deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-56707
Published: 2024-12-28
Description: In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c

Add error pointer checks after calling otx2_mbox_get_rsp().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1611b1ea7cf8d07dff091a45389b10401bb6d5b3; https://git.kernel.org/stable/c/20e06a5137a1174214bae3a29ce623e69455ee0f; https://git.kernel.org/stable/c/3ccbc7a518868eff1d5a198b9e454e182b651e00
CVE: CVE-2024-56708
Published: 2024-12-28
Description: In the Linux kernel, the following vulnerability has been resolved:

EDAC/igen6: Avoid segmentation fault on module unload

The segmentation fault happens because:

During modprobe:
1. In igen6_probe(), igen6_pvt will be allocated with kzalloc()
2. In igen6_register_mci(), mci->pvt_info will point to
   &igen6_pvt->imc[mc]

During rmmod:
1. In mci_release() in edac_mc.c, it will kfree(mci->pvt_info)
2. In igen6_remove(), it will kfree(igen6_pvt);

Fix this issue by setting mci->pvt_info to NULL to avoid the double
kfree.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://git.kernel.org/stable/c/029ac07bb92d2f7502d47a4916f197a8445d83bf; https://git.kernel.org/stable/c/2a80e710bbc088a2511c159ee4d910456c5f0832; https://git.kernel.org/stable/c/830cabb61113d92a425dd3038ccedbdfb3c8d079
CVE: CVE-2024-12994
Published: 2024-12-28
Description: A vulnerability was found in running-elephant Datart 1.0.0-rc3. It has been rated as critical. Affected by this issue is the function extractModel of the file /import of the component File Upload. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://github.com/piqi233/cves/blob/main/readme.md; https://vuldb.com/?ctiid.289628; https://vuldb.com/?id.289628
CVE: CVE-2024-12995
Published: 2024-12-28
Description: A vulnerability classified as problematic has been found in ruifang-tech Rebuild 3.8.6. This affects an unknown part of the file /project/050-[PII_REDACTED]/tasks of the component Project Tasks Section. The manipulation of the argument description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/rebuild/StoredXSS-TaskDescription.md; https://vuldb.com/?ctiid.289629; https://vuldb.com/?id.289629
CVE: CVE-2024-56512
Published: 2024-12-28
Description: Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups.

Creating a new Process Group can include binding to a Parameter Context, but in cases where the Process Group did not reference any Parameter values, the framework did not check user authorization for the bound Parameter Context. Missing authorization for a bound Parameter Context enabled clients to download non-sensitive Parameter values after creating the Process Group.

Creating a new Process Group can also include referencing existing Controller Services or Parameter Providers. The framework did not check user authorization for referenced Controller Services or Parameter Providers, enabling clients to create Process Groups and use these components that were otherwise unauthorized.

