deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-23524
Published: 2024-06-10
Description: Missing Authorization vulnerability in ONTRAPORT Inc. PilotPress.This issue affects PilotPress: from n/a through 2.0.30.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/pilotpress/wordpress-pilotpress-plugin-2-0-29-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pilotpress/wordpress-pilotpress-plugin-2-0-29-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35717
Published: 2024-06-10
Description: Missing Authorization vulnerability in A WP Life Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/media-slider/wordpress-media-slider-plugin-1-3-9-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/media-slider/wordpress-media-slider-plugin-1-3-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35720
Published: 2024-06-10
Description: Missing Authorization vulnerability in A WP Life Album Gallery – WordPress Gallery.This issue affects Album Gallery – WordPress Gallery: from n/a through 1.5.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/new-album-gallery/wordpress-album-gallery-wordpress-gallery-plugin-1-5-7-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/new-album-gallery/wordpress-album-gallery-wordpress-gallery-plugin-1-5-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35721
Published: 2024-06-10
Description: Missing Authorization vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: from n/a through 1.4.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/new-image-gallery/wordpress-image-gallery-plugin-1-4-5-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/new-image-gallery/wordpress-image-gallery-plugin-1-4-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35722
Published: 2024-06-10
Description: Missing Authorization vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: from n/a through 1.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/slider-responsive-slideshow/wordpress-slider-responsive-slideshow-image-slider-gallery-slideshow-plugin-1-4-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slider-responsive-slideshow/wordpress-slider-responsive-slideshow-image-slider-gallery-slideshow-plugin-1-4-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35723
Published: 2024-06-10
Description: Missing Authorization vulnerability in Andrew Dashboard To-Do List dashboard-to-do-list.This issue affects Dashboard To-Do List: from n/a through <= 1.2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/dashboard-to-do-list/vulnerability/wordpress-dashboard-to-do-list-plugin-1-2-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dashboard-to-do-list/wordpress-dashboard-to-do-list-plugin-1-2-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35724
Published: 2024-06-10
Description: Missing Authorization vulnerability in Bosa Themes Bosa Elementor Addons and Templates for WooCommerce.This issue affects Bosa Elementor Addons and Templates for WooCommerce: from n/a through 1.0.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/bosa-elementor-for-woocommerce/wordpress-bosa-elementor-addons-and-templates-for-woocommerce-plugin-1-0-12-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bosa-elementor-for-woocommerce/wordpress-bosa-elementor-addons-and-templates-for-woocommerce-plugin-1-0-12-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35725
Published: 2024-06-10
Description: Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-6-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35726
Published: 2024-06-10
Description: Missing Authorization vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.19.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wc4bp/wordpress-woobuddy-plugin-3-4-19-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc4bp/wordpress-woobuddy-plugin-3-4-19-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35727
Published: 2024-06-10
Description: Missing Authorization vulnerability in actpro Extra Product Options for WooCommerce.This issue affects Extra Product Options for WooCommerce: from n/a through 3.0.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/extra-product-options-for-woocommerce/wordpress-extra-product-options-for-woocommerce-plugin-3-0-6-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/extra-product-options-for-woocommerce/wordpress-extra-product-options-for-woocommerce-plugin-3-0-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35729
Published: 2024-06-10
Description: Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.2.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/tickera-event-ticketing-system/vulnerability/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-2-6-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tickera-event-ticketing-system/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-2-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35735
Published: 2024-06-10
Description: Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-2-11-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-2-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35741
Published: 2024-06-10
Description: Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-1-7-broken-access-control-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-1-7-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2024-35742
Published: 2024-06-10
Description: Missing Authorization vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/yikes-inc-easy-mailchimp-extender/wordpress-easy-forms-for-mailchimp-plugin-6-9-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yikes-inc-easy-mailchimp-extender/wordpress-easy-forms-for-mailchimp-plugin-6-9-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-4328
Published: 2024-06-10
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users into performing actions without their consent, such as deleting important files on the system. The issue is present in the application's handling of requests, making it susceptible to CSRF attacks that could lead to unauthorized actions being performed on behalf of the user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://huntr.com/bounties/0f4faadf-ebca-4ef8-9d8a-66dbd849c0f8; https://huntr.com/bounties/0f4faadf-ebca-4ef8-9d8a-66dbd849c0f8
CVE: CVE-2024-4744
Published: 2024-06-10
Description: Missing Authorization vulnerability in Avirtum iPages Flipbook.This issue affects iPages Flipbook: from n/a through 1.5.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/ipages-flipbook/wordpress-ipages-flipbook-plugin-1-5-1-broken-access-control-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/ipages-flipbook/wordpress-ipages-flipbook-plugin-1-5-1-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2024-4745
Published: 2024-06-10
Description: Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-4746
Published: 2024-06-10
Description: Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm: from n/a through <= 2.9.32.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/netgsm/vulnerability/wordpress-netgsm-plugin-2-9-16-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/netgsm/wordpress-netgsm-plugin-2-9-16-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-36971
Published: 2024-06-10
Description: In the Linux kernel, the following vulnerability has been resolved:

net: fix __dst_negative_advice() race

__dst_negative_advice() does not enforce proper RCU rules when
sk->dst_cache must be cleared, leading to possible UAF.

RCU rules are that we must first clear sk->sk_dst_cache,
then call dst_release(old_dst).

Note that sk_dst_reset(sk) is implementing this protocol correctly,
while __dst_negative_advice() uses the wrong order.

Given that ip6_negative_advice() has special logic
against RTF_CACHE, this means each of the three ->negative_advice()
existing methods must perform the sk_dst_reset() themselves.

Note the check against NULL dst is centralized in
__dst_negative_advice(), there is no need to duplicate
it in various callbacks.

Many thanks to Clement Lecigne for tracking this issue.

This old bug became visible after the blamed commit, using UDP sockets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13; https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6; https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508
CVE: CVE-2024-1228
Published: 2024-06-10
Description: Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations.

This issue affects Eurosoft Przychodnia software before version 20240417.001 (from that version vulnerability is fixed).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://cert.pl/en/posts/2024/06/CVE-2024-1228/; https://cert.pl/posts/2024/06/CVE-2024-1228/; https://www.eurosoft.com.pl/eurosoft-przychodnia
CVE: CVE-2024-28833
Published: 2024-06-10
Description: Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of second factor mechanisms.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://checkmk.com/werk/16830; https://checkmk.com/werk/16830
CVE: CVE-2024-3699
Published: 2024-06-10
Description: Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all drEryk Gabinet installations.This issue affects drEryk Gabinet software versions from 7.0.0.0 through 9.17.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://cert.pl/en/posts/2024/06/CVE-2024-1228/; https://cert.pl/posts/2024/06/CVE-2024-1228/; https://dreryk.pl/produkty/gabinet/
CVE: CVE-2024-3700
Published: 2024-06-10
Description: Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Simple Care software installations.

