_tp_recv+0x4a2/0x510
 j1939_can_recv+0x226/0x380
 can_rcv_filter+0xf8/0x220
 can_receive+0x102/0x220
 ? process_backlog+0xf0/0x2c0
 can_rcv+0x53/0xf0
 __netif_receive_skb_one_core+0x67/0x90
 ? process_backlog+0x97/0x2c0
 __netif_receive_skb+0x22/0x80
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1740a1e45eee65099a92fb502e1e67e63aad277d; https://git.kernel.org/stable/c/6950df42a03c9ac9290503ced3f371199cb68fa9; https://git.kernel.org/stable/c/9ab896775f98ff54b68512f345eed178bf961084
CVE: CVE-2022-49738
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on i_extra_isize in is_alive()

syzbot found a f2fs bug:

BUG: KASAN: slab-out-of-bounds in data_blkaddr fs/f2fs/f2fs.h:2891 [inline]
BUG: KASAN: slab-out-of-bounds in is_alive fs/f2fs/gc.c:1117 [inline]
BUG: KASAN: slab-out-of-bounds in gc_data_segment fs/f2fs/gc.c:1520 [inline]
BUG: KASAN: slab-out-of-bounds in do_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734
Read of size 4 at addr ffff[PII_REDACTED]68 by task kworker/u4:3/52

CPU: 1 PID: 52 Comm: kworker/u4:3 Not tainted 6.1.0-rc4-syzkaller-00362-gfef7fd48922d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:395
kasan_report+0xbb/0x1f0 mm/kasan/report.c:495
data_blkaddr fs/f2fs/f2fs.h:2891 [inline]
is_alive fs/f2fs/gc.c:1117 [inline]
gc_data_segment fs/f2fs/gc.c:1520 [inline]
do_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734
f2fs_gc+0x88c/0x20a0 fs/f2fs/gc.c:1831
f2fs_balance_fs+0x544/0x6b0 fs/f2fs/segment.c:410
f2fs_write_inode+0x57e/0xe20 fs/f2fs/inode.c:753
write_inode fs/fs-writeback.c:1440 [inline]
__writeback_single_inode+0xcfc/0x1440 fs/fs-writeback.c:1652
writeback_sb_inodes+0x54d/0xf90 fs/fs-writeback.c:1870
wb_writeback+0x2c5/0xd70 fs/fs-writeback.c:2044
wb_do_writeback fs/fs-writeback.c:2187 [inline]
wb_workfn+0x2dc/0x12f0 fs/fs-writeback.c:2227
process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

The root cause is that we forgot to do sanity check on .i_extra_isize
in below path, result in accessing invalid address later, fix it.
- gc_data_segment
 - is_alive
  - data_blkaddr
   - offset_in_addr
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/5b25035fb888cb2f78bf0b9c9f95b1dc54480d36; https://git.kernel.org/stable/c/914e38f02a490dafd980ff0f39cccedc074deb29; https://git.kernel.org/stable/c/97ccfffcc061e54ce87e4a51a40e2e9cb0b7076a
CVE: CVE-2022-49739
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

gfs2: Always check inode size of inline inodes

Check if the inode size of stuffed (inline) inodes is within the allowed
range when reading inodes from disk (gfs2_dinode_in()).  This prevents
us from on-disk corruption.

The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just
truncate inline data to the maximum allowed size don't actually make
sense, and they can be removed now as well.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/45df749f827c286adbc951f2a4865b67f0442ba9; https://git.kernel.org/stable/c/46c9088cabd4d0469fdb61ac2a9c5003057fe94d; https://git.kernel.org/stable/c/4d4cb76636134bf9a0c9c3432dae936f99954586
CVE: CVE-2022-49741
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

fbdev: smscufx: fix error handling code in ufx_usb_probe

The current error handling code in ufx_usb_probe have many unmatching
issues, e.g., missing ufx_free_usb_list, destroy_modedb label should
only include framebuffer_release, fb_dealloc_cmap only matches
fb_alloc_cmap.

