deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-8607
Published: 2024-09-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oceanic Software ValeApp allows SQL Injection.This issue affects ValeApp: before v2.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1562
CVE: CVE-2024-8608
Published: 2024-09-27
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Oceanic Software ValeApp allows Stored XSS.This issue affects ValeApp: before v2.0.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-24-1562
CVE: CVE-2024-8609
Published: 2024-09-27
Description: Insertion of Sensitive Information into Log File vulnerability in Oceanic Software ValeApp allows Query System for Information.This issue affects ValeApp: before v2.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.usom.gov.tr/bildirim/tr-24-1562
CVE: CVE-2024-8643
Published: 2024-09-27
Description: Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking.This issue affects ValeApp: before v2.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384, CWE-384
References: https://www.usom.gov.tr/bildirim/tr-24-1562
CVE: CVE-2024-8644
Published: 2024-09-27
Description: Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking).This issue affects ValeApp: before v2.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-315, CWE-312
References: https://www.usom.gov.tr/bildirim/tr-24-1562
CVE: CVE-2024-9279
Published: 2024-09-27
Description: A vulnerability, which was classified as problematic, was found in funnyzpc Mee-Admin up to 1.6. This affects an unknown part of the file /mee/index of the component User Center. The manipulation of the argument User Nickname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/Armnying/Vulnerability-recurrence-sortin/blob/main/Mee-admin-xss.md; https://vuldb.com/?ctiid.278661; https://vuldb.com/?id.278661
CVE: CVE-2024-9280
Published: 2024-09-27
Description: A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the function fileUpload of the file FileUploadKit.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/Arvin-Shi/111/issues/1; https://vuldb.com/?ctiid.278662; https://vuldb.com/?id.278662
CVE: CVE-2024-46441
Published: 2024-09-27
Description: An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php (called from app/admin/controller/ypay/Home.php). The file extension of an uncompressed file is not checked.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/kacins/YPay/issues/4
CVE: CVE-2024-46802
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: added NULL check at start of dc_validate_stream

[Why]
prevent invalid memory access

[How]
check if dc and stream are NULL
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/154a50bf4221a6a6ccf88d565b8184da7c40a2dd; https://git.kernel.org/stable/c/26c56049cc4f1705b498df[PII_REDACTED]92a4b0d5; https://git.kernel.org/stable/c/356fcce9cdbfe338a275e9e1836adfdd7f5c52a9
CVE: CVE-2024-46803
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Check debug trap enable before write dbg_ev_file

In interrupt context, write dbg_ev_file will be run by work queue. It
will cause write dbg_ev_file execution after debug_trap_disable, which
will cause NULL pointer access.
v2: cancel work "debug_event_workarea" before set dbg_ev_file as NULL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/547033b593063eb85bfdf9b25a5f1b8fd1911be2; https://git.kernel.org/stable/c/820dcbd38a77bd5fdc4236d521c1c122841227d0; https://git.kernel.org/stable/c/e6ea3b8fe[PII_REDACTED]47fe54dd2db8155fdafd8
CVE: CVE-2024-46804
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add array index check for hdcp ddc access

[Why]
Coverity reports OVERRUN warning. Do not check if array
index valid.

[How]
Check msg_id valid and valid array index.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/0ee4387c5a4b57ec733c3fb4365188d5979cd9c7; https://git.kernel.org/stable/c/2a63c90c7a90ab2bd23deebc2814fc5b52abf6d2; https://git.kernel.org/stable/c/4e70c0f5251c25885c31ee84a31f99a01f7cf50e
CVE: CVE-2024-46805
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix the waring dereferencing hive

Check the amdgpu_hive_info *hive that maybe is NULL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/01cd55b971131b07b7ff8d622fa93bb4f8be07df; https://git.kernel.org/stable/c/1940708ccf5aff76de4e0b399f99267c93a89193; https://git.kernel.org/stable/c/4ab720b6aa1ef5e71db1e534b5b45c80ac4ec58a
CVE: CVE-2024-46806
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix the warning division or modulo by zero

