deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5455
Published: 2024-06-21
Description: The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazine_style' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://roadmap.theplusaddons.com/updates/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8699142d-4ddd-4ca1-9886-9b2d905a36cd?source=cve; https://roadmap.theplusaddons.com/updates/
CVE: CVE-2024-5756
Published: 2024-06-21
Description: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/includes/db/class-es-db-contacts.php#L532; https://plugins.trac.wordpress.org/changeset/3101638/email-subscribers/trunk/lite/includes/db/class-es-db-contacts.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bd11c6-2f55-4eee-834a-c4e405482b9c?source=cve
CVE: CVE-2021-47621
Published: 2024-06-21
Description: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://docs.r3.com/en/platform/corda/4.8/enterprise/release-notes-enterprise.html; https://github.com/classgraph/classgraph/commit/681362ad6b0b9d9abaffb2e07099ce54d7a41fa3; https://github.com/classgraph/classgraph/pull/539
CVE: CVE-2024-4377
Published: 2024-06-21
Description: The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/778cebec-bdbb-4538-9518-c5bd50f76961/; https://wpscan.com/vulnerability/778cebec-bdbb-4538-9518-c5bd50f76961/
CVE: CVE-2024-4381
Published: 2024-06-21
Description: The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9b3cda9a-17a7-4173-93a2-d552a874fae9/; https://wpscan.com/vulnerability/9b3cda9a-17a7-4173-93a2-d552a874fae9/
CVE: CVE-2024-4382
Published: 2024-06-21
Description: The CB (legacy) WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting codes, timeframes, and bookings via CSRF attacks
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1a67aeab-8145-4c8a-9c18-e6436fa39b63/; https://wpscan.com/vulnerability/1a67aeab-8145-4c8a-9c18-e6436fa39b63/
CVE: CVE-2024-4384
Published: 2024-06-21
Description: The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ad[PII_REDACTED]-4dc9-b5b9-50808e9e0d26/; https://wpscan.com/vulnerability/ad[PII_REDACTED]-4dc9-b5b9-50808e9e0d26/
CVE: CVE-2024-4474
Published: 2024-06-21
Description: The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/71954c60-6a5b-4cac-9920-6d9b787ead9c/; https://wpscan.com/vulnerability/71954c60-6a5b-4cac-9920-6d9b787ead9c/
CVE: CVE-2024-4475
Published: 2024-06-21
Description: The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in admin clear the logs them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/f0c7fa00-da6e-4f07-875f-7b85759a54b3/; https://wpscan.com/vulnerability/f0c7fa00-da6e-4f07-875f-7b85759a54b3/
CVE: CVE-2024-4477
Published: 2024-06-21
Description: The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ab551552-944c-4e2a-9355-7011cbe553b0/; https://wpscan.com/vulnerability/ab551552-944c-4e2a-9355-7011cbe553b0/
CVE: CVE-2024-4616
Published: 2024-06-21
Description: The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d203bf3b-aee9-4755-b429-d6bbdd940890/; https://wpscan.com/vulnerability/d203bf3b-aee9-4755-b429-d6bbdd940890/
CVE: CVE-2024-4755
Published: 2024-06-21
Description: The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/adc6ea6d-29d8-4ad0-b0db-2540e8b3f9a9/; https://wpscan.com/vulnerability/adc6ea6d-29d8-4ad0-b0db-2540e8b3f9a9/
CVE: CVE-2024-4969
Published: 2024-06-21
Description: The Widget Bundle WordPress plugin through 2.0.0 does not have CSRF checks when logging Widgets, which could allow attackers to make logged in admin enable/disable widgets via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1a7ec5dc-eda4-4fed-9df9-f41d2b937fed/; https://wpscan.com/vulnerability/1a7ec5dc-eda4-4fed-9df9-f41d2b937fed/
CVE: CVE-2024-4970
Published: 2024-06-21
Description: The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4a9fc352-7ec2-4992-9cda-7bdca4f42788/; https://wpscan.com/vulnerability/4a9fc352-7ec2-4992-9cda-7bdca4f42788/
CVE: CVE-2024-5447
Published: 2024-06-21
Description: The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a692b869-1666-42d1-b56d-dfcccd68ab67/; https://wpscan.com/vulnerability/a692b869-1666-42d1-b56d-dfcccd68ab67/
CVE: CVE-2024-5448
Published: 2024-06-21
Description: The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c482fe19-b643-41ea-8194-22776b388290/; https://wpscan.com/vulnerability/c482fe19-b643-41ea-8194-22776b388290/
CVE: CVE-2024-38873
Published: 2024-06-21
Description: An issue was discovered in the friendlycaptcha_official (aka Integration of Friendly Captcha) extension before 0.1.4 for TYPO3. The extension fails to check the requirement of the captcha field in submitted form data, allowing a remote user to bypass the captcha check. This only affects the captcha integration for the ext:form extension.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://typo3.org/security/advisory/typo3-ext-sa-2024-004; https://typo3.org/security/advisory/typo3-ext-sa-2024-004
CVE: CVE-2024-38874
Published: 2024-06-21
Description: An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-693
References: https://typo3.org/security/advisory/typo3-ext-sa-2024-003; https://typo3.org/security/advisory/typo3-ext-sa-2024-003
CVE: CVE-2024-5191
Published: 2024-06-21
Description: The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mime_types’ parameter in all versions up to, and including, 3.4.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.17/inc/modules/utilities/images.php#L58; https://plugins.trac.wordpress.org/changeset/3104910/; https://www.wordfence.com/threat-intel/vulnerabilities/id/31f4bad5-3a11-42c6-a336-6bd178ab5113?source=cve
CVE: CVE-2024-5639
Published: 2024-06-21
Description: The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update the profile picture of any user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://plugins.trac.wordpress.org/browser/metronet-profile-picture/tags/2.6.1/metronet-profile-picture.php#L1122; https://plugins.trac.wordpress.org/browser/metronet-profile-picture/tags/2.6.1/metronet-profile-picture.php#L989; https://plugins.trac.wordpress.org/changeset/3105132/
CVE: CVE-2024-2003
Published: 2024-06-21
Description: Local privilege escalation vulnerability allowed an attacker to misuse ESET's file operations during a restore operation from quarantine.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://support.eset.com/ca8674; https://support.eset.com/ca8674
CVE: CVE-2024-5945
Published: 2024-06-21
Description: The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissions to upload sanitized files, to bypass SVG sanitization and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A bypass to the patch in version 4.3 was discovered and fixed completely in version 4.4.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-svg-images/trunk/wp-svg-images.php#L111; https://plugins.trac.wordpress.org/browser/wp-svg-images/trunk/wp-svg-images.php#L313; https://plugins.trac.wordpress.org/changeset/3105276/
CVE: CVE-2024-6225
Published: 2024-06-21
Description: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.5 (and 7.5.1 for the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3092932%40ameliabooking&new=3092932%40ameliabooking&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/[PII_REDACTED]-ae2b-8aa634a217c6?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3092932%40ameliabooking&new=3092932%40ameliabooking&sfp_email=&sfph_mail=
CVE: CVE-2024-5859
Published: 2024-06-21
Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘d’ parameter in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3104980%40meeting-scheduler-by-vcita&new=3104980%40meeting-scheduler-by-vcita&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ea0559-dec7-4c20-956d-dbfe7bc67634?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3104980%40meeting-scheduler-by-vcita&new=3104980%40meeting-scheduler-by-vcita&sfp_email=&sfph_mail=
CVE: CVE-2024-31890
Published: 2024-06-21
Description: IBM i 7.3, 7.4, and 7.5 product IBM TCP/IP Connectivity Utilities for i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain root access to the host operating system.  IBM X-Force ID:  288171.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/288171; https://www.ibm.com/support/pages/node/7158240; https://exchange.xforce.ibmcloud.com/vulnerabilities/288171
CVE: CVE-2024-6027
Published: 2024-06-21
Description: The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/themify-wc-product-filter/trunk/public/class-wpf-public.php#L604; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3104239%40themify-wc-product-filter%2Ftrunk&old=3100861%40themify-wc-product-filter%2Ftrunk&sfp_email=&sfph_mail=#file2; https://themify.org/changelogs/themify-wc-product-filter.txt
CVE: CVE-2023-52884
Published: 2024-06-21
Description: In the Linux kernel, the following vulnerability has been resolved:

Input: cyapa - add missing input core locking to suspend/resume functions

Grab input->mutex during suspend/resume functions like it is done in
other input drivers. This fixes the following warning during system
suspend/resume cycle on Samsung Exynos5250-based Snow Chromebook:

------------[ cut here ]------------
WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c
Modules linked in: ...
CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G        W          6.6.0-rc5-next-20231009 #14109
Hardware name: Samsung Exynos (Flattened Device Tree)
Workqueue: events_unbound async_run_entry_fn
 unwind_backtrace from show_stack+0x10/0x14
 show_stack from dump_stack_lvl+0x58/0x70
 dump_stack_lvl from __warn+0x1a8/0x1cc
 __warn from warn_slowpath_fmt+0x18c/0x1b4
 warn_slowpath_fmt from input_device_enabled+0x68/0x6c
 input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc
 cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c
 cyapa_reinitialize from cyapa_resume+0x48/0x98
 cyapa_resume from dpm_run_callback+0x90/0x298
 dpm_run_callback from device_resume+0xb4/0x258
 device_resume from async_resume+0x20/0x64
 async_resume from async_run_entry_fn+0x40/0x15c
 async_run_entry_fn from process_scheduled_works+0xbc/0x6a8
 process_scheduled_works from worker_thread+0x188/0x454
 worker_thread from kthread+0x108/0x140
 kthread from ret_from_fork+0x14/0x28
Exception stack(0xf1625fb0 to 0xf1625ff8)
...
---[ end trace [PII_REDACTED] ]---
...
------------[ cut here ]------------
WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c
Modules linked in: ...
CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G        W          6.6.0-rc5-next-20231009 #14109
Hardware name: Samsung Exynos (Flattened Device Tree)
Workqueue: events_unbound async_run_entry_fn
 unwind_backtrace from show_stack+0x10/0x14
 show_stack from dump_stack_lvl+0x58/0x70
 dump_stack_lvl from __warn+0x1a8/0x1cc
 __warn from warn_slowpath_fmt+0x18c/0x1b4
 warn_slowpath_fmt from input_device_enabled+0x68/0x6c
 input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc
 cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c
 cyapa_reinitialize from cyapa_resume+0x48/0x98
 cyapa_resume from dpm_run_callback+0x90/0x298
 dpm_run_callback from device_resume+0xb4/0x258
 device_resume from async_resume+0x20/0x64
 async_resume from async_run_entry_fn+0x40/0x15c
 async_run_entry_fn from process_scheduled_works+0xbc/0x6a8
 process_scheduled_works from worker_thread+0x188/0x454
 worker_thread from kthread+0x108/0x140
 kthread from ret_from_fork+0x14/0x28
Exception stack(0xf1625fb0 to 0xf1625ff8)
...
---[ end trace [PII_REDACTED] ]---
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/7b4e0b39182cf5e677c1fc092a3ec40e621c25b6; https://git.kernel.org/stable/c/9400caf566f65c703e99d95f87b00c4b445627a7; https://git.kernel.org/stable/c/a4c638ab25786bd5aab5978fe51b2b9be16a4ebd
CVE: CVE-2024-31076
Published: 2024-06-21
Description: In the Linux kernel, the following vulnerability has been resolved:

genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline

The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of
interrupt affinity reconfiguration via procfs. Instead, the change is
deferred until the next instance of the interrupt being triggered on the
original CPU.

When the interrupt next triggers on the original CPU, the new affinity is
enforced within __irq_move_irq(). A vector is allocated from the new CPU,
but the old vector on the original CPU remains and is not immediately
reclaimed. Instead, apicd->move_in_progress is flagged, and the reclaiming
process is delayed until the next trigger of the interrupt on the new CPU.

Upon the subsequent triggering of the interrupt on the new CPU,
irq_complete_move() adds a task to the old CPU's vector_cleanup list if it
remains online. Subsequently, the timer on the old CPU iterates over its
vector_cleanup list, reclaiming old vectors.

However, a rare scenario arises if the old CPU is outgoing before the
interrupt triggers again on the new CPU.

In that case irq_force_complete_move() is not invoked on the outgoing CPU
to reclaim the old apicd->prev_vector because the interrupt isn't currently
affine to the outgoing CPU, and irq_needs_fixup() returns false. Even
though __vector_schedule_cleanup() is later called on the new CPU, it
doesn't reclaim apicd->prev_vector; instead, it simply resets both
apicd->move_in_progress and apicd->prev_vector to 0.

As a result, the vector remains unreclaimed in vector_matrix, leading to a
CPU vector leak.

To address this issue, move the invocation of irq_force_complete_move()
before the irq_needs_fixup() call to reclaim apicd->prev_vector, if the
interrupt is currently or used to be affine to the outgoing CPU.

Additionally, reclaim the vector in __vector_schedule_cleanup() as well,
following a warning message, although theoretically it should never see
apicd->move_in_progress with apicd->prev_cpu pointing to an offline CPU.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/59f86a2908380d09cdc726461c0fbb8d8579c99f; https://git.kernel.org/stable/c/6752dfcfff3ac3e16625ebd3f0ad9630900e7e76; https://git.kernel.org/stable/c/9eeda3e0071a329af1eba15f4e57dc39576bb420
CVE: CVE-2024-33619
Published: 2024-06-21
Description: In the Linux kernel, the following vulnerability has been resolved:

efi: libstub: only free priv.runtime_map when allocated

priv.runtime_map is only allocated when efi_novamap is not set.
Otherwise, it is an uninitialized value.  In the error path, it is freed
unconditionally.  Avoid passing an uninitialized value to free_pool.
Free priv.runtime_map only when it was allocated.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/4b2543f7e1e6b91cfc8dd1696e3cdf01c3ac8974; https://git.kernel.org/stable/c/6ca67a5fe1c606d1fbe24c30a9fc0bdc43a18554; https://git.kernel.org/stable/c/9dce01f386c9ce6990c0a83fa14b1c95330b037e
CVE: CVE-2024-36244
Published: 2024-06-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: extend minimum interval restriction to entire cycle too

It is possible for syzbot to side-step the restriction imposed by the
blamed commit in the Fixes: tag, because the taprio UAPI permits a
cycle-time different from (and potentially shorter than) the sum of
entry intervals.

We need one more restriction, which is that the cycle time itself must
be larger than N * ETH_ZLEN bit times, where N is the number of schedule
entries. This restriction needs to apply regardless of whether the cycle
time came from the user or was the implicit, auto-calculated value, so
we move the existing "cycle == 0" check outside the "if "(!new->cycle_time)"
branch. This way covers both conditions and scenarios.

Add a selftest which illustrates the issue triggered by syzbot.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/34d83c3e6e97867ae061d14eb52123404aab1cbc; https://git.kernel.org/stable/c/91f249b01fe490fce11fbb4307952ca8cce78724; https://git.kernel.org/stable/c/b939d1e04a90248b4cdf417b0969c270ceb992b2