deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2953
Published: 2024-05-22
Description: The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/tags/2.1.4/plugin/PostSettings.php#L207; https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/tags/2.1.4/plugin/PostSettings.php#L209; https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/tags/2.1.4/plugin/PostSettings.php#L210
CVE: CVE-2024-32988
Published: 2024-05-22
Description: 'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT may be retrieved if the application binary is reverse-engineered.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://jvn.jp/en/jp/JVN83405304/; https://jvn.jp/en/jp/JVN83405304/
CVE: CVE-2024-3666
Published: 2024-05-22
Description: The Opal Estate Pro – Property Management and Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the agent latitude and longitude parameters in all versions up to, and including, 1.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-87
References: https://wordpress.org/plugins/opal-estate-pro/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d5d58f-913a-4a26-8b2a-bfdd08033993?source=cve; https://wordpress.org/plugins/opal-estate-pro/
CVE: CVE-2024-3671
Published: 2024-05-22
Description: The Print-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'print-me' shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes such as 'tag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/print-o-matic/; https://www.wordfence.com/threat-intel/vulnerabilities/id/10ea8f3a-35d6-494e-90f6-9165320cf99c?source=cve; https://wordpress.org/plugins/print-o-matic/
CVE: CVE-2024-4157
Published: 2024-05-22
Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Successful exploitation requires the attacker to have "View Form" and "Manage Form" permissions, which must be explicitly set by an administrator. However, this requirement can be bypassed when this vulnerability is chained with CVE-2024-2771.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://plugins.trac.wordpress.org/changeset/3081740/fluentform; https://www.wordfence.com/threat-intel/vulnerabilities/id/8def156a-f2f2-4640-a1c9-c21c74e1f308?source=cve; https://plugins.trac.wordpress.org/changeset/3081740/fluentform
CVE: CVE-2024-5147
Published: 2024-05-22
Description: The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'grid_style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/trunk/includes/wpzoom-elementor-ajax-posts-grid.php#L105; https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/trunk/includes/wpzoom-elementor-ajax-posts-grid.php#L112; https://plugins.trac.wordpress.org/changeset/3090236#file6
CVE: CVE-2021-47474
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

comedi: vmk80xx: fix bulk-buffer overflow

The driver is using endpoint-sized buffers but must not assume that the
tx and rx buffers are of equal size or a malicious device could overflow
the slab-allocated receive buffer when doing bulk transfers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/063f576c43d589a4c153554b681d32b3f8317c7b; https://git.kernel.org/stable/c/0866dcaa828c21bc2f94dac00e086078f11b5772; https://git.kernel.org/stable/c/1ae4715121a57bc6fa29fd992127b01907f2f993
CVE: CVE-2021-47475
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

comedi: vmk80xx: fix transfer-buffer overflows

The driver uses endpoint-sized USB transfer buffers but up until
recently had no sanity checks on the sizes.

Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize
of usb endpoints found") inadvertently fixed NULL-pointer dereferences
when accessing the transfer buffers in case a malicious device has a
zero wMaxPacketSize.

Make sure to allocate buffers large enough to handle also the other
accesses that are done without a size check (e.g. byte 18 in
vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond
the buffers, for example, when doing descriptor fuzzing.

The original driver was for a low-speed device with 8-byte buffers.
Support was later added for a device that uses bulk transfers and is
presumably a full-speed device with a maximum 64-byte wMaxPacketSize.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50; https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9; https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47
CVE: CVE-2021-47476
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

comedi: ni_usb6501: fix NULL-deref in command paths

The driver uses endpoint-sized USB transfer buffers but had no sanity
checks on the sizes. This can lead to zero-size-pointer dereferences or
overflowed transfer buffers in ni6501_port_command() and
ni6501_counter_command() if a (malicious) device has smaller max-packet
sizes than expected (or when doing descriptor fuzz testing).