Checks the partition mode and returns an error for an invalid mode.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/stable/c/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c; https://git.kernel.org/stable/c/a01618adcba78c6bd6c4557a4a5e32f58b658cd1; https://git.kernel.org/stable/c/d116bb921e8b104f45d1f30a473ea99ef4262b9a
CVE: CVE-2024-46807
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/amdgpu: Check tbo resource pointer

Validate tbo resource pointer, skip if NULL
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2be1eb6304d9623ba21dd6f3e68ffb753a759635; https://git.kernel.org/stable/c/4dfec5f5501a27e0a0da00e136d65ef9011ded4c; https://git.kernel.org/stable/c/6cd2b872643bb29bba01a8ac739138db7bd79007
CVE: CVE-2024-46808
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range

[Why & How]
ASSERT if return NULL from kcalloc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/5524fa301ba649f8cf00848f91468e0ba7e4f24c; https://git.kernel.org/stable/c/ca0b0b0a22306f2e51105ac48f4a09c2fbbb504e
CVE: CVE-2024-46809
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check BIOS images before it is used

BIOS images may fail to load and null checks are added before they are
used.

This fixes 6 NULL_RETURNS issues reported by Coverity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4fcd903a5d9e897420d7d8b3ca55c6e5dbb47379; https://git.kernel.org/stable/c/8b0ddf19cca2a352b2a7e01d99d3ba949a99c84c; https://git.kernel.org/stable/c/c5cb98554c4c6265b494d040c1c62f1db2fa28a6
CVE: CVE-2024-46810
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ

Make sure the connector is fully initialized before signalling any
HPD events via drm_kms_helper_hotplug_event(), otherwise this may
lead to NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/162e48cb1d84c2c966b649b8ac5c9d4f75f6d44f; https://git.kernel.org/stable/c/1fb[PII_REDACTED]783b424aa4712f0a27a9eaf5a8; https://git.kernel.org/stable/c/9d567126474e68f959b2c2543c375f3bb32e948a
CVE: CVE-2024-46811
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box

[Why]
Coverity reports OVERRUN warning. soc.num_states could
be 40. But array range of bw_params->clk_table.entries is 8.

[How]
Assert if soc.num_states greater than 8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/188fd1616ec43033cedbe343b6579e9921e2d898; https://git.kernel.org/stable/c/4003bac784380fed1f94f197350567eaa73a409d; https://git.kernel.org/stable/c/aba188d6f4ebaf52acf13f204db2bd2c22072504
CVE: CVE-2024-46812
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration

[Why]
Coverity reports Memory - illegal accesses.

[How]
Skip inactive planes.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/2fd32a65f2e78eff0862c8fdf7815ca6bb44fb2e; https://git.kernel.org/stable/c/3300a039caf850376bc3416c808cd8879da412bb; https://git.kernel.org/stable/c/4331ae2788e779b11f3aad40c04be6c64831f2a2
CVE: CVE-2024-46813
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check link_index before accessing dc->links[]

[WHY & HOW]
dc->links[] has max size of MAX_LINKS and NULL is return when trying to
access with out-of-bound index.

This fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/032c5407a608ac3b2a98bf4fbda27d12c20c5887; https://git.kernel.org/stable/c/8aa2864044b9d13e95fe224f32e808afbf79ecdf; https://git.kernel.org/stable/c/ac04759b4a002969cf0f1384f1b8bb2001cfa782
CVE: CVE-2024-46814
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check msg_id before processing transcation

[WHY & HOW]
HDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid
array index, and it needs checking before used.

This fixes 4 OVERRUN issues reported by Coverity.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/0147505f08220c89b3a9c90eb608191276e263a8; https://git.kernel.org/stable/c/6590643c5de74098d27933b7d224d5ac065d7755; https://git.kernel.org/stable/c/[PII_REDACTED]70060023d3f8a8ace895d710e268f4
CVE: CVE-2024-46815
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]

[WHY & HOW]
num_valid_sets needs to be checked to avoid a negative index when
accessing reader_wm_sets[num_valid_sets - 1].

