deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-41069
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: topology: Fix references to freed memory

Most users after parsing a topology file, release memory used by it, so
having pointer references directly into topology file contents is wrong.
Use devm_kmemdup(), to allocate memory as needed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/97ab304ecd95c0b1703ff8c8c3956dc6e2afe8e1; https://git.kernel.org/stable/c/ab5a6208b4d6872b1c6ecea1867940fc668cc76d; https://git.kernel.org/stable/c/b188d7f3dfab10e332e3c1066e18857964a520d2
CVE: CVE-2024-41070
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()

Al reported a possible use-after-free (UAF) in kvm_spapr_tce_attach_iommu_group().

It looks up `stt` from tablefd, but then continues to use it after doing
fdput() on the returned fd. After the fdput() the tablefd is free to be
closed by another thread. The close calls kvm_spapr_tce_release() and
then release_spapr_tce_table() (via call_rcu()) which frees `stt`.

Although there are calls to rcu_read_lock() in
kvm_spapr_tce_attach_iommu_group() they are not sufficient to prevent
the UAF, because `stt` is used outside the locked regions.

With an artifcial delay after the fdput() and a userspace program which
triggers the race, KASAN detects the UAF:

  BUG: KASAN: slab-use-after-free in kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm]
  Read of size 4 at addr c[PII_REDACTED]52c30 by task kvm-vfio/2505
  CPU: 54 PID: 2505 Comm: kvm-vfio Not tainted 6.10.0-rc3-next-20240612-dirty #1
  Hardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV
  Call Trace:
    dump_stack_lvl+0xb4/0x108 (unreliable)
    print_report+0x2b4/0x6ec
    kasan_report+0x118/0x2b0
    __asan_load4+0xb8/0xd0
    kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm]
    kvm_vfio_set_attr+0x524/0xac0 [kvm]
    kvm_device_ioctl+0x144/0x240 [kvm]
    sys_ioctl+0x62c/0x1810
    system_call_exception+0x190/0x440
    system_call_vectored_common+0x15c/0x2ec
  ...
  Freed by task 0:
   ...
   kfree+0xec/0x3e0
   release_spapr_tce_table+0xd4/0x11c [kvm]
   rcu_core+0x568/0x16a0
   handle_softirqs+0x23c/0x920
   do_softirq_own_stack+0x6c/0x90
   do_softirq_own_stack+0x58/0x90
   __irq_exit_rcu+0x218/0x2d0
   irq_exit+0x30/0x80
   arch_local_irq_restore+0x128/0x230
   arch_local_irq_enable+0x1c/0x30
   cpuidle_enter_state+0x134/0x5cc
   cpuidle_enter+0x6c/0xb0
   call_cpuidle+0x7c/0x100
   do_idle+0x394/0x410
   cpu_startup_entry+0x60/0x70
   start_secondary+0x3fc/0x410
   start_secondary_prolog+0x10/0x14

Fix it by delaying the fdput() until `stt` is no longer in use, which
is effectively the entire function. To keep the patch minimal add a call
to fdput() at each of the existing return paths. Future work can convert
the function to goto or __cleanup style cleanup.

With the fix in place the test case no longer triggers the UAF.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/4cdf6926f443c84f680213c7aafbe6f91a5fcbc0; https://git.kernel.org/stable/c/5f856023971f97fff74cfaf21b48ec320147b50a; https://git.kernel.org/stable/c/82c7a4cf14aa866f8f7f09e662b02eddc49ee0bf
CVE: CVE-2024-41071
Published: 2024-07-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-41072
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: wext: add extra SIOCSIWSCAN data check

In 'cfg80211_wext_siwscan()', add extra check whether number of
channels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed
IW_MAX_FREQUENCIES and reject invalid request with -EINVAL otherwise.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/001120ff0c9e3557dee9b5ee0d358e0fc189996f; https://git.kernel.org/stable/c/35cee10ccaee5bd451a480521bbc25dc9f07fa5b; https://git.kernel.org/stable/c/6295bad58f988eaafcf0e6f8b198a580398acb3b
CVE: CVE-2024-41073
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme: avoid double free special payload

If a discard request needs to be retried, and that retry may fail before
a new special payload is added, a double free will result. Clear the
RQF_SPECIAL_LOAD when the request is cleaned.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/1b9fd1265fac85916f90b4648de02adccdb7220b; https://git.kernel.org/stable/c/882574942a9be8b9d70d13462ddacc80c4b385ba; https://git.kernel.org/stable/c/ae84383c96d6662c24697ab6b44aae855ab670aa
CVE: CVE-2024-41074
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Set object to close if ondemand_id < 0 in copen

If copen is maliciously called in the user mode, it may delete the request
corresponding to the random id. And the request may have not been read yet.