This vulnerability is limited in scope to authenticated users authorized to create Process Groups. The scope is further limited to deployments with component-based authorization policies. Upgrading to Apache NiFi 2.1.0 is the recommended mitigation, which includes authorization checking for Parameter and Controller Service references on Process Group creation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-638, CWE-862
References: https://lists.apache.org/thread/cjc8fns5kjsho0s7vonlnojokyfx47wn; http://www.openwall.com/lists/oss-security/2024/12/28/1
CVE: CVE-2024-12998
Published: 2024-12-28
Description: A vulnerability, which was classified as problematic, was found in code-projects Online Car Rental System 1.0. This affects an unknown part of the file /index.php of the component GET Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://vuldb.com/?ctiid.289659; https://vuldb.com/?id.289659
CVE: CVE-2024-12999
Published: 2024-12-29
Description: A vulnerability has been found in PHPGurukul Small CRM 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289660; https://vuldb.com/?id.289660
CVE: CVE-2024-13000
Published: 2024-12-29
Description: A vulnerability was found in PHPGurukul Small CRM 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/quote-details.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289661; https://vuldb.com/?id.289661
CVE: CVE-2024-13001
Published: 2024-12-29
Description: A vulnerability was found in PHPGurukul Small CRM 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289662; https://vuldb.com/?id.289662
CVE: CVE-2024-13002
Published: 2024-12-29
Description: A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /order_process.php. The manipulation of the argument fnm leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/writeke/CVE/blob/main/BookstoreManagementSystemSQL.md; https://vuldb.com/?ctiid.289663
CVE: CVE-2024-13003
Published: 2024-12-29
Description: A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /update_ed.php. The manipulation of the argument e_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/naotuo/CVE/blob/main/SQL_Injection_in_Portfolio_Management_System.md; https://vuldb.com/?ctiid.289664
CVE: CVE-2024-12238
Published: 2024-12-29
Description: The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.8.20/includes/Display/Preview.php#L68; https://www.wordfence.com/threat-intel/vulnerabilities/id/524a2143-b15f-4edc-98de-dafef4c5bc00?source=cve
CVE: CVE-2018-25107
Published: 2024-12-29
Description: The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of random bits.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://github.com/karenetheridge/Crypt-Random-Source/pull/3; https://metacpan.org/release/ETHER/Crypt-Random-Source-0.13/changes
CVE: CVE-2024-13004
Published: 2024-12-29
Description: A vulnerability classified as critical has been found in PHPGurukul Complaint Management System 1.0. This affects an unknown part of the file /admin/category.php. The manipulation of the argument state leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/alc9700jmo/CVE/issues/6; https://phpgurukul.com/; https://vuldb.com/?ctiid.289665
CVE: CVE-2024-56737
Published: 2024-12-29
Description: GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://savannah.gnu.org/bugs/?66599
CVE: CVE-2024-56738
Published: 2024-12-29
Description: GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://savannah.gnu.org/bugs/?66603
CVE: CVE-2024-13005
Published: 2024-12-29
Description: A vulnerability classified as critical was found in 1000 Projects Attendance Tracking Management System 1.0. This vulnerability affects unknown code of the file /admin/attendance_action.php. The manipulation of the argument attendance_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/Hacker0xOne/CVE/issues/18; https://vuldb.com/?ctiid.289666
CVE: CVE-2024-13006
Published: 2024-12-29
Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Human Resource Management System 1.0. This issue affects some unknown processing of the file /employeeview.php. The manipulation of the argument search leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/Sakurapan/CVE/issues/1; https://vuldb.com/?ctiid.289667
CVE: CVE-2024-13007
Published: 2024-12-29
Description: A vulnerability, which was classified as critical, was found in Codezips Event Management System 1.0. Affected is an unknown function of the file /contact.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/T3rm1n4L-LYC/Vuldb/blob/main/SQL_Injection_in_Event_Management_System.md; https://vuldb.com/?ctiid.289668; https://vuldb.com/?id.289668
CVE: CVE-2024-56709
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring: check if iowq is killed before queuing

task work can be executed after the task has gone through io_uring
termination, whether it's the final task_work run or the fallback path.
In this case, task work will find ->io_wq being already killed and
null'ed, which is a problem if it then tries to forward the request to
io_queue_iowq(). Make io_queue_iowq() fail requests in this case.

Note that it also checks PF_KTHREAD, because the user can first close
a DEFER_TASKRUN ring and shortly after kill the task, in which case
->iowq check would race.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2ca94c8de36091067b9ce7527ae8db3812d38781; https://git.kernel.org/stable/c/4f95a2186b7f2af09331e1e8069bcaf34fe019cf; https://git.kernel.org/stable/c/534d59ab38010aada88390db65985e65d0de7d9e
CVE: CVE-2024-56710
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ceph: fix memory leak in ceph_direct_read_write()

The bvecs array which is allocated in iter_get_bvecs_alloc() is leaked
and pages remain pinned if ceph_alloc_sparse_ext_map() fails.

There is no need to delay the allocation of sparse_ext map until after
the bvecs array is set up, so fix this by moving sparse_ext allocation
a bit earlier.  Also, make a similar adjustment in __ceph_sync_read()
for consistency (a leak of the same kind in __ceph_sync_read() has been
addressed differently).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/44e518abbb498075ae85c7d1d1a503a6bb05ea2d; https://git.kernel.org/stable/c/66e0c4f91461d17d[PII_REDACTED]1c824620bed4ef; https://git.kernel.org/stable/c/eb[PII_REDACTED]f31d5897e99bb761f46cb4ce5859
CVE: CVE-2024-56711
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/panel: himax-hx83102: Add a check to prevent NULL pointer dereference

drm_mode_duplicate() could return NULL due to lack of memory,
which will then call NULL pointer dereference. Add a check to
prevent it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/747547972e647509815ad8530ff09d62220a56c2; https://git.kernel.org/stable/c/e1e1af9148dc4c866eda3fb59cd6ec3c7ea34b1d
CVE: CVE-2024-56712
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

udmabuf: fix memory leak on last export_udmabuf() error path

In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a
dma_buf owning the udmabuf has already been created; but the error handling
in udmabuf_create() will tear down the udmabuf without doing anything about
the containing dma_buf.

