deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-27055
Published: 2024-05-01
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-27056
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: ensure offloading TID queue exists

The resume code path assumes that the TX queue for the offloading TID
has been configured. At resume time it then tries to sync the write
pointer as it may have been updated by the firmware.

In the unusual event that no packets have been send on TID 0, the queue
will not have been allocated and this causes a crash. Fix this by
ensuring the queue exist at suspend time.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/35afffaddbe8d310dc61659da0b1a337b0d0addc; https://git.kernel.org/stable/c/4903303f25f48b5a1e34e6324c7fae9ccd6b959a; https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f
CVE: CVE-2024-27057
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend

When the system is suspended while audio is active, the
sof_ipc4_pcm_hw_free() is invoked to reset the pipelines since during
suspend the DSP is turned off, streams will be re-started after resume.

If the firmware crashes during while audio is running (or when we reset
the stream before suspend) then the sof_ipc4_set_multi_pipeline_state()
will fail with IPC error and the state change is interrupted.
This will cause misalignment between the kernel and firmware state on next
DSP boot resulting errors returned by firmware for IPC messages, eventually
failing the audio resume.
On stream close the errors are ignored so the kernel state will be
corrected on the next DSP boot, so the second boot after the DSP panic.

If sof_ipc4_trigger_pipelines() is called from sof_ipc4_pcm_hw_free() then
state parameter is SOF_IPC4_PIPE_RESET and only in this case.

Treat a forced pipeline reset similarly to how we treat a pcm_free by
ignoring error on state sending to allow the kernel's state to be
consistent with the state the firmware will have after the next boot.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3cac6eebea9b4bc5f041e157e45c76e212ad6759; https://git.kernel.org/stable/c/c40aad7c81e5fba34b70123ed7ce3397fa62a4d2; https://git.kernel.org/stable/c/d153e8b154f9746ac969c85a4e[PII_REDACTED]647c
CVE: CVE-2024-27058
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

tmpfs: fix race on handling dquot rbtree

A syzkaller reproducer found a race while attempting to remove dquot
information from the rb tree.

Fetching the rb_tree root node must also be protected by the
dqopt->dqio_sem, otherwise, giving the right timing, shmem_release_dquot()
will trigger a warning because it couldn't find a node in the tree, when
the real reason was the root node changing before the search starts:

Thread 1				Thread 2
- shmem_release_dquot()			- shmem_{acquire,release}_dquot()

- fetch ROOT				- Fetch ROOT

					- acquire dqio_sem
- wait dqio_sem

					- do something, triger a tree rebalance
					- release dqio_sem

- acquire dqio_sem
- start searching for the node, but
  from the wrong location, missing
  the node, and triggering a warning.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/0a69b6b3a026543bc215ccc866d0aea5579e6ce2; https://git.kernel.org/stable/c/617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb; https://git.kernel.org/stable/c/c7077f43f30d817d10a9f8245e51576ac114b2f0
CVE: CVE-2024-27059
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command

The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values
in the ATA ID information to calculate cylinder and head values when
creating a CDB for READ or WRITE commands.  The calculation involves
division and modulus operations, which will cause a crash if either of
these values is 0.  While this never happens with a genuine device, it
could happen with a flawed or subversive emulation, as reported by the
syzbot fuzzer.

Protect against this possibility by refusing to bind to the device if
either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID
information is 0.  This requires isd200_Initialization() to return a
negative error code when initialization fails; currently it always
returns 0 (even when there is an error).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/stable/c/014bcf41d946b36a8f0b8e9b5d9529efbb822f49; https://git.kernel.org/stable/c/284fb1003d5da111019b9e0bf99b084fd71ac133; https://git.kernel.org/stable/c/3a67d4ab9e730361d183086dfb0ddd8c61f01636
CVE: CVE-2024-27060
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()

Olliver reported that his system crashes when plugging in Thunderbolt 1
device:

 BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] PREEMPT SMP NOPTI
 RIP: 0010:tb_port_do_update_credits+0x1b/0x130 [thunderbolt]
 Call Trace:
  <TASK>
  ? __die+0x23/0x70
  ? page_fault_oops+0x171/0x4e0
  ? exc_page_fault+0x7f/0x180
  ? asm_exc_page_fault+0x26/0x30
  ? tb_port_do_update_credits+0x1b/0x130
  ? tb_switch_update_link_attributes+0x83/0xd0
  tb_switch_add+0x7a2/0xfe0
  tb_scan_port+0x236/0x6f0
  tb_handle_hotplug+0x6db/0x900
  process_one_work+0x171/0x340
  worker_thread+0x27b/0x3a0
  ? __pfx_worker_thread+0x10/0x10
  kthread+0xe5/0x120
  ? __pfx_kthread+0x10/0x10
  ret_from_fork+0x31/0x50
  ? __pfx_kthread+0x10/0x10
  ret_from_fork_asm+0x1b/0x30
  </TASK>