Add the missing sanity checks to probe().
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4a9d43cb5d5f39fa39fc1da438517004cc95f7ea; https://git.kernel.org/stable/c/[PII_REDACTED]1b20ab219937b1c30a706590a59224; https://git.kernel.org/stable/c/907767da8f3a925b060c740e0b5c92ea7dbec440
CVE: CVE-2021-47477
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

comedi: dt9812: fix DMA buffers on stack

USB transfer buffers are typically mapped for DMA and must not be
allocated on the stack or transfers will fail.

Allocate proper transfer buffers in the various command helpers and
return an error on short transfers instead of acting on random stack
data.

Note that this also fixes a stack info leak on systems where DMA is not
used as 32 bytes are always sent to the device regardless of how short
the command is.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/20cebb8b620dc987e55ddc46801de986e081757e; https://git.kernel.org/stable/c/365a346cda82f51d835c49136a00a9df8a78c7f2; https://git.kernel.org/stable/c/39ea61037ae78f14fa121228dd962ea3280eacf3
CVE: CVE-2021-47478
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

isofs: Fix out of bound access for corrupted isofs image

When isofs image is suitably corrupted isofs_read_inode() can read data
beyond the end of buffer. Sanity-check the directory entry length before
using it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://git.kernel.org/stable/c/156ce5bb6cc43a80a743810199defb1dc3f55b7f; https://git.kernel.org/stable/c/6e80e9314f8bb52d9eabe[PII_REDACTED]ff01120f5; https://git.kernel.org/stable/c/86d4aedcbc69c0f84551fb70f953c24e396de2d7
CVE: CVE-2021-47479
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8712: fix use-after-free in rtl8712_dl_fw

Syzbot reported use-after-free in rtl8712_dl_fw(). The problem was in
race condition between r871xu_dev_remove() ->ndo_open() callback.

It's easy to see from crash log, that driver accesses released firmware
in ->ndo_open() callback. It may happen, since driver was releasing
firmware _before_ unregistering netdev. Fix it by moving
unregister_netdev() before cleaning up resources.

Call Trace:
...
 rtl871x_open_fw drivers/staging/rtl8712/hal_init.c:83 [inline]
 rtl8712_dl_fw+0xd95/0xe10 drivers/staging/rtl8712/hal_init.c:170
 rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]
 rtl871x_hal_init+0xae/0x180 drivers/staging/rtl8712/hal_init.c:394
 netdev_open+0xe6/0x6c0 drivers/staging/rtl8712/os_intfs.c:380
 __dev_open+0x2bc/0x4d0 net/core/dev.c:1484

Freed by task 1306:
...
 release_firmware+0x1b/0x30 drivers/base/firmware_loader/main.c:1053
 r871xu_dev_remove+0xcc/0x2c0 drivers/staging/rtl8712/usb_intf.c:599
 usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:458
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/a65c9afe9f2f55b7a7fb4a25ab654cd4139683a4; https://git.kernel.org/stable/c/befd23bd3b17f1a3f9c943a8580b47444c7c63ed; https://git.kernel.org/stable/c/c052cc1a069c3e575619cf64ec427eb41176ca70
CVE: CVE-2021-47480
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Put LLD module refcnt after SCSI device is released

SCSI host release is triggered when SCSI device is freed. We have to make
sure that the low-level device driver module won't be unloaded before SCSI
host instance is released because shost->hostt is required in the release
handler.

Make sure to put LLD module refcnt after SCSI device is released.