This leaves a dma_buf in memory that contains a dangling pointer; though
that doesn't seem to lead to anything bad except a memory leak.

Fix it by moving the dma_buf_fd() call out of export_udmabuf() so that we
can give it different error handling.

Note that the shape of this code changed a lot in commit 5e72b2b41a21
("udmabuf: convert udmabuf driver to use folios"); but the memory leak
seems to have existed since the introduction of udmabuf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/c9fc8428d4255c2128da9c4d5cd92e554d0150cf; https://git.kernel.org/stable/c/f49856f525acd5bef52ae28b7da2e001bbe7439e
CVE: CVE-2024-56713
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

net: netdevsim: fix nsim_pp_hold_write()

nsim_pp_hold_write() has two problems:

1) It may return with rtnl held, as found by syzbot.

2) Its return value does not propagate an error if any.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5c553262f063b3bf85df3b22a9818a8d92510f4d; https://git.kernel.org/stable/c/b9b8301d369b4c876de5255dbf067b19ba88ac71
CVE: CVE-2024-56714
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ionic: no double destroy workqueue

There are some FW error handling paths that can cause us to
try to destroy the workqueue more than once, so let's be sure
we're checking for that.

The case where this popped up was in an AER event where the
handlers got called in such a way that ionic_reset_prepare()
and thus ionic_dev_teardown() got called twice in a row.
The second time through the workqueue was already destroyed,
and destroy_workqueue() choked on the bad wq pointer.

We didn't hit this in AER handler testing before because at
that time we weren't using a private workqueue.  Later we
replaced the use of the system workqueue with our own private
workqueue but hadn't rerun the AER handler testing since then.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/13355dd37e22edbcb99c599f[PII_REDACTED]40a650; https://git.kernel.org/stable/c/746e6ae2e202b062b9deee7bd86d94937997ecd7
CVE: CVE-2024-56715
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ionic: Fix netdev notifier unregister on failure

If register_netdev() fails, then the driver leaks the netdev notifier.
Fix this by calling ionic_lif_unregister() on register_netdev()
failure. This will also call ionic_lif_unregister_phc() if it has
already been registered.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/87847938f5708b2509b279369c96572254bcf2ba; https://git.kernel.org/stable/c/9590d32e090ea2751e131ae5273859ca22f5ac14; https://git.kernel.org/stable/c/da5736f516a664a9e1ff74902663c64c423045d2
CVE: CVE-2024-56716
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

netdevsim: prevent bad user input in nsim_dev_health_break_write()

If either a zero count or a large one is provided, kernel can crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1284, CWE-1284
References: https://git.kernel.org/stable/c/470c5ecbac2f19b1cdee2a6ce8d5650c3295c94b; https://git.kernel.org/stable/c/81bdfcd6e6a998e219c9dd49ec7291c2e0594bbc; https://git.kernel.org/stable/c/8e9ef6bdf71bf25f4735e0230ce1919de8985835
CVE: CVE-2024-56717
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()

Packets injected by the CPU should have a SRC_PORT field equal to the
CPU port module index in the Analyzer block (ocelot->num_phys_ports).

The blamed commit copied the ocelot_ifh_set_basic() call incorrectly
from ocelot_xmit_common() in net/dsa/tag_ocelot.c. Instead of calling
with "x", it calls with BIT_ULL(x), but the field is not a port mask,
but rather a single port index.

[ side note: this is the technical debt of code duplication :( ]

The error used to be silent and doesn't appear to have other
user-visible manifestations, but with new changes in the packing
library, it now fails loudly as follows:

------------[ cut here ]------------
Cannot store 0x40 inside bits 46-43 - will truncate
sja1105 spi2.0: xmit timed out
WARNING: CPU: 1 PID: 102 at lib/packing.c:98 __pack+0x90/0x198
sja1105 spi2.0: timed out polling for tstamp
CPU: 1 UID: 0 PID: 102 Comm: felix_xmit
Tainted: G        W        N 6.13.0-rc1-00372-gf706b85d972d-dirty #2605
Call trace:
 __pack+0x90/0x198 (P)
 __pack+0x90/0x198 (L)
 packing+0x78/0x98
 ocelot_ifh_set_basic+0x260/0x368
 ocelot_port_inject_frame+0xa8/0x250
 felix_port_deferred_xmit+0x14c/0x258
 kthread_worker_fn+0x134/0x350
 kthread+0x114/0x138

The code path pertains to the ocelot switchdev driver and to the felix
secondary DSA tag protocol, ocelot-8021q. Here seen with ocelot-8021q.