This is due the fact that some Thunderbolt 1 devices only have one lane
adapter. Fix this by checking for the lane 1 before we read its credits.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/440fba897c5ae32d7df1f1d609dbb19e2bba7fbb; https://git.kernel.org/stable/c/ce64ba1f6ec3439e4b4d880b4db99673f4507228; https://git.kernel.org/stable/c/d3d17e23d1a0d1f959b4fa55b35f1802d9c584fa
CVE: CVE-2024-27061
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: sun8i-ce - Fix use after free in unprepare

sun8i_ce_cipher_unprepare should be called before
crypto_finalize_skcipher_request, because client callbacks may
immediately free memory, that isn't needed anymore. But it will be
used by unprepare after free. Before removing prepare/unprepare
callbacks it was handled by crypto engine in crypto_finalize_request.

Usually that results in a pointer dereference problem during a in
crypto selftest.
 Unable to handle kernel NULL pointer dereference at
                                      virtual address [PII_REDACTED]
 Mem abort info:
   ESR = 0x[PII_REDACTED]000004
   EC = 0x25: DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
   FSC = 0x04: level 0 translation fault
 Data abort info:
   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
 user pgtable: 4k pages, 48-bit VAs, pgdp=[PII_REDACTED]16d000
 [[PII_REDACTED]] pgd=[PII_REDACTED], p4d=[PII_REDACTED]
 Internal error: Oops: [PII_REDACTED] [#1] SMP

This problem is detected by KASAN as well.
 ==================================================================
 BUG: KASAN: slab-use-after-free in sun8i_ce_cipher_do_one+0x6e8/0xf80 [sun8i_ce]
 Read of size 8 at addr ffff00000dcdc040 by task 1c15000.crypto-/373

 Hardware name: Pine64 PinePhone (1.2) (DT)
 Call trace:
  dump_backtrace+0x9c/0x128
  show_stack+0x20/0x38
  dump_stack_lvl+0x48/0x60
  print_report+0xf8/0x5d8
  kasan_report+0x90/0xd0
  __asan_load8+0x9c/0xc0
  sun8i_ce_cipher_do_one+0x6e8/0xf80 [sun8i_ce]
  crypto_pump_work+0x354/0x620 [crypto_engine]
  kthread_worker_fn+0x244/0x498
  kthread+0x168/0x178
  ret_from_fork+0x10/0x20

 Allocated by task 379:
  kasan_save_stack+0x3c/0x68
  kasan_set_track+0x2c/0x40
  kasan_save_alloc_info+0x24/0x38
  __kasan_kmalloc+0xd4/0xd8
  __kmalloc+0x74/0x1d0
  alg_test_skcipher+0x90/0x1f0
  alg_test+0x24c/0x830
  cryptomgr_test+0x38/0x60
  kthread+0x168/0x178
  ret_from_fork+0x10/0x20

 Freed by task 379:
  kasan_save_stack+0x3c/0x68
  kasan_set_track+0x2c/0x40
  kasan_save_free_info+0x38/0x60
  __kasan_slab_free+0x100/0x170
  slab_free_freelist_hook+0xd4/0x1e8
  __kmem_cache_free+0x15c/0x290
  kfree+0x74/0x100
  kfree_sensitive+0x80/0xb0
  alg_test_skcipher+0x12c/0x1f0
  alg_test+0x24c/0x830
  cryptomgr_test+0x38/0x60
  kthread+0x168/0x178
  ret_from_fork+0x10/0x20

 The buggy address belongs to the object at ffff00000dcdc000
  which belongs to the cache kmalloc-256 of size 256
 The buggy address is located 64 bytes inside of
  freed 256-byte region [ffff00000dcdc000, ffff00000dcdc100)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-476
References: https://git.kernel.org/stable/c/[PII_REDACTED]4547c149a0fc5f58e792c2752860c; https://git.kernel.org/stable/c/51a7d338c212e0640b1aca52ba6590d5bea49879; https://git.kernel.org/stable/c/dc60b25540c82fc4baa95d1458ae96ead21859e0
CVE: CVE-2024-27063
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

leds: trigger: netdev: Fix kernel panic on interface rename trig notify

Commit d5e01266e7f5 ("leds: trigger: netdev: add additional specific link
speed mode") in the various changes, reworked the way to set the LINKUP
mode in commit cee4bd16c319 ("leds: trigger: netdev: Recheck
NETDEV_LED_MODE_LINKUP on dev rename") and moved it to a generic function.