Fixes a kernel panic of 'BUG: unable to handle page fault for address'
reported by Changhui and Yi.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1105573d964f7b[PII_REDACTED]6b01f5f6ba8a1813; https://git.kernel.org/stable/c/1ce287eff9f23181d5644db787f472463a61f68b; https://git.kernel.org/stable/c/61a0faa89f21861d1f8d059123b5c285a5d9ffee
CVE: CVE-2021-47481
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR

Normally the zero fill would hide the missing initialization, but an
errant set to desc_size in reg_create() causes a crash:

  BUG: unable to handle page fault for address: [PII_REDACTED]
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP PTI
  CPU: 5 PID: 890 Comm: ib_write_bw Not tainted 5.15.0-rc4+ #47
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
  RIP: 0010:mlx5_ib_dereg_mr+0x14/0x3b0 [mlx5_ib]
  Code: 48 63 cd 4c 89 f7 48 89 0c 24 e8 37 30 03 e1 48 8b 0c 24 eb a0 90 0f 1f 44 00 00 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 30 <48> 8b 2f 65 48 8b 04 25 28 00 00 00 48 89 44 24 28 31 c0 8b 87 c8
  RSP: 0018:ffff88811afa3a60 EFLAGS: 00010286
  RAX:[PII_REDACTED]00001c RBX: [PII_REDACTED] RCX: [PII_REDACTED]
  RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: [PII_REDACTED]
  RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: c0000000fffff7ff
  R10: ffff88811afa38f8 R11: ffff88811afa38f0 R12: ffffffffa02c7ac0
  R13: [PII_REDACTED] R14: ffff88811afa3cd8 R15: ffff88810772fa00
  FS:  00007f47b9080740(0000) GS:ffff88852cd40000(0000) knlGS:[PII_REDACTED]
  CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
  CR2: [PII_REDACTED] CR3:[PII_REDACTED]61e003 CR4:[PII_REDACTED]370ea0
  DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
  DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
  Call Trace:
   mlx5_ib_free_odp_mr+0x95/0xc0 [mlx5_ib]
   mlx5_ib_dereg_mr+0x128/0x3b0 [mlx5_ib]
   ib_dereg_mr_user+0x45/0xb0 [ib_core]
   ? xas_load+0x8/0x80
   destroy_hw_idr_uobject+0x1a/0x50 [ib_uverbs]
   uverbs_destroy_uobject+0x2f/0x150 [ib_uverbs]
   uobj_destroy+0x3c/0x70 [ib_uverbs]
   ib_uverbs_cmd_verbs+0x467/0xb00 [ib_uverbs]
   ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]
   ? ttwu_queue_wakelist+0xa9/0xe0
   ? pty_write+0x85/0x90
   ? file_tty_write.isra.33+0x214/0x330
   ? process_echoes+0x60/0x60
   ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs]
   __x64_sys_ioctl+0x10d/0x8e0
   ? vfs_write+0x17f/0x260
   do_syscall_64+0x3c/0x80
   entry_SYSCALL_64_after_hwframe+0x44/0xae

Add the missing xarray initialization and remove the desc_size set.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/[PII_REDACTED]a0f555d7088203dec2614e41b5106e; https://git.kernel.org/stable/c/5f6995295f65d1ee6f36d466d26afd98eb797afe; https://git.kernel.org/stable/c/[PII_REDACTED]a0f555d7088203dec2614e41b5106e
CVE: CVE-2021-47482
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

net: batman-adv: fix error handling

Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was
in wrong error handling in batadv_mesh_init().

Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case
of any batadv_*_init() calls failure. This approach may work well, when
there is some kind of indicator, which can tell which parts of batadv are
initialized; but there isn't any.

All written above lead to cleaning up uninitialized fields. Even if we hide
ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit
GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]

To fix these bugs we can unwind batadv_*_init() calls one by one.
It is good approach for 2 reasons: 1) It fixes bugs on error handling
path 2) It improves the performance, since we won't call unneeded
batadv_*_free() functions.