My local syzkaller reports a memory leak bug:

memory leak in ufx_usb_probe

BUG: memory leak
unreferenced object 0xffff88802f879580 (size 128):
  comm "kworker/0:7", pid 17416, jiffies[PII_REDACTED] (age 46.710s)
  hex dump (first 32 bytes):
    80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff  .!|.............
    00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00  ................
  backtrace:
    [<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045
    [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]
    [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]
    [<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]
    [<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655
    [<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]
    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639
    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778
    [<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808
    [<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936
    [<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008
    [<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
    [<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517
    [<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170
    [<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
    [<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]
    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639
    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778

Fix this bug by rewriting the error handling code in ufx_usb_probe.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b; https://git.kernel.org/stable/c/[PII_REDACTED]ef31d26af65386a4ca496f50f0cfdf; https://git.kernel.org/stable/c/3b3d3127f5b4291ae4caaf50f7b66089ad600480
CVE: CVE-2022-49742
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: initialize locks earlier in f2fs_fill_super()

syzbot is reporting lockdep warning at f2fs_handle_error() [1], for
spin_lock(&sbi->error_lock) is called before spin_lock_init() is called.
For safe locking in error handling, move initialization of locks (and
obvious structures) in f2fs_fill_super() to immediately after memory
allocation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/92b4cf5b48955a4bdd15fe4e2067db8ebd87f04c; https://git.kernel.org/stable/c/ddeff03bb33810fcf2f0c18e03d099cf0aacda62
CVE: CVE-2022-49743
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ovl: Use "buf" flexible array for memcpy() destination

The "buf" flexible array needs to be the memcpy() destination to avoid
false positive run-time warning from the recent FORTIFY_SOURCE
hardening:

  memcpy: detected field-spanning write (size 93) of single field "&fh->fb"
  at fs/overlayfs/export.c:799 (size 21)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/012cdef22000f3104e4fa8224ad29fde509b8caf; https://git.kernel.org/stable/c/07a96977b2f462337a9121302de64277b8747ab1; https://git.kernel.org/stable/c/a77141a06367825d639ac51b04703d551163e36c
CVE: CVE-2022-49744
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/uffd: fix pte marker when fork() without fork event

Patch series "mm: Fixes on pte markers".

Patch 1 resolves the syzkiller report from Pengfei.

Patch 2 further harden pte markers when used with the recent swapin error
markers.  The major case is we should persist a swapin error marker after
fork(), so child shouldn't read a corrupted page.


This patch (of 2):

When fork(), dst_vma is not guaranteed to have VM_UFFD_WP even if src may
have it and has pte marker installed.  The warning is improper along with
the comment.  The right thing is to inherit the pte marker when needed, or
keep the dst pte empty.

A vague guess is this happened by an accident when there's the prior patch
to introduce src/dst vma into this helper during the uffd-wp feature got
developed and I probably messed up in the rebase, since if we replace
dst_vma with src_vma the warning & comment it all makes sense too.

Hugetlb did exactly the right here (copy_hugetlb_page_range()).  Fix the
general path.

Reproducer:

https://github.com/xupengfe/syzkaller_logs/blob/main/221208_115556_copy_page_range/repro.c

Bugzilla report: https://bugzilla.kernel.org/show_bug.cgi?id=216808
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2d11727655bf931776fb541f5862daf04bd5bf02; https://git.kernel.org/stable/c/49d6d7fb631345b0f2957a7c4be24ad63903150f
CVE: CVE-2022-49745
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

fpga: m10bmc-sec: Fix probe rollback

Handle probe error rollbacks properly to avoid leaks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://git.kernel.org/stable/c/60ce26d10e5850f33cc76fce52f5377045e75a15; https://git.kernel.org/stable/c/74cff472d3d66db13b5ef64f40dfa42383f71ff7
CVE: CVE-2022-49746
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init

If the function sdma_load_context() fails, the sdma_desc will be
freed, but the allocated desc->bd is forgot to be freed.

We already met the sdma_load_context() failure case and the log as
below:
[ 450.699064] imx-sdma 30bd0000.dma-controller: Timeout waiting for CH0 ready
...

In this case, the desc->bd will not be freed without this change.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/1417f59ac0b02130ee56c0c50794b9b257be3d17; https://git.kernel.org/stable/c/43acd767bd90c5d4172ce7fee5d9007a9a08dea9; https://git.kernel.org/stable/c/80ee99e52936b2c04cc37b17a14b2ae2f9d282ac
CVE: CVE-2022-49747
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

erofs/zmap.c: Fix incorrect offset calculation

Effective offset to add to length was being incorrectly calculated,
which resulted in iomap->length being set to 0, triggering a WARN_ON
in iomap_iter_done().

Fix that, and describe it in comments.

This was reported as a crash by syzbot under an issue about a warning
encountered in iomap_iter_done(), but unrelated to erofs.