This changed the logic where, in the previous implementation the dev
from the trigger event was used to check if the carrier was ok, but in
the new implementation with the generic function, the dev in
trigger_data is used instead.

This is problematic and cause a possible kernel panic due to the fact
that the dev in the trigger_data still reference the old one as the
new one (passed from the trigger event) still has to be hold and saved
in the trigger_data struct (done in the NETDEV_REGISTER case).

On calling of get_device_state(), an invalid net_dev is used and this
cause a kernel panic.

To handle this correctly, move the call to get_device_state() after the
new net_dev is correctly set in trigger_data (in the NETDEV_REGISTER
case) and correctly parse the new dev.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/10f2af1af8ab8a7064f193446abd5579d3def7e3; https://git.kernel.org/stable/c/3f360227cb46edb2cd2494128e1e06ed5768a62e; https://git.kernel.org/stable/c/415798bc07dd1c1ae3a656aa026580816e0b9fe8
CVE: CVE-2024-27064
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: Fix a memory leak in nf_tables_updchain

If nft_netdev_register_hooks() fails, the memory associated with
nft_stats is not freed, causing a memory leak.

This patch fixes it by moving nft_stats_alloc() down after
nft_netdev_register_hooks() succeeds.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/4e4623a4f6e133e671f65f9ac493bddaaf63e250; https://git.kernel.org/stable/c/79846fdcc548d617b0b321addc6a3821d3b75b20; https://git.kernel.org/stable/c/7eaf837a4eb5f74561e2486972e7f5184b613f6e
CVE: CVE-2024-27065
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: do not compare internal table flags on updates

Restore skipping transaction if table update does not modify flags.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/2531f907d3e40a6173090f10670ae76d117ab27b; https://git.kernel.org/stable/c/3443e57654f90c9a843ab6a6040c10709fd033aa; https://git.kernel.org/stable/c/4a0e7f2decbf9bd72461226f1f5f7dcc4b08f139
CVE: CVE-2024-27066
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

virtio: packed: fix unmap leak for indirect desc table

When use_dma_api and premapped are true, then the do_unmap is false.

Because the do_unmap is false, vring_unmap_extra_packed is not called by
detach_buf_packed.

  if (unlikely(vq->do_unmap)) {
                curr = id;
                for (i = 0; i < state->num; i++) {
                        vring_unmap_extra_packed(vq,
                                                 &vq->packed.desc_extra[curr]);
                        curr = vq->packed.desc_extra[curr].next;
                }
  }

So the indirect desc table is not unmapped. This causes the unmap leak.

So here, we check vq->use_dma_api instead. Synchronously, dma info is
updated based on use_dma_api judgment

This bug does not occur, because no driver use the premapped with
indirect.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140; https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e; https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd
CVE: CVE-2024-27067
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

xen/evtchn: avoid WARN() when unbinding an event channel

When unbinding a user event channel, the related handler might be
called a last time in case the kernel was built with
CONFIG_DEBUG_SHIRQ. This might cause a WARN() in the handler.

Avoid that by adding an "unbinding" flag to struct user_event which
will short circuit the handler.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/35485dad6e28f9b17884764d4692b1655cb848d0; https://git.kernel.org/stable/c/51c23bd691c0f1fb95b29731c356c6fd69925d17; https://git.kernel.org/stable/c/99e425032c6ec13584d3cd33846e0c7307501b47
CVE: CVE-2024-27068
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error handling path

If devm_krealloc() fails, then 'efuse' is leaking.
So free it to avoid a leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2db869da91afd48e5b9ec76814709be49662b07d; https://git.kernel.org/stable/c/9b[PII_REDACTED]1800dd934609384b1aca7c6ad218; https://git.kernel.org/stable/c/a37f3652bee468f879d35fe2da9ede3f1dcbb7be
CVE: CVE-2024-27069
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ovl: relax WARN_ON in ovl_verify_area()

syzbot hit an assertion in copy up data loop which looks like it is
the result of a lower file whose size is being changed underneath
overlayfs.