This fixes an OVERRUN issue reported by Coverity.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/21f9cb44f8c60bf6c26487d428b1a09ad3e8aebf; https://git.kernel.org/stable/c/6a4a08e45e614cfa7a56498cdfaeb7fae2f07fa0; https://git.kernel.org/stable/c/7c47dd2e92341f2989ab73dbed07f8894593ad7b
CVE: CVE-2024-46816
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links

[Why]
Coverity report OVERRUN warning. There are
only max_links elements within dc->links. link
count could up to AMDGPU_DM_MAX_DISPLAY_INDEX 31.

[How]
Make sure link count less than max_links.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/13080d052c995aee14695a5b740c245121eb2bcc; https://git.kernel.org/stable/c/36c39a8dcce210649f2f45f252abaa09fcc1ae87; https://git.kernel.org/stable/c/c[PII_REDACTED]2fd31251f0957fafc9e90d9a247fd
CVE: CVE-2024-46817
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6

[Why]
Coverity reports OVERRUN warning. Should abort amdgpu_dm
initialize.

[How]
Return failure to amdgpu_dm_init.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/21bbb39863f10f5fb4bf772d15b07d5d13590e9d; https://git.kernel.org/stable/c/28b515c458aa9c92bfcb99884c94713a5f471cea; https://git.kernel.org/stable/c/754321ed63f0a4a31252ca72e0bd89a9e1888018
CVE: CVE-2024-46818
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check gpio_id before used as array index

[WHY & HOW]
GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore
should be checked in advance.

This fixes 5 OVERRUN issues reported by Coverity.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/0184cca30cad74d88f5c875d4e26999e26325700; https://git.kernel.org/stable/c/08e7755f754e3d2cef7d3a7da538d33526bd6f7c; https://git.kernel.org/stable/c/276e3fd93e3beb5894eb1cc8480f9f417d51524d
CVE: CVE-2024-46819
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: the warning dereferencing obj for nbio_v7_4

if ras_manager obj null, don't print NBIO err data
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/130c2dc75c8c40acc3c96ededea6af80e03c14b8; https://git.kernel.org/stable/c/614564a5b28983de53b23a358ebe6c483a2aa21e; https://git.kernel.org/stable/c/70e8ec21fcb8c51446899d3bfe416b31adfa3661
CVE: CVE-2024-46820
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend

We do not directly enable/disable VCN IRQ in vcn 5.0.0.
And we do not handle the IRQ state as well. So the calls to
disable IRQ and set state are removed. This effectively gets
rid of the warining of
      "WARN_ON(!amdgpu_irq_enabled(adev, src, type))"
in amdgpu_irq_put().
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/10fe1a79cd1bff3048e13120e93c02f8ecd05e9d; https://git.kernel.org/stable/c/aa92264ba6fd4fb570002f[PII_REDACTED]1316e7ae
CVE: CVE-2024-46821
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: Fix negative array index read

Avoid using the negative values
for clk_idex as an index into an array pptable->DpmDescriptor.

V2: fix clk_index return check (Tim Huang)
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/06a3810010b525b9958424e344f0c25b09e128fa; https://git.kernel.org/stable/c/4711b1347cb9f0c3083da6d87c624d75f9bd1d50; https://git.kernel.org/stable/c/60f4a4bc3329e5cb8c4df0cc961f0d5ffd96e22d
CVE: CVE-2024-46822
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry

In a review discussion of the changes to support vCPU hotplug where
a check was added on the GICC being enabled if was online, it was
noted that there is need to map back to the cpu and use that to index
into a cpumask. As such, a valid ID is needed.