The messenger (packing) is not really to blame, so fix the original
commit instead.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2d5df3a680ffdaf606baa10636bdb1daf757832e; https://git.kernel.org/stable/c/2f3c62ffe88116cd2a39cd73e[PII_REDACTED]9970f; https://git.kernel.org/stable/c/59c4ca8d8d7918eb6e2df91d2c254827264be309
CVE: CVE-2024-56718
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

net/smc: protect link down work from execute after lgr freed

link down work may be scheduled before lgr freed but execute
after lgr freed, which may result in crash. So it is need to
hold a reference before shedule link down work, and put the
reference after work executed or canceled.

The relevant crash call stack as follows:
 list_del corruption. prev->next should be ffffb638c9c0fe20,
    but was [PII_REDACTED]
 ------------[ cut here ]------------
 kernel BUG at lib/list_debug.c:51!
 invalid opcode: 0000 [#1] SMP NOPTI
 CPU: 6 PID: 978112 Comm: kworker/6:119 Kdump: loaded Tainted: G #1
 Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 2221b89 04/01/2014
 Workqueue: events smc_link_down_work [smc]
 RIP: 0010:__list_del_entry_valid.cold+0x31/0x47
 RSP: 0018:ffffb638c9c0fdd8 EFLAGS: 00010086
 RAX: [PII_REDACTED] RBX: ffff942fb75e5128 RCX: [PII_REDACTED]
 RDX: ffff943520930aa0 RSI: ffff94352091fc80 RDI: ffff94352091fc80
 RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: ffffb638c9c0fc38
 R10: ffffb638c9c0fc30 R11: ffffffffa015eb28 R12: [PII_REDACTED]
 R13: ffffb638c9c0fe20 R14: [PII_REDACTED] R15: ffff942f9cd051c0
 FS:  [PII_REDACTED](0000) GS:ffff[PII_REDACTED]00(0000) knlGS:[PII_REDACTED]
 CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
 CR2: 00007f4f25214000 CR3: 000000025fbae004 CR4:[PII_REDACTED]7706e0
 DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
 DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
 PKRU: 55555554
 Call Trace:
  rwsem_down_write_slowpath+0x17e/0x470
  smc_link_down_work+0x3c/0x60 [smc]
  process_one_work+0x1ac/0x350
  worker_thread+0x49/0x2f0
  ? rescuer_thread+0x360/0x360
  kthread+0x118/0x140
  ? __kthread_bind_mask+0x60/0x60
  ret_from_fork+0x1f/0x30
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2627c3e8646932dfc7b9722c88c2e1ffcf7a9fb2; https://git.kernel.org/stable/c/2b33eb8f1b3e8c2f87cfdbc8cc117f6bdfabc6ec; https://git.kernel.org/stable/c/841b1824750d3b8d1dc0a96b14db4418b952abbc
CVE: CVE-2024-56719
Published: 2024-12-29
Description: In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix TSO DMA API usage causing oops

Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap
for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s
members to be later in stmmac_tso_xmit().

The buf (dma cookie) and len stored in this structure are passed to
dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that
the dma cookie passed to dma_unmap_single() is the same as the value
returned from dma_map_single(). However, by moving the assignment
later, this is not the case when priv->dma_cap.addr64 > 32 as "des"
is offset by proto_hdr_len.

This causes problems such as:

  dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed

and with DMA_API_DEBUG enabled:

  DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes]

Fix this by maintaining "des" as the original DMA cookie, and use
tso_des to pass the offset DMA cookie to stmmac_tso_allocator().

Full details of the crashes can be found at:
https://lore.kernel.org/all/d8[PII_REDACTED]-4e14-b516-37c2d838171a@nvidia.com/
https://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4c49f38e20a57f8abaebdf95b369295b153d1f8e; https://git.kernel.org/stable/c/6abcdc9a73274052a9e96a1926994ecf9aedad82; https://git.kernel.org/stable/c/9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2
CVE: CVE-2024-13008
Published: 2024-12-29
Description: A vulnerability has been found in code-projects Responsive Hotel Site 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/newsletter.php. The manipulation of the argument eid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Err-4O4/cve/issues/1; https://github.com/Lanxiy7th/lx_CVE_report-/issues/18