deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-28782
Published: 2024-04-03
Description: IBM QRadar Suite Software 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by an authenticated user.  IBM X-Force ID:  285698.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-256
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/285698; https://www.ibm.com/support/pages/node/7145683; https://exchange.xforce.ibmcloud.com/vulnerabilities/285698
CVE: CVE-2024-29477
Published: 2024-04-03
Description: Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://dolibarr.com; https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-29477.md; http://dolibarr.com
CVE: CVE-2024-31380
Published: 2024-04-03
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to patch the issue.This issue affects Oxygen Builder: from n/a through 4.9.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/vulnerability/oxygen/wordpress-oxygen-plugin-4-8-1-auth-remote-code-execution-rce-vulnerability?_s_id=cve; https://snicco.io/vulnerability-disclosure/oxygen/client-control-remote-code-execution-oxygen-4-8-1; https://patchstack.com/database/vulnerability/oxygen/wordpress-oxygen-plugin-4-8-1-auth-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-31390
Published: 2024-04-03
Description: : Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a through 1.7.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/articles/unpatched-authenticated-rce-in-oxygen-and-breakdance-builder?_s_id=cve; https://patchstack.com/database/vulnerability/breakdance/wordpress-breakdance-plugin-1-7-0-authenticated-remote-code-execution-rce-vulnerability?_s_id=cve; https://snicco.io/vulnerability-disclosure/breakdance/client-mode-remote-code-execution-breakdance-1-7-0?_s_id=cve
CVE: CVE-2024-3254
Published: 2024-04-03
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Internship Portal Management System 1.0. This issue affects some unknown processing of the file admin/edit_admin.php. The manipulation of the argument admin_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259103.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-04; https://vuldb.com/?ctiid.259103; https://vuldb.com/?id.259103
CVE: CVE-2024-3255
Published: 2024-04-03
Description: A vulnerability, which was classified as critical, was found in SourceCodester Internship Portal Management System 1.0. Affected is an unknown function of the file admin/edit_admin_query.php. The manipulation of the argument username/password/name/admin_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259104.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-05; https://vuldb.com/?ctiid.259104; https://vuldb.com/?id.259104
CVE: CVE-2023-25699
Published: 2024-04-03
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integration allows OS Command Injection.This issue affects VideoWhisper Live Streaming Integration: from n/a through 5.5.15.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78
References: https://patchstack.com/database/vulnerability/videowhisper-live-streaming-integration/wordpress-broadcast-live-video-live-streaming-html5-webrtc-hls-rtsp-rtmp-plugin-5-5-15-remote-code-execution-rce?_s_id=cve; https://patchstack.com/database/vulnerability/videowhisper-live-streaming-integration/wordpress-broadcast-live-video-live-streaming-html5-webrtc-hls-rtsp-rtmp-plugin-5-5-15-remote-code-execution-rce?_s_id=cve
CVE: CVE-2023-38729
Published: 2024-04-03
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to sensitive information disclosure when using ADMIN_CMD with IMPORT or EXPORT.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: https://www.ibm.com/support/pages/node/7145721; https://https://exchange.xforce.ibmcloud.com/vulnerabilities/262259; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-52296
Published: 2024-04-03
Description: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service when querying a specific UDF built-in function concurrently.  IBM X-Force ID:  278547.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://https://exchange.xforce.ibmcloud.com/vulnerabilities/278547; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7145722
CVE: CVE-2024-22360
Published: 2024-04-03
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted query on certain columnar tables.  IBM X-Force ID:  280905.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://https://exchange.xforce.ibmcloud.com/vulnerabilities/280905; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7145730
CVE: CVE-2024-24707
Published: 2024-04-03
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Cwicly Builder, SL. Cwicly allows Code Injection.This issue affects Cwicly: from n/a through 1.4.0.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/vulnerability/cwicly/wordpress-cwicly-plugin-1-4-0-2-remote-code-execution-rce-vulnerability?_s_id=cve; https://snicco.io/vulnerability-disclosure/cwicly/remote-code-execution-cwicly-1-4-0-2?_s_id=cve; https://patchstack.com/database/vulnerability/cwicly/wordpress-cwicly-plugin-1-4-0-2-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-25030
Published: 2024-04-03
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 stores potentially sensitive information in log files that could be read by a local user.  IBM X-Force ID:  281677.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-532
References: https://https://exchange.xforce.ibmcloud.com/vulnerabilities/281677; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7145725
CVE: CVE-2024-25046
Published: 2024-04-03
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service by an authenticated user using a specially crafted query.  IBM X-Force ID:  282953.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://https://exchange.xforce.ibmcloud.com/vulnerabilities/282953; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7145726
CVE: CVE-2024-25096
Published: 2024-04-03
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-6-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-6-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-27254
Published: 2024-04-03
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 federated server is vulnerable to denial of service with a specially crafted query under certain conditions.  IBM X-Force ID:  283813.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://https://exchange.xforce.ibmcloud.com/vulnerabilities/283813; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7145727
CVE: CVE-2024-30568
Published: 2024-04-03
Description: Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Netgear-R6850%20V1.1.0.88%20Command%20Injection%28ping_test%29.md; https://www.netgear.com/about/security/; https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Netgear-R6850%20V1.1.0.88%20Command%20Injection%28ping_test%29.md
CVE: CVE-2024-30569
Published: 2024-04-03
Description: An information leak in currentsetting.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88currentsetting.htm%EF%BC%89.md; https://www.netgear.com/about/security/; https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88currentsetting.htm%EF%BC%89.md
CVE: CVE-2024-30570
Published: 2024-04-03
Description: An information leak in debuginfo.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88debuginfo.htm%EF%BC%89.md; https://www.netgear.com/about/security/; https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88debuginfo.htm%EF%BC%89.md
CVE: CVE-2024-30571
Published: 2024-04-03
Description: An information leak in the BRS_top.html component of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88BRS_top.html%EF%BC%89.md; https://www.netgear.com/about/security/; https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88BRS_top.html%EF%BC%89.md
CVE: CVE-2024-30572
Published: 2024-04-03
Description: Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntp_server parameter.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Netgear-R6850%20V1.1.0.88%20Command%20Injection%28ntp_server%29.md; https://www.netgear.com/about/security/; https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Netgear-R6850%20V1.1.0.88%20Command%20Injection%28ntp_server%29.md
CVE: CVE-2024-3256
Published: 2024-04-03
Description: A vulnerability has been found in SourceCodester Internship Portal Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/edit_activity.php. The manipulation of the argument activity_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259105 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-06; https://vuldb.com/?ctiid.259105; https://vuldb.com/?id.259105
CVE: CVE-2024-3257
Published: 2024-04-03
Description: A vulnerability was found in SourceCodester Internship Portal Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/edit_activity_query.php. The manipulation of the argument title/description/start/end leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259106 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-07; https://vuldb.com/?ctiid.259106; https://vuldb.com/?id.259106
CVE: CVE-2024-3258
Published: 2024-04-03
Description: A vulnerability was found in SourceCodester Internship Portal Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin/add_activity.php. The manipulation of the argument title/description/start/end leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259107.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-08; https://vuldb.com/?ctiid.259107; https://vuldb.com/?id.259107
CVE: CVE-2024-0394
Published: 2024-04-03
Description: Rapid7 Minerva Armor versions below 4.5.5 suffer from a privilege escalation vulnerability whereby an authenticated attacker can elevate privileges and execute arbitrary code with SYSTEM privilege.  The vulnerability is caused by the product's implementation of OpenSSL's`OPENSSLDIR` parameter where it is set to a path accessible to low-privileged users.  The vulnerability has been remediated and fixed in version 4.5.5. 

CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://www.rapid7.com/blog/post/2024/04/03/cve-2024-0394-rapid7-minerva-armor-privilege-escalation-fixed/; https://www.rapid7.com/blog/post/2024/04/03/cve-2024-0394-rapid7-minerva-armor-privilege-escalation-fixed/
CVE: CVE-2024-21870
Published: 2024-04-03
Description: A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-73
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1950; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1950; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1950
CVE: CVE-2024-22178
Published: 2024-04-03
Description: A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-73
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1951; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1951; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1951
CVE: CVE-2024-24976
Published: 2024-04-03
Description: A denial of service vulnerability exists in the OAS Engine File Data Source Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can cause the running program to stop. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-130
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1948; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1948; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1948
CVE: CVE-2024-27201
Published: 2024-04-03
Description: An improper input validation vulnerability exists in the OAS Engine User Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can lead to unexpected data in the configuration. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1949; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1949; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1949
CVE: CVE-2024-31419
Published: 2024-04-03
Description: An information disclosure flaw was found in OpenShift Virtualization. The DownwardMetrics feature was introduced to expose host metrics to virtual machine guests and is enabled by default. This issue could expose limited host metrics of a node to any guest in any namespace without being explicitly enabled by an administrator.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://access.redhat.com/security/cve/CVE-2024-31419; https://bugzilla.redhat.com/show_bug.cgi?id=2272948; https://access.redhat.com/security/cve/CVE-2024-31419
CVE: CVE-2024-31420
Published: 2024-04-03
Description: A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/security/cve/CVE-2024-31420; https://bugzilla.redhat.com/show_bug.cgi?id=2272951; https://access.redhat.com/security/cve/CVE-2024-31420
CVE: CVE-2024-3259
Published: 2024-04-03
Description: A vulnerability was found in SourceCodester Internship Portal Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/delete_activity.php. The manipulation of the argument activity_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259108.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-09; https://vuldb.com/?ctiid.259108; https://vuldb.com/?id.259108
CVE: CVE-2023-52638
Published: 2024-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock

The following 3 locks would race against each other, causing the
deadlock situation in the Syzbot bug report:

- j1939_socks_lock
- active_session_list_lock
- sk_session_queue_lock

A reasonable fix is to change j1939_socks_lock to an rwlock, since in
the rare situations where a write lock is required for the linked list
that j1939_socks_lock is protecting, the code does not attempt to
acquire any more locks. This would break the circular lock dependency,
where, for example, the current thread already locks j1939_socks_lock
and attempts to acquire sk_session_queue_lock, and at the same time,
another thread attempts to acquire j1939_socks_lock while holding
sk_session_queue_lock.

NOTE: This patch along does not fix the unregister_netdevice bug
reported by Syzbot; instead, it solves a deadlock situation to prepare
for one or more further patches to actually fix the Syzbot bug, which
appears to be a reference counting problem within the j1939 codebase.

[mkl: remove unrelated newline change]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/03358aba991668d3bb2c65b3c82aa32c36851170; https://git.kernel.org/stable/c/26dfe112ec2e95fe0099681f6aec33da13c2dd8e; https://git.kernel.org/stable/c/559b6322f9480bff68cfa98d108991e945a4f284
CVE: CVE-2023-52639
Published: 2024-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: vsie: fix race during shadow creation

Right now it is possible to see gmap->private being zero in
kvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the
fact that we add gmap->private == kvm after creation:

static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,
                               struct vsie_page *vsie_page)
{
[...]
        gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);
        if (IS_ERR(gmap))
                return PTR_ERR(gmap);
        gmap->private = vcpu->kvm;

Let children inherit the private field of the parent.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/28bb27824f25f36e5f80229a358d66ee09244082; https://git.kernel.org/stable/c/5df3b81a567eb565029563f26f374ae3803a1dfc; https://git.kernel.org/stable/c/f5572c0323cf8b4f1f[PII_REDACTED]a25b8fb8a380
CVE: CVE-2023-5755
Published: 2024-04-03
Description: Rejected reason: **REJECT** Duplicate of CVE-2023-46784. Please refer to CVE-2023-46784.
CVE: CVE-2024-26685
Published: 2024-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix potential bug in end_buffer_async_write

According to a syzbot report, end_buffer_async_write(), which handles the
completion of block device writes, may detect abnormal condition of the
buffer async_write flag and cause a BUG_ON failure when using nilfs2.

Nilfs2 itself does not use end_buffer_async_write().  But, the async_write
flag is now used as a marker by commit 7f42ec394156 ("nilfs2: fix issue
with race condition of competition between segments for dirty blocks") as
a means of resolving double list insertion of dirty blocks in
nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the
resulting crash.

This modification is safe as long as it is used for file data and b-tree
node blocks where the page caches are independent.  However, it was
irrelevant and redundant to also introduce async_write for segment summary
and super root blocks that share buffers with the backing device.  This
led to the possibility that the BUG_ON check in end_buffer_async_write
would fail as described above, if independent writebacks of the backing
device occurred in parallel.

The use of async_write for segment summary buffers has already been
removed in a previous change.

Fix this issue by removing the manipulation of the async_write flag for
the remaining super root block buffer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/2c3bdba00283a6c7a5b19481a59a730f46063803; https://git.kernel.org/stable/c/5bc09b397cbf1221f8a8aacb1152650c9195b02b; https://git.kernel.org/stable/c/626daab3811b772086aef1bf8eed3ffe6f523eff
CVE: CVE-2024-26686
Published: 2024-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats

lock_task_sighand() can trigger a hard lockup.  If NR_CPUS threads call
do_task_stat() at the same time and the process has NR_THREADS, it will
spin with irqs disabled O(NR_CPUS * NR_THREADS) time.

Change do_task_stat() to use sig->stats_lock to gather the statistics
outside of ->siglock protected section, in the likely case this code will
run lockless.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/0c35d[PII_REDACTED]c54fa1843fe7dea6fcbcdbac5; https://git.kernel.org/stable/c/27978243f165b44e342f28f449b91327944ea071; https://git.kernel.org/stable/c/3820b0fac7732a653bcc6f6ac20c1d72e697f8f6