If an MPIDR check fails in acpi_map_gic_cpu_interface() it is possible
for the entry in cpu_madt_gicc[cpu] == NULL.  This function would
then cause a NULL pointer dereference.   Whilst a path to trigger
this has not been established, harden this caller against the
possibility.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/[PII_REDACTED]c70038eb6b686cba5f1ce48ebb9cdd; https://git.kernel.org/stable/c/40cae0df42e5e7f7a1c0f32deed9c4027c1ba94e; https://git.kernel.org/stable/c/4c3b21204abb4fa3ab310fbbb5cf7f0e85f3a1bc
CVE: CVE-2024-46823
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

kunit/overflow: Fix UB in overflow_allocation_test

The 'device_name' array doesn't exist out of the
'overflow_allocation_test' function scope. However, it is being used as
a driver name when calling 'kunit_driver_create' from
'kunit_device_register'. It produces the kernel panic with KASAN
enabled.

Since this variable is used in one place only, remove it and pass the
device name into kunit_device_register directly as an ascii string.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/92e9bac18124682c4b99ede9ee3bcdd68f121e92; https://git.kernel.org/stable/c/d1207f07decc66546a7fa463d2f335a856c986ef; https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
CVE: CVE-2024-46824
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

iommufd: Require drivers to supply the cache_invalidate_user ops

If drivers don't do this then iommufd will oops invalidation ioctls with
something like:

  Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
  Mem abort info:
    ESR = 0x[PII_REDACTED]000004
    EC = 0x21: IABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
    FSC = 0x04: level 0 translation fault
  user pgtable: 4k pages, 48-bit VAs, pgdp=[PII_REDACTED]
  [[PII_REDACTED]] pgd=[PII_REDACTED], p4d=[PII_REDACTED]
  Internal error: Oops: [PII_REDACTED] [#1] PREEMPT SMP
  Modules linked in:
  CPU: 2 PID: 371 Comm: qemu-system-aar Not tainted 6.8.0-rc7-gde77230ac23a #9
  Hardware name: linux,dummy-virt (DT)
  pstate: 81400809 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c)
  pc : 0x0
  lr : iommufd_hwpt_invalidate+0xa4/0x204
  sp : ffff800080f3bcc0
  x29: ffff800080f3bcf0 x28: ffff0000c369b300 x27: [PII_REDACTED]
  x26: [PII_REDACTED] x25: [PII_REDACTED] x24: [PII_REDACTED]
  x23: [PII_REDACTED] x22: 00000000c1e334a0 x21: ffff0000c1e334a0
  x20: ffff800080f3bd38 x19: ffff800080f3bd58 x18: [PII_REDACTED]
  x17: [PII_REDACTED] x16: [PII_REDACTED] x15: 0000ffff8240d6d8
  x14: [PII_REDACTED] x13: [PII_REDACTED] x12: [PII_REDACTED]
  x11: [PII_REDACTED] x10: [PII_REDACTED] x9 : [PII_REDACTED]
  x8 : [PII_REDACTED] x7 : 0000fffeac1ec950 x6 : [PII_REDACTED]
  x5 : ffff800080f3bd78 x4 : [PII_REDACTED] x3 : [PII_REDACTED]
  x2 : [PII_REDACTED] x1 : ffff800080f3bcc8 x0 : ffff0000c6034d80
  Call trace:
   0x0
   iommufd_fops_ioctl+0x154/0x274
   __arm64_sys_ioctl+0xac/0xf0
   invoke_syscall+0x48/0x110
   el0_svc_common.constprop.0+0x40/0xe0
   do_el0_svc+0x1c/0x28
   el0_svc+0x34/0xb4
   el0t_64_sync_handler+0x120/0x12c
   el0t_64_sync+0x190/0x194

All existing drivers implement this op for nesting, this is mostly a
bisection aid.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/89827a4de802765b1ebb401fc1e73a90108c7520; https://git.kernel.org/stable/c/a11dda723c6493bb1853bbc61c093377f96e2d47
CVE: CVE-2024-46825
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check

The lookup function iwl_mvm_rcu_fw_link_id_to_link_conf() is
normally called with input from the firmware, so it should use
IWL_FW_CHECK() instead of WARN_ON().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3cca098c91391b3fa48142bfda57048b985c87f6; https://git.kernel.org/stable/c/415f3634d53c7fb4cf07d2f5a0be7f2e15e6da33; https://git.kernel.org/stable/c/[PII_REDACTED]d4b321801a92b06f6d5248b2b4465f
CVE: CVE-2024-46826
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ELF: fix kernel.randomize_va_space double read

ELF loader uses "randomize_va_space" twice. It is sysctl and can change
at any moment, so 2 loads could see 2 different values in theory with
unpredictable consequences.