So, this patch makes all batadv_*_init() clean up all allocated memory
before returning with an error to no call correspoing batadv_*_free()
and open-codes batadv_mesh_free() with proper order to avoid touching
uninitialized fields.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-544
References: https://git.kernel.org/stable/c/07533f1a673ce1126d0a72ef1e4b5eaaa3dd6d20; https://git.kernel.org/stable/c/0c6b199f09be489c48622537a550787fc80aea73; https://git.kernel.org/stable/c/6422e[PII_REDACTED]994fe8cc6d452b0dcd2c9483e
CVE: CVE-2021-47483
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

regmap: Fix possible double-free in regcache_rbtree_exit()

In regcache_rbtree_insert_to_block(), when 'present' realloc failed,
the 'blk' which is supposed to assign to 'rbnode->block' will be freed,
so 'rbnode->block' points a freed memory, in the error handling path of
regcache_rbtree_init(), 'rbnode->block' will be freed again in
regcache_rbtree_exit(), KASAN will report double-free as follows:

BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
Call Trace:
 slab_free_freelist_hook+0x10d/0x240
 kfree+0xce/0x390
 regcache_rbtree_exit+0x15d/0x1a0
 regcache_rbtree_init+0x224/0x2c0
 regcache_init+0x88d/0x1310
 __regmap_init+0x3151/0x4a80
 __devm_regmap_init+0x7d/0x100
 madera_spi_probe+0x10f/0x333 [madera_spi]
 spi_probe+0x183/0x210
 really_probe+0x285/0xc30

To fix this, moving up the assignment of rbnode->block to immediately after
the reallocation has succeeded so that the data structure stays valid even
if the second reallocation fails.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/1cead23c1c0bc766dacb900a3b0269f651ad596f; https://git.kernel.org/stable/c/36e911a16b377bde0ad91a8c679069d0d310b1a6; https://git.kernel.org/stable/c/3dae1a4eced3ee733d7222e69b8a55caf2d61091
CVE: CVE-2021-47484
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: Fix possible null pointer dereference.

This patch fixes possible null pointer dereference in files
"rvu_debugfs.c" and "rvu_nix.c"
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/c2d4c543f74c90f883e8ec62a31973ae8807d354; https://git.kernel.org/stable/c/f1e3cd1cc80204fd02b9e[PII_REDACTED]a2af90dc0; https://git.kernel.org/stable/c/c2d4c543f74c90f883e8ec62a31973ae8807d354
CVE: CVE-2021-47485
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields

Overflowing either addrlimit or bytes_togo can allow userspace to trigger
a buffer overflow of kernel memory. Check for overflows in all the places
doing math on user controlled buffers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/stable/c/0d[PII_REDACTED]608d123dad51def9fe50b7ebe952; https://git.kernel.org/stable/c/0f8cdfff06829a0b0348b6debc29ff6a61967724; https://git.kernel.org/stable/c/3f57c3f67fd93b4da86aeffea1ca32c484d054ad
CVE: CVE-2021-47486
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv, bpf: Fix potential NULL dereference

The bpf_jit_binary_free() function requires a non-NULL argument. When
the RISC-V BPF JIT fails to converge in NR_JIT_ITERATIONS steps,
jit_data->header will be NULL, which triggers a NULL
dereference. Avoid this by checking the argument, prior calling the
function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://git.kernel.org/stable/c/27de809a3d83a[PII_REDACTED]ebb19712533d6fd9b; https://git.kernel.org/stable/c/cac6b043cea3e120f4fccec16f7381747cbfdc0d; https://git.kernel.org/stable/c/e1b80a5ebe5431caeb20f88c32d4a024777a2d41
CVE: CVE-2021-47487
Published: 2024-05-22
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2021-47488
Published: 2024-05-22
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2021-47489
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix even more out of bound writes from debugfs

CVE-2021-42327 was fixed by:

commit f23750b5b3d98653b31d[PII_REDACTED]ef6364ad67
Author: Thelford Williams <tdwilliamsiv@gmail.com>
Date:   Wed Oct 13 16:04:13 2021 -0400

    drm/amdgpu: fix out of bounds write

but amdgpu_dm_debugfs.c contains more of the same issue so fix the
remaining ones.

