deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-51013
Published: 2024-11-05
Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the RADIUSAddr%d_wla parameter at wireless.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_64/64.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51014
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid_an parameter in bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_56/56.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51015
Published: 2024-11-05
Description: Netgear R7000P v1.3.3.154 was discovered to contain a command injection vulnerability via the device_name2 parameter at operation_mode.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_62/62.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51016
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the addName%d parameter in usb_approve.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_58/58.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51017
Published: 2024-11-05
Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the l2tp_user_netmask parameter at l2tp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_59/59.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51018
Published: 2024-11-05
Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51019
Published: 2024-11-05
Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pppoe_localnetmask parameter at pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_61/61.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51020
Published: 2024-11-05
Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the apn parameter at usbISP_detail_edit.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_63/63.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51021
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a command injection vulnerability via the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_57/57.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51022
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid parameter in bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_55/55.md; https://www.netgear.com/about/security/
CVE: CVE-2024-51023
Published: 2024-11-05
Description: D-Link DIR_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the Address parameter in the SetNetworkTomographySettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_42/42.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-51024
Published: 2024-11-05
Description: D-Link DIR_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_43/43.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-52013
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at wiz_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52014
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at genie_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52015
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at bsw_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52016
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the component wlg_adv.cgi via the apmode_dns1_pri and apmode_dns1_sec parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_49/49.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52017
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_54/54.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52018
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at genie_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_53/53.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52019
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52020
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at wiz_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52021
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at bsw_fix.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52022
Published: 2024-11-05
Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component wlg_adv.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_48/48.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52023
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe2.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52024
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at wizpppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52025
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at geniepppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52026
Published: 2024-11-05
Description: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at bsw_pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52028
Published: 2024-11-05
Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at wiz_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52029
Published: 2024-11-05
Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at genie_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md; https://www.netgear.com/about/security/
CVE: CVE-2024-52030
Published: 2024-11-05
Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at ru_wan_flow.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md; https://www.netgear.com/about/security/
CVE: CVE-2023-29116
Published: 2024-11-05
Description: Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configuration details could be obtained.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2023-29117
Published: 2024-11-05
Description: Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2023-29118
Published: 2024-11-05
Description: Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2023-29119
Published: 2024-11-05
Description: Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2023-29120
Published: 2024-11-05
Description: Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2023-29121
Published: 2024-11-05
Description: Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-284
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2023-29122
Published: 2024-11-05
Description: Under certain conditions, access to service libraries is granted to account they should not have access to.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-708
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2023-29125
Published: 2024-11-05
Description: A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2023-29126
Published: 2024-11-05
Description: The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypass authentication.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-1287
References: https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf
CVE: CVE-2024-48312
Published: 2024-11-05
Description: WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40wagneralves_87750/poc-cve-weblaudos-d1ec40cfc183
CVE: CVE-2024-49522
Published: 2024-11-05
Description: Substance3D - Painter versions 10.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_painter/apsb24-52.html
CVE: CVE-2024-50089
Published: 2024-11-05
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-50090
Published: 2024-11-05
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe/oa: Fix overflow in oa batch buffer

By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch
buffer, this is not a problem if batch buffer is only used once but
oa reuses the batch buffer for the same metric and at each call
it appends a MI_BATCH_BUFFER_END, printing the warning below and then
overflowing.

[  381.072016] ------------[ cut here ]------------
[  381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!
               platform: LUNARLAKE subplatform: 1
               graphics: Xe2_LPG / Xe2_HPG 20.04 step B0
               media: Xe2_LPM / Xe2_HPM 20.00 step B0
               tile: 0 VRAM 0 B
               GT: 0 type 1

So here checking if batch buffer already have MI_BATCH_BUFFER_END if
not append it.

v2:
- simply fix, suggestion from Ashutosh

(cherry picked from commit 9ba0e0f30ca42a98af[PII_REDACTED]edfb6315718a)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://git.kernel.org/stable/c/6c10ba06bb1b48acce6d4d9c1e33beb9954f1788; https://git.kernel.org/stable/c/bcb5be3421705e682b0b32073ad627056d6bc2a2
CVE: CVE-2024-50091
Published: 2024-11-05
Description: In the Linux kernel, the following vulnerability has been resolved:

dm vdo: don't refer to dedupe_context after releasing it

Clear the dedupe_context pointer in a data_vio whenever ownership of
the context is lost, so that vdo can't examine it accidentally.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0808ebf2f80b962e75741a41ced372a7116f1e26; https://git.kernel.org/stable/c/63ef073084c67878d7a92e15ad055172da3f05a3
CVE: CVE-2024-50092
Published: 2024-11-05
Description: In the Linux kernel, the following vulnerability has been resolved:

net: netconsole: fix wrong warning

A warning is triggered when there is insufficient space in the buffer
for userdata. However, this is not an issue since userdata will be sent
in the next iteration.