Note that when the object is set to reopen, the open request will be done
with the still reopen state in above case. As a result, the request
corresponding to this object is always skipped in select_req function, so
the read request is never completed and blocks other process.

Fix this issue by simply set object to close if its id < 0 in copen.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0845c553db11c84ff53fccd59da11b6d6ece4a60; https://git.kernel.org/stable/c/4f8703fb3482f92edcfd31661857b16fec89c2c0; https://git.kernel.org/stable/c/703bea37d13e4ccdafd17ae7c4cb583752ba7663
CVE: CVE-2024-41075
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

cachefiles: add consistency check for copen/cread

This prevents malicious processes from completing random copen/cread
requests and crashing the system. Added checks are listed below:

  * Generic, copen can only complete open requests, and cread can only
    complete read requests.
  * For copen, ondemand_id must not be 0, because this indicates that the
    request has not been read by the daemon.
  * For cread, the object corresponding to fd and req should be the same.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539; https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a; https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a
CVE: CVE-2024-41076
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

NFSv4: Fix memory leak in nfs4_set_security_label

We leak nfs_fattr and nfs4_label every time we set a security xattr.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/899604a7c[PII_REDACTED]41caff9ee3dd8193d984c; https://git.kernel.org/stable/c/aad11473f8f4be3df86461081ce35ec5b145ba68; https://git.kernel.org/stable/c/b[PII_REDACTED]9e64f5de1e8db5bb75870f1eb1c6e
CVE: CVE-2024-41077
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

null_blk: fix validation of block size

Block size should be between 512 and PAGE_SIZE and be a power of 2. The current
check does not validate this, so update the check.

Without this patch, null_blk would Oops due to a null pointer deref when
loaded with bs=1536 [1].


[axboe: remove unnecessary braces and != 0 check]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/08f03186b96e25e3154916a2e70732557c770ea7; https://git.kernel.org/stable/c/2772ed2fc075eef7df3789906fc9dae01e4e132e; https://git.kernel.org/stable/c/9625afe1dd4a158a14bb50f81af9e2dac634c0b1
CVE: CVE-2024-41078
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix quota root leak after quota disable failure

If during the quota disable we fail when cleaning the quota tree or when
deleting the root from the root tree, we jump to the 'out' label without
ever dropping the reference on the quota root, resulting in a leak of the
root since fs_info->quota_root is no longer pointing to the root (we have
set it to NULL just before those steps).

Fix this by always doing a btrfs_put_root() call under the 'out' label.
This is a problem that exists since qgroups were first added in 2012 by
commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but
back then we missed a kfree on the quota root and free_extent_buffer()
calls on its root and commit root nodes, since back then roots were not
yet reference counted.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/5ef3961682e5310f2221bae99bcf9f5d0f4b0d51; https://git.kernel.org/stable/c/7dd6a5b96157a21245566b21fd58276a214357ff; https://git.kernel.org/stable/c/8a69529f22590b67bb018de9acbcf94abc8603cf
CVE: CVE-2024-41079
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

nvmet: always initialize cqe.result

The spec doesn't mandate that the first two double words (aka results)
for the command queue entry need to be set to 0 when they are not
used (not specified). Though, the target implemention returns 0 for TCP
and FC but not for RDMA.

Let's make RDMA behave the same and thus explicitly initializing the
result field. This prevents leaking any data from the stack.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0990e8a863645496b9e3f91cfcfd63cd95c80319; https://git.kernel.org/stable/c/10967873b[PII_REDACTED]7a071954be8b54f0f8e4d; https://git.kernel.org/stable/c/30d35b24b7957922f81cfdaa66f2e1b1e9b9aed2
CVE: CVE-2024-41080
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix possible deadlock in io_register_iowq_max_workers()

The io_register_iowq_max_workers() function calls io_put_sq_data(),
which acquires the sqd->lock without releasing the uring_lock.
Similar to the commit 009ad9f0c6ee ("io_uring: drop ctx->uring_lock
before acquiring sqd->lock"), this can lead to a potential deadlock
situation.

To resolve this issue, the uring_lock is released before calling
io_put_sq_data(), and then it is re-acquired after the function call.

This change ensures that the locks are acquired in the correct
order, preventing the possibility of a deadlock.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/73254a297c2dd094abec7c9efee32455ae875bdf; https://git.kernel.org/stable/c/950ac86cff338ab56e2eaf611f4936ee34893b63; https://git.kernel.org/stable/c/97ed7ff58de66c544692b3c2b988f3f594348de0
CVE: CVE-2024-41081
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ila: block BH in ila_output()

As explained in commit[PII_REDACTED]d6 ("tipc: block BH
before using dst_cache"), net/core/dst_cache.c
helpers need to be called with BH disabled.

ila_output() is called from lwtunnel_output()
possibly from process context, and under rcu_read_lock().