This issue affects Estomed Sp. z o.o. Simple Care software in all versions. The software is no longer supported.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://cert.pl/en/posts/2024/06/CVE-2024-1228/; https://cert.pl/posts/2024/06/CVE-2024-1228/; https://cert.pl/en/posts/2024/06/CVE-2024-1228/
CVE: CVE-2024-36405
Published: 2024-06-10
Description: liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identified in the reference implementation of the Kyber key encapsulation mechanism when it is compiled with Clang 15-18 for `-Os`, `-O1`, and other compilation options. A proof-of-concept local attack on the reference implementation leaks the entire ML-KEM 512 secret key in ~10 minutes using end-to-end decapsulation timing measurements. The issue has been fixed in version 0.10.1. As a possible workaround, some compiler options may produce vectorized code that does not leak secret information, however relying on these compiler options as a workaround may not be reliable.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-208, CWE-385
References: https://github.com/open-quantum-safe/liboqs/blob/7eecda6095c003ddded7175a1ffdf35a2ce63ed5/src/kem/kyber/pqcrystals-kyber_kyber512_ref/poly.c#L166; https://github.com/open-quantum-safe/liboqs/commit/982c762c242ef549c914891b47bf6e0ed6321f91; https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-f2v9-5498-2vpp
CVE: CVE-2024-5785
Published: 2024-06-10
Description: Command injection vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user to execute commands inside the router by making a POST request to the URL “/boaform/admin/formUserTracert”.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-comtrend-router; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-comtrend-router
CVE: CVE-2024-5786
Published: 2024-06-10
Description: Cross-Site Request Forgery vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability allows an attacker to force an end user to execute unwanted actions in a web application to which he is authenticated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-comtrend-router; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-comtrend-router
CVE: CVE-2022-45168
Published: 2024-06-10
Description: An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/createbackupcodes endpoint, because the application allows a user to generate or regenerate the backup codes before checking the TOTP.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-863
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-45176
Published: 2024-06-10
Description: An issue was discovered in LIVEBOX Collaboration vDesk through v018. Stored Cross-site Scripting (XSS) can occur under the /api/v1/getbodyfile endpoint via the uri parameter. The web application (through its vShare functionality section) doesn't properly check parameters, sent in HTTP requests as input, before saving them on the server. In addition, crafted JavaScript content can then be reflected back to the end user and executed by the web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2024-35304
Published: 2024-06-10
Description: System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects Pandora FMS: from 700 through <777.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2024-35305
Published: 2024-06-10
Description: Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through <777.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2024-35306
Published: 2024-06-10
Description: OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 through <777.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2024-35307
Published: 2024-06-10
Description: Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2024-36406
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open re-direct. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-hcw8-p37h-8hrv; https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-hcw8-p37h-8hrv
CVE: CVE-2024-36528
Published: 2024-06-10
Description: nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://mat4mee.notion.site/2-bug-chains-in-nukeViet-lead-to-RCE-bdd42b20b05a448fbe87c752b41bb15f; https://mat4mee.notion.site/2-bug-chains-in-nukeViet-lead-to-RCE-bdd42b20b05a448fbe87c752b41bb15f
CVE: CVE-2024-36531
Published: 2024-06-10
Description: nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-94
References: https://mat4mee.notion.site/Module-upload-in-nukeViet-leads-to-RCE-01ff3ff4c80d402d8c7c8a2b15a24c33; https://mat4mee.notion.site/Module-upload-in-nukeViet-leads-to-RCE-01ff3ff4c80d402d8c7c8a2b15a24c33
CVE: CVE-2024-36972
Published: 2024-06-10
Description: In the Linux kernel, the following vulnerability has been resolved:

af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.

Billy Jheng Bing-Jhong reported a race between __unix_gc() and
queue_oob().

__unix_gc() tries to garbage-collect close()d inflight sockets,
and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GC
will drop the reference and set NULL to it locklessly.

However, the peer socket still can send MSG_OOB message and
queue_oob() can update unix_sk(sk)->oob_skb concurrently, leading
NULL pointer dereference. [0]

To fix the issue, let's update unix_sk(sk)->oob_skb under the
sk_receive_queue's lock and take it everywhere we touch oob_skb.

Note that we defer kfree_skb() in manage_oob() to silence lockdep
false-positive (See [1]).

[0]:
BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 PF: supervisor write access in kernel mode
 PF: error_code(0x0002) - not-present page
PGD[PII_REDACTED]f5e067 P4D[PII_REDACTED]f5e067 PUD 9f5d067 PMD 0
Oops: 0002 [#1] PREEMPT SMP PTI
CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Workqueue: events delayed_fput
RIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847)
Code: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 <48> 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc
RSP: 0018:ffffc900001bfd48 EFLAGS: 00000002
RAX: [PII_REDACTED] RBX: ffff8880088f5ae8 RCX:[PII_REDACTED]1289f9
RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: ffff8880088f5b00
RBP: ffff8880088f5b00 R08: [PII_REDACTED] R09: [PII_REDACTED]
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: ffff8880056b6a00
R13: ffff8880088f5280 R14: [PII_REDACTED] R15: ffff8880088f5a80
FS:  [PII_REDACTED](0000) GS:ffff88807dd80000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: [PII_REDACTED] CR3: [PII_REDACTED] CR4:[PII_REDACTED]7506f0
PKRU: 55555554
Call Trace:
 <TASK>
 unix_release_sock (net/unix/af_unix.c:654)
 unix_release (net/unix/af_unix.c:1050)
 __sock_release (net/socket.c:660)
 sock_close (net/socket.c:1423)
 __fput (fs/file_table.c:423)
 delayed_fput (fs/file_table.c:444 (discriminator 3))
 process_one_work (kernel/workqueue.c:3259)
 worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416)
 kthread (kernel/kthread.c:388)
 ret_from_fork (arch/x86/kernel/process.c:153)
 ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
 </TASK>
Modules linked in:
CR2: [PII_REDACTED]
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3; https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1; https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1