Current warning message:

    ------------[ cut here ]------------
     WARNING: CPU: 13 PID: 3013042 at drivers/net/netconsole.c:1122 write_ext_msg+0x3b6/0x3d0
      ? write_ext_msg+0x3b6/0x3d0
      console_flush_all+0x1e9/0x330

The code incorrectly issues a warning when this_chunk is zero, which is
a valid scenario. The warning should only be triggered when this_chunk
is negative.
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/712a3af[PII_REDACTED]217df54e7f337f99df198d2; https://git.kernel.org/stable/c/d94785bb46b6167382b1de3290eccc91fa98df53
CVE: CVE-2024-50093
Published: 2024-11-05
Description: In the Linux kernel, the following vulnerability has been resolved:

thermal: intel: int340x: processor: Fix warning during module unload

The processor_thermal driver uses pcim_device_enable() to enable a PCI
device, which means the device will be automatically disabled on driver
detach.  Thus there is no need to call pci_disable_device() again on it.

With recent PCI device resource management improvements, e.g. commit
f748a07a0b64 ("PCI: Remove legacy pcim_release()"), this problem is
exposed and triggers the warining below.

 [  224.010735] proc_thermal_pci 0000:00:04.0: disabling already-disabled device
 [  224.010747] WARNING: CPU: 8 PID: 4442 at drivers/pci/pci.c:2250 pci_disable_device+0xe5/0x100
 ...
 [  224.010844] Call Trace:
 [  224.010845]  <TASK>
 [  224.010847]  ? show_regs+0x6d/0x80
 [  224.010851]  ? __warn+0x8c/0x140
 [  224.010854]  ? pci_disable_device+0xe5/0x100
 [  224.010856]  ? report_bug+0x1c9/0x1e0
 [  224.010859]  ? handle_bug+0x46/0x80
 [  224.010862]  ? exc_invalid_op+0x1d/0x80
 [  224.010863]  ? asm_exc_invalid_op+0x1f/0x30
 [  224.010867]  ? pci_disable_device+0xe5/0x100
 [  224.010869]  ? pci_disable_device+0xe5/0x100
 [  224.010871]  ? kfree+0x21a/0x2b0
 [  224.010873]  pcim_disable_device+0x20/0x30
 [  224.010875]  devm_action_release+0x16/0x20
 [  224.010878]  release_nodes+0x47/0xc0
 [  224.010880]  devres_release_all+0x9f/0xe0
 [  224.010883]  device_unbind_cleanup+0x12/0x80
 [  224.010885]  device_release_driver_internal+0x1ca/0x210
 [  224.010887]  driver_detach+0x4e/0xa0
 [  224.010889]  bus_remove_driver+0x6f/0xf0
 [  224.010890]  driver_unregister+0x35/0x60
 [  224.010892]  pci_unregister_driver+0x44/0x90
 [  224.010894]  proc_thermal_pci_driver_exit+0x14/0x5f0 [processor_thermal_device_pci]
 ...
 [  224.010921] ---[ end trace [PII_REDACTED] ]---

Remove the excess pci_disable_device() calls.

[ rjw: Subject and changelog edits ]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/434525a864136c928b54fd2512b4c0167c207463; https://git.kernel.org/stable/c/8403021b6f32d68a7e3a6b8428ecaf5c153a9974; https://git.kernel.org/stable/c/99ca0b57e49fb73624eede1c4396d9e3d10ccf14
CVE: CVE-2024-50094
Published: 2024-11-05
Description: In the Linux kernel, the following vulnerability has been resolved:

sfc: Don't invoke xdp_do_flush() from netpoll.

Yury reported a crash in the sfc driver originated from
netpoll_send_udp(). The netconsole sends a message and then netpoll
invokes the driver's NAPI function with a budget of zero. It is
dedicated to allow driver to free TX resources, that it may have used
while sending the packet.

In the netpoll case the driver invokes xdp_do_flush() unconditionally,
leading to crash because bpf_net_context was never assigned.

Invoke xdp_do_flush() only if budget is not zero.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/55e802468e1d38dec8e25a2fdb6078d45b647e8c; https://git.kernel.org/stable/c/65d4fc76d75c136744e67754d20feda609e7b793
CVE: CVE-2024-50096
Published: 2024-11-05
Description: In the Linux kernel, the following vulnerability has been resolved:

nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error

The `nouveau_dmem_copy_one` function ensures that the copy push command is
sent to the device firmware but does not track whether it was executed
successfully.

In the case of a copy error (e.g., firmware or hardware failure), the
copy push command will be sent via the firmware channel, and
`nouveau_dmem_copy_one` will likely report success, leading to the
`migrate_to_ram` function returning a dirty HIGH_USER page to the user.

This can result in a security vulnerability, as a HIGH_USER page that may
contain sensitive or corrupted data could be returned to the user.

To prevent this vulnerability, we allocate a zero page. Thus, in case of
an error, a non-dirty (zero) page will be returned to the user.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/614bfb2050982d23d53d0d51c4079dba0437c883; https://git.kernel.org/stable/c/697e3ddcf1f8b68bd531fc34eead27c000bdf3e1; https://git.kernel.org/stable/c/73f75d2b5aee5a735cf64b8ab4543d5c20dbbdd9