We might be interrupted by a softirq, re-enter ila_output()
and corrupt dst_cache data structures.

Fix the race by using local_bh_disable().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/522c3336c2025818fa05e9daf0ac35711e55e316; https://git.kernel.org/stable/c/7435bd2f84a25aba[PII_REDACTED]61b3795ba782da; https://git.kernel.org/stable/c/[PII_REDACTED]1c6476eb07f4c66624bdd1b42f758a
CVE: CVE-2024-41082
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme-fabrics: use reserved tag for reg read/write command

In some scenarios, if too many commands are issued by nvme command in
the same time by user tasks, this may exhaust all tags of admin_q. If
a reset (nvme reset or IO timeout) occurs before these commands finish,
reconnect routine may fail to update nvme regs due to insufficient tags,
which will cause kernel hang forever. In order to workaround this issue,
maybe we can let reg_read32()/reg_read64()/reg_write32() use reserved
tags. This maybe safe for nvmf:

1. For the disable ctrl path,  we will not issue connect command
2. For the enable ctrl / fw activate path, since connect and reg_xx()
   are called serially.

So the reserved tags may still be enough while reg_xx() use reserved tags.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/165da9c67a26f08c9b956c15d701da7690f45bcb; https://git.kernel.org/stable/c/7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa; https://git.kernel.org/stable/c/165da9c67a26f08c9b956c15d701da7690f45bcb
CVE: CVE-2024-41671
Published: 2024-07-29
Description: Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.
CVSS Score: 8.3 (HIGH)
CWE: CWE-444
References: https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33; https://github.com/twisted/twisted/commit/4a930de12fb67e88fefcb[PII_REDACTED]f42b27abc; https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7
CVE: CVE-2024-41676
Published: 2024-07-29
Description: Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases.
But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/OpenMage/magento-lts/commit/484cf8afc550e98bbf2c03fbb29a8450a32e7948; https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5vrp-638w-p8m2; https://github.com/OpenMage/magento-lts/commit/484cf8afc550e98bbf2c03fbb29a8450a32e7948
CVE: CVE-2024-41799
Published: 2024-07-29
Description: tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme files could be uploaded via tgstation-server (requiring a separate, isolated privilege) or some other means. A server configured to execute in BYOND's trusted security level (requiring a third separate, isolated privilege OR being set by another user) could lead to this escalating into remote code execution via BYOND's shell() proc. The ability to execute this kind of attack is a known side effect of having privileged TGS users, but normally requires multiple privileges with known weaknesses. This vector is not intentional as it does not require control over the where deployment code is sourced from and _may_ not require remote write access to an instance's `Configuration` directory. This problem is fixed in versions 6.8.0 and above.
CVSS Score: 8.4 (HIGH)
CWE: CWE-22
References: https://github.com/tgstation/tgstation-server/commit/374852fe5ae306415eb5aafb2d16b06897d7afe4; https://github.com/tgstation/tgstation-server/pull/1835; https://github.com/tgstation/tgstation-server/security/advisories/GHSA-c3h4-9gc2-f7h4
CVE: CVE-2023-52887
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new

This patch enhances error handling in scenarios with RTS (Request to
Send) messages arriving closely. It replaces the less informative WARN_ON_ONCE
backtraces with a new error handling method. This provides clearer error
messages and allows for the early termination of problematic sessions.
Previously, sessions were only released at the end of j1939_xtp_rx_rts().

Potentially this could be reproduced with something like:
testj1939 -r vcan0:0x80 &
while true; do
	# send first RTS
	cansend vcan0 18EC8090#[PII_REDACTED];
	# send second RTS
	cansend vcan0 18EC8090#[PII_REDACTED];
	# send abort
	cansend vcan0 18EC8090#ff[PII_REDACTED]2301;
done
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/0bc0a7416ea73f79f915c9a05ac0858dff65cfed; https://git.kernel.org/stable/c/1762ca80c2b72dd1b5821c5e347713ae696276ea; https://git.kernel.org/stable/c/177e33b655d35d72866b50aec84307119dc5f3d4
CVE: CVE-2024-41083
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_page_mkwrite() to check folio->mapping is valid

Fix netfs_page_mkwrite() to check that folio->mapping is valid once it has
taken the folio lock (as filemap_page_mkwrite() does).  Without this,
generic/247 occasionally oopses with something like the following:

    BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page

    RIP: 0010:trace_event_raw_event_netfs_folio+0x61/0xc0
    ...
    Call Trace:
     <TASK>
     ? __die_body+0x1a/0x60
     ? page_fault_oops+0x6e/0xa0
     ? exc_page_fault+0xc2/0xe0
     ? asm_exc_page_fault+0x22/0x30
     ? trace_event_raw_event_netfs_folio+0x61/0xc0
     trace_netfs_folio+0x39/0x40
     netfs_page_mkwrite+0x14c/0x1d0
     do_page_mkwrite+0x50/0x90
     do_pte_missing+0x184/0x200
     __handle_mm_fault+0x42d/0x500
     handle_mm_fault+0x121/0x1f0
     do_user_addr_fault+0x23e/0x3c0
     exc_page_fault+0xc2/0xe0
     asm_exc_page_fault+0x22/0x30