This type of use case is documented to cause undefined behavior, so
returning EIO error for the copy up makes sense, but it should not be
causing a WARN_ON assertion.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/77a28aa[PII_REDACTED]24ad56daf8f4f17d58ee48e; https://git.kernel.org/stable/c/c3c85aefc0da1e5074a06c682542a54ccc99bdca; https://git.kernel.org/stable/c/77a28aa[PII_REDACTED]24ad56daf8f4f17d58ee48e
CVE: CVE-2024-27070
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault

syzbot reports a f2fs bug as below:

BUG: KASAN: slab-use-after-free in f2fs_filemap_fault+0xd1/0x2c0 fs/f2fs/file.c:49
Read of size 8 at addr ffff88807bb22680 by task syz-executor184/5058

CPU: 0 PID: 5058 Comm: syz-executor184 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x163/0x540 mm/kasan/report.c:488
 kasan_report+0x142/0x170 mm/kasan/report.c:601
 f2fs_filemap_fault+0xd1/0x2c0 fs/f2fs/file.c:49
 __do_fault+0x131/0x450 mm/memory.c:4376
 do_shared_fault mm/memory.c:4798 [inline]
 do_fault mm/memory.c:4872 [inline]
 do_pte_missing mm/memory.c:3745 [inline]
 handle_pte_fault mm/memory.c:5144 [inline]
 __handle_mm_fault+0x23b7/0x72b0 mm/memory.c:5285
 handle_mm_fault+0x27e/0x770 mm/memory.c:5450
 do_user_addr_fault arch/x86/mm/fault.c:1364 [inline]
 handle_page_fault arch/x86/mm/fault.c:1507 [inline]
 exc_page_fault+0x456/0x870 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570

The root cause is: in f2fs_filemap_fault(), vmf->vma may be not alive after
filemap_fault(), so it may cause use-after-free issue when accessing
vmf->vma->vm_flags in trace_f2fs_filemap_fault(). So it needs to keep vm_flags
in separated temporary variable for tracepoint use.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/8186e16a766d709a08f188d2f4e84098f364bea1; https://git.kernel.org/stable/c/897761d16564e899faecb9381b[PII_REDACTED]081f; https://git.kernel.org/stable/c/eb70d5a6c932d9d23f4bb3e7b83782c21ac4b064
CVE: CVE-2024-27071
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

backlight: hx8357: Fix potential NULL pointer dereference

The "im" pins are optional. Add missing check in the hx8357_probe().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/67e578c8ff2d7df03bf8ca9a7f5436b1796f6ad1; https://git.kernel.org/stable/c/b1ba8bcb2d1ffce11b308ce166c9cc28d989e3b9; https://git.kernel.org/stable/c/67e578c8ff2d7df03bf8ca9a7f5436b1796f6ad1
CVE: CVE-2024-27072
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

media: usbtv: Remove useless locks in usbtv_video_free()

Remove locks calls in usbtv_video_free() because
are useless and may led to a deadlock as reported here:
https://syzkaller.appspot.com/x/bisect.txt?x=166dc872180000
Also remove usbtv_stop() call since it will be called when
unregistering the device.

Before 'c838530d230b' this issue would only be noticed if you
disconnect while streaming and now it is noticeable even when
disconnecting while not streaming.


[hverkuil: fix minor spelling mistake in log message]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/3e7d82ebb86e94643bdb30b0b5b077ed27dce1c2; https://git.kernel.org/stable/c/4ec4641df57cbdfdc51bb4959afcdbcf5003ddb9; https://git.kernel.org/stable/c/65e6a2773d655172143cc0b927cdc[PII_REDACTED]5
CVE: CVE-2024-27073
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

media: ttpci: fix two memleaks in budget_av_attach

When saa7146_register_device and saa7146_vv_init fails, budget_av_attach
should free the resources it allocates, like the error-handling of
ttpci_budget_init does. Besides, there are two fixme comment refers to
such deallocations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1597cd1a88cfcdc4bf8b1b44cd458fed9a5a5d63; https://git.kernel.org/stable/c/24e51d6eb578b82ff292927f14b9f5ec05a46beb; https://git.kernel.org/stable/c/55ca0c7eae8499bb96f4e5d9b26af95e89c4e6a0
CVE: CVE-2024-27074
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