C reproducer: https://syzkaller.appspot.com/text?tag=ReproC&x=1037a6b2880000
Kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=e2021a61197ebe02
Dashboard link: https://syzkaller.appspot.com/bug?extid=a8e049cd3abd342936b6
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/[PII_REDACTED]c1e74f52d3ea067338d314a83a8afb; https://git.kernel.org/stable/c/6acd87d50998ef0afafc441613aeaf5a8f5c9eff; https://git.kernel.org/stable/c/9f31d8c889d9a4e47bfcc6c4537d0c9f89fe582c
CVE: CVE-2022-49748
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

perf/x86/amd: fix potential integer overflow on shift of a int

The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
arithmetic and then passed as a 64 bit function argument. In the case where
i is 32 or more this can lead to an overflow.  Avoid this by shifting
using the BIT_ULL macro instead.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://git.kernel.org/stable/c/08245672cdc6505550d1a5020603b0a8d4a6dcc7; https://git.kernel.org/stable/c/14cc13e433e[PII_REDACTED]b1adbf05608d7d47a93; https://git.kernel.org/stable/c/a4d01fb87ece45d4164fd725890211ccf9a307a9
CVE: CVE-2022-49749
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

i2c: designware: use casting of u64 in clock multiplication to avoid overflow

In functions i2c_dw_scl_lcnt() and i2c_dw_scl_hcnt() may have overflow
by depending on the values of the given parameters including the ic_clk.
For example in our use case where ic_clk is larger than one million,
multiplication of ic_clk * 4700 will result in 32 bit overflow.

Add cast of u64 to the calculation to avoid multiplication overflow, and
use the corresponding define for divide.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://git.kernel.org/stable/c/2f29d780bd691d20e89e5b35d5e[PII_REDACTED]e94; https://git.kernel.org/stable/c/9f36aae9e80e79b7a6d62227eaa96935166be9fe; https://git.kernel.org/stable/c/c8c37bc514514999e62a17e95160ed9ebf75ca8d
CVE: CVE-2022-49750
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

cpufreq: CPPC: Add u64 casts to avoid overflowing

The fields of the _CPC object are unsigned 32-bits values.
To avoid overflows while using _CPC's values, add 'u64' casts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://git.kernel.org/stable/c/7d596bbc66a52ff2c7a83d7e0ee840cb07e2a045; https://git.kernel.org/stable/c/f5f94b9c8b805d87ff185caf9779c3a4d07819e3
CVE: CVE-2022-49751
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

w1: fix WARNING after calling w1_process()

I got the following WARNING message while removing driver(ds2482):

------------[ cut here ]------------
do not call blocking ops when !TASK_RUNNING; state=1 set at [<000000002d50bfb6>] w1_process+0x9e/0x1d0 [wire]
WARNING: CPU: 0 PID: 262 at kernel/sched/core.c:9817 __might_sleep+0x98/0xa0
CPU: 0 PID: 262 Comm: w1_bus_master1 Tainted: G                 N 6.1.0-rc3+ #307
RIP: 0010:__might_sleep+0x98/0xa0
Call Trace:
 exit_signals+0x6c/0x550
 do_exit+0x2b4/0x17e0
 kthread_exit+0x52/0x60
 kthread+0x16d/0x1e0
 ret_from_fork+0x1f/0x30

The state of task is set to TASK_INTERRUPTIBLE in loop in w1_process(),
set it to TASK_RUNNING when it breaks out of the loop to avoid the
warning.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/190b5c3bbd5df685bb1063bda048831d72b8f1d4; https://git.kernel.org/stable/c/216f35db6ec6a667cd9db4838d657c1d2f4684da; https://git.kernel.org/stable/c/276052159ba94d4d9f5b453fb4707d6798c6b845
CVE: CVE-2022-49752
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()

The 'parent' returned by fwnode_graph_get_port_parent()
with refcount incremented when 'prev' is not NULL, it
needs be put when finish using it.

Because the parent is const, introduce a new variable to
store the returned fwnode, then put it before returning
from fwnode_graph_get_next_endpoint().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/39af728649b05e88a2b40e714feeee6451c3f18e; https://git.kernel.org/stable/c/7701a4bd45c11f9a289d8f262fad05705a012339; https://git.kernel.org/stable/c/e0472947bead3af94cc968ce35fc0414803a2f65
CVE: CVE-2022-49754
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix a buffer overflow in mgmt_mesh_add()

Smatch Warning:
net/bluetooth/mgmt_util.c:375 mgmt_mesh_add() error: __memcpy()
'mesh_tx->param' too small (48 vs 50)

Analysis:

'mesh_tx->param' is array of size 48. This is the destination.
u8 param[sizeof(struct mgmt_cp_mesh_send) + 29]; // 19 + 29 = 48.

But in the caller 'mesh_send' we reject only when len > 50.
len > (MGMT_MESH_SEND_SIZE + 31) // 19 + 31 = 50.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://git.kernel.org/stable/c/2185e0fdbb2137f22a9dd9fcbf6481400d56299b; https://git.kernel.org/stable/c/ed818fd8c531abf561b379995ee7cc4c68029464