Issue exactly one load for consistent value across one exec.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1cf8cd[PII_REDACTED]0b6ea055811d04edd24fe4f7; https://git.kernel.org/stable/c/1f81d51141a234ad0a3874b4d185dc27a521cd27; https://git.kernel.org/stable/c/2a97388a807b6ab5538aa8f8537b2463c6988bd2
CVE: CVE-2024-46827
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix firmware crash due to invalid peer nss

Currently, if the access point receives an association
request containing an Extended HE Capabilities Information
Element with an invalid MCS-NSS, it triggers a firmware
crash.

This issue arises when EHT-PHY capabilities shows support
for a bandwidth and MCS-NSS set for that particular
bandwidth is filled by zeros and due to this, driver obtains
peer_nss as 0 and sending this value to firmware causes
crash.

Address this issue by implementing a validation step for
the peer_nss value before passing it to the firmware. If
the value is greater than zero, proceed with forwarding
it to the firmware. However, if the value is invalid,
reject the association request to prevent potential
firmware crashes.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/25a15f80253a7c8776e4e4880d797d20ec864154; https://git.kernel.org/stable/c/838c2cfdb6be7d7d8c06c711edf893eb34ca2e7c; https://git.kernel.org/stable/c/db163a463bb93cd3e37e1e7b10b9726fb6f95857
CVE: CVE-2024-46828
Published: 2024-09-27
Description: In the Linux kernel, the following vulnerability has been resolved:

sched: sch_cake: fix bulk flow accounting logic for host fairness

In sch_cake, we keep track of the count of active bulk flows per host,
when running in dst/src host fairness mode, which is used as the
round-robin weight when iterating through flows. The count of active
bulk flows is updated whenever a flow changes state.

This has a peculiar interaction with the hash collision handling: when a
hash collision occurs (after the set-associative hashing), the state of
the hash bucket is simply updated to match the new packet that collided,
and if host fairness is enabled, that also means assigning new per-host
state to the flow. For this reason, the bulk flow counters of the
host(s) assigned to the flow are decremented, before new state is
assigned (and the counters, which may not belong to the same host
anymore, are incremented again).

Back when this code was introduced, the host fairness mode was always
enabled, so the decrement was unconditional. When the configuration
flags were introduced the *increment* was made conditional, but
the *decrement* was not. Which of course can lead to a spurious
decrement (and associated wrap-around to U16_MAX).

AFAICT, when host fairness is disabled, the decrement and wrap-around
happens as soon as a hash collision occurs (which is not that common in
itself, due to the set-associative hashing). However, in most cases this
is harmless, as the value is only used when host fairness mode is
enabled. So in order to trigger an array overflow, sch_cake has to first
be configured with host fairness disabled, and while running in this
mode, a hash collision has to occur to cause the overflow. Then, the
qdisc has to be reconfigured to enable host fairness, which leads to the
array out-of-bounds because the wrapped-around value is retained and
used as an array index. It seems that syzbot managed to trigger this,
which is quite impressive in its own right.

This patch fixes the issue by introducing the same conditional check on
decrement as is used on increment.

The original bug predates the upstreaming of cake, but the commit listed
in the Fixes tag touched that code, meaning that this patch won't apply
before that.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/4a4eeefa514db570be025ab46d779af180e2c9bb; https://git.kernel.org/stable/c/546ea84d07e3e324644025e2aae2d12ea4c5896e; https://git.kernel.org/stable/c/549e407569e08459d16122341d332cb508024094