This is due to the invalidate_inode_pages2_range() issued at the end of the
DIO write interfering with the mmap'd writes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3473eb87afd402e415a8ca885b284ea0420dde25; https://git.kernel.org/stable/c/a81c98bfa40c11f8ea79b5a9b3f5fda73bfbb4d2; https://git.kernel.org/stable/c/3473eb87afd402e415a8ca885b284ea0420dde25
CVE: CVE-2024-41084
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

cxl/region: Avoid null pointer dereference in region lookup

cxl_dpa_to_region() looks up a region based on a memdev and DPA.
It wrongly assumes an endpoint found mapping the DPA is also of
a fully assembled region. When not true it leads to a null pointer
dereference looking up the region name.

This appears during testing of region lookup after a failure to
assemble a BIOS defined region or if the lookup raced with the
assembly of the BIOS defined region.

Failure to clean up BIOS defined regions that fail assembly is an
issue in itself and a fix to that problem will alleviate some of
the impact. It will not alleviate the race condition so let's harden
this path.

The behavior change is that the kernel oops due to a null pointer
dereference is replaced with a dev_dbg() message noting that an
endpoint was mapped.

Additional comments are added so that future users of this function
can more clearly understand what it provides.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/285f2a08841432fc3e498b1cd00cce5216cdf189; https://git.kernel.org/stable/c/a9e099e29e925f8b31cfe53e8a786b9796f8e453; https://git.kernel.org/stable/c/b8a40a6dbfb0150c1081384caa9bbe28ce5d5060
CVE: CVE-2024-41085
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

cxl/mem: Fix no cxl_nvd during pmem region auto-assembling

When CXL subsystem is auto-assembling a pmem region during cxl
endpoint port probing, always hit below calltrace.

 BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 RIP: 0010:cxl_pmem_region_probe+0x22e/0x360 [cxl_pmem]
 Call Trace:
  <TASK>
  ? __die+0x24/0x70
  ? page_fault_oops+0x82/0x160
  ? do_user_addr_fault+0x65/0x6b0
  ? exc_page_fault+0x7d/0x170
  ? asm_exc_page_fault+0x26/0x30
  ? cxl_pmem_region_probe+0x22e/0x360 [cxl_pmem]
  ? cxl_pmem_region_probe+0x1ac/0x360 [cxl_pmem]
  cxl_bus_probe+0x1b/0x60 [cxl_core]
  really_probe+0x173/0x410
  ? __pfx___device_attach_driver+0x10/0x10
  __driver_probe_device+0x80/0x170
  driver_probe_device+0x1e/0x90
  __device_attach_driver+0x90/0x120
  bus_for_each_drv+0x84/0xe0
  __device_attach+0xbc/0x1f0
  bus_probe_device+0x90/0xa0
  device_add+0x51c/0x710
  devm_cxl_add_pmem_region+0x1b5/0x380 [cxl_core]
  cxl_bus_probe+0x1b/0x60 [cxl_core]

The cxl_nvd of the memdev needs to be available during the pmem region
probe. Currently the cxl_nvd is registered after the endpoint port probe.
The endpoint probe, in the case of autoassembly of regions, can cause a
pmem region probe requiring the not yet available cxl_nvd. Adjust the
sequence so this dependency is met.

This requires adding a port parameter to cxl_find_nvdimm_bridge() that
can be used to query the ancestor root port. The endpoint port is not
yet available, but will share a common ancestor with its parent, so
start the query from there instead.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1d064e4fbebcf5b18dc10c1f3973487eb163b600; https://git.kernel.org/stable/c/84ec985944ef34a34a1605b93ce401aa8737af96; https://git.kernel.org/stable/c/1d064e4fbebcf5b18dc10c1f3973487eb163b600
CVE: CVE-2024-41086
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

bcachefs: Fix sb_field_downgrade validation

- bch2_sb_downgrade_validate() wasn't checking for a downgrade entry
  extending past the end of the superblock section

- for_each_downgrade_entry() is used in to_text() and needs to work on
  malformed input; it also was missing a check for a field extending
  past the end of the section
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/692aa7a54b2b28d59f24b3bf[PII_REDACTED]484b99; https://git.kernel.org/stable/c/bf920ed92ef24dcd6970c88881cd4700b3acf05b; https://git.kernel.org/stable/c/692aa7a54b2b28d59f24b3bf[PII_REDACTED]484b99