media: go7007: fix a memleak in go7007_load_encoder

In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without
a deallocation thereafter. After the following call chain:

saa7134_go7007_init
  |-> go7007_boot_encoder
        |-> go7007_load_encoder
  |-> kfree(go)

go is freed and thus bounce is leaked.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/291cda0b805fc0d6e90d[PII_REDACTED]30c8667159; https://git.kernel.org/stable/c/7405a0d[PII_REDACTED]e9ae834e7d84f9d163731a4; https://git.kernel.org/stable/c/790fa2c04dfb9f095ec372bf17909424d6e864b3
CVE: CVE-2024-27075
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

media: dvb-frontends: avoid stack overflow warnings with clang

A previous patch worked around a KASAN issue in stv0367, now a similar
problem showed up with clang:

drivers/media/dvb-frontends/stv0367.c:1222:12: error: stack frame size (3624) exceeds limit (2048) in 'stv0367ter_set_frontend' [-Werror,-Wframe-larger-than]
 1214 | static int stv0367ter_set_frontend(struct dvb_frontend *fe)

Rework the stv0367_writereg() function to be simpler and mark both
register access functions as noinline_for_stack so the temporary
i2c_msg structures do not get duplicated on the stack when KASAN_STACK
is enabled.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/107052a8cfeff3a[PII_REDACTED]2b4f052e4860a8a; https://git.kernel.org/stable/c/7a4cf27d1f0538f779bf31b8c99eda394e277119; https://git.kernel.org/stable/c/8fad9c5bb00d3a9508d18bbfe832e33a47377730
CVE: CVE-2024-27076
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak

Free the memory allocated in v4l2_ctrl_handler_init on release.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/42492b00156c03a79fd4851190aa63045d6a15ce; https://git.kernel.org/stable/c/4797a3dd46f220e6d83daf54d70c5b33db6deb01; https://git.kernel.org/stable/c/5d9fe604bf9b5b09d2215225df55f22a4cbbc684
CVE: CVE-2024-27077
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity

The entity->name (i.e. name) is allocated in v4l2_m2m_register_entity
but isn't freed in its following error-handling paths. This patch
adds such deallocation to prevent memleak of entity->name.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0175f2d34c85744f9ad6554f696cf0afb5bd04e4; https://git.kernel.org/stable/c/0c9550b032de48d6a7fa6a4ddc09699d64d9300d; https://git.kernel.org/stable/c/3dd8abb0ed0e0a7c66d6d677c86ccb188cc39333
CVE: CVE-2024-27078
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-tpg: fix some memleaks in tpg_alloc

In tpg_alloc, resources should be deallocated in each and every
error-handling paths, since they are allocated in for statements.
Otherwise there would be memleaks because tpg_free is called only when
tpg_alloc return 0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0de691ff547d86dd54c24b40a81f9c925df8dd77; https://git.kernel.org/stable/c/31096da07933598da8522c54bd007376fb152a09; https://git.kernel.org/stable/c/4c86c772fef06f5d7a66151bac42366825db0941
CVE: CVE-2024-27079
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Fix NULL domain on device release

In the kdump kernel, the IOMMU operates in deferred_attach mode. In this
mode, info->domain may not yet be assigned by the time the release_device
function is called. It leads to the following crash in the crash kernel:

    BUG: kernel NULL pointer dereference, address:[PII_REDACTED]00003c
    ...
    RIP: 0010:do_raw_spin_lock+0xa/0xa0
    ...
    _raw_spin_lock_irqsave+0x1b/0x30
    intel_iommu_release_device+0x96/0x170
    iommu_deinit_device+0x39/0xf0
    __iommu_group_remove_device+0xa0/0xd0
    iommu_bus_notifier+0x55/0xb0
    notifier_call_chain+0x5a/0xd0
    blocking_notifier_call_chain+0x41/0x60
    bus_notify+0x34/0x50
    device_del+0x269/0x3d0
    pci_remove_bus_device+0x77/0x100
    p2sb_bar+0xae/0x1d0
    ...
    i801_probe+0x423/0x740

Use the release_domain mechanism to fix it. The scalable mode context
entry which is not part of release domain should be cleared in
release_device().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/333fe86968482ca701c609af590003bcea450e8f; https://git.kernel.org/stable/c/81e921fd321614c2ad8ac333b041aae1da7a1c6d; https://git.kernel.org/stable/c/333fe86968482ca701c609af590003bcea450e8f