v2:
	* Add missing fix in dp_max_bpc_write (Harry Wentland)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/1336b886b162fdc84708096ea152a61c0e1fc09c; https://git.kernel.org/stable/c/3f4e54bd312d3dafb59daf2b97ffa08abebe60f5; https://git.kernel.org/stable/c/9eb4bdd554fc31a5ef6bf645a20ff21618ce45a9
CVE: CVE-2021-47490
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: fix memleak in ttm_transfered_destroy

We need to cleanup the fences for ghost objects as well.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214029
Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214447
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0db55f9a1bafbe3dac750ea669de[PII_REDACTED]b5; https://git.kernel.org/stable/c/132a3d998d6753047f22152731fba2b0d6b463dd; https://git.kernel.org/stable/c/0db55f9a1bafbe3dac750ea669de[PII_REDACTED]b5
CVE: CVE-2021-47491
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: khugepaged: skip huge page collapse for special files

The read-only THP for filesystems will collapse THP for files opened
readonly and mapped with VM_EXEC.  The intended usecase is to avoid TLB
misses for large text segments.  But it doesn't restrict the file types
so a THP could be collapsed for a non-regular file, for example, block
device, if it is opened readonly and mapped with EXEC permission.  This
may cause bugs, like [1] and [2].

This is definitely not the intended usecase, so just collapse THP for
regular files in order to close the attack surface.

[shy828301@gmail.com: fix vm_file check [3]]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5fcb6fce74ffa614d964667110cf1a516c48c6d9; https://git.kernel.org/stable/c/6d67b2a73b8e3a079c355bab3c1aef7d85a044b8; https://git.kernel.org/stable/c/a4aeaa06d45e90f9b279f0b09de84bd00006e733
CVE: CVE-2021-47492
Published: 2024-05-22
Description: In the Linux kernel, the following vulnerability has been resolved:

mm, thp: bail out early in collapse_file for writeback page

Currently collapse_file does not explicitly check PG_writeback, instead,
page_has_private and try_to_release_page are used to filter writeback
pages.  This does not work for xfs with blocksize equal to or larger
than pagesize, because in such case xfs has no page->private.

This makes collapse_file bail out early for writeback page.  Otherwise,
xfs end_page_writeback will panic as follows.

  page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:ffff0003f88c86a8 index:0x0 pfn:0x84ef32
  aops:xfs_address_space_operations [xfs] ino:30000b7 dentry name:"libtest.so"
  flags: 0x57fffe[PII_REDACTED](locked|referenced|uptodate|active|writeback)
  raw: 57fffe[PII_REDACTED] ffff80001b48bc28 ffff80001b48bc28 ffff0003f88c86a8
  raw: [PII_REDACTED] [PII_REDACTED] 00000000ffffffff ffff0000c3e9a000
  page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u))
  page->mem_cgroup:ffff0000c3e9a000
  ------------[ cut here ]------------
  kernel BUG at include/linux/mm.h:1212!
  Internal error: Oops - BUG: 0 [#1] SMP
  Modules linked in:
  BUG: Bad page state in process khugepaged  pfn:84ef32
   xfs(E)
  page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:0 index:0x0 pfn:0x84ef32
   libcrc32c(E) rfkill(E) aes_ce_blk(E) crypto_simd(E) ...
  CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Tainted: ...
  pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
  Call trace:
    end_page_writeback+0x1c0/0x214
    iomap_finish_page_writeback+0x13c/0x204
    iomap_finish_ioend+0xe8/0x19c
    iomap_writepage_end_bio+0x38/0x50
    bio_endio+0x168/0x1ec
    blk_update_request+0x278/0x3f0
    blk_mq_end_request+0x34/0x15c
    virtblk_request_done+0x38/0x74 [virtio_blk]
    blk_done_softirq+0xc4/0x110
    __do_softirq+0x128/0x38c
    __irq_exit_rcu+0x118/0x150
    irq_exit+0x1c/0x30
    __handle_domain_irq+0x8c/0xf0
    gic_handle_irq+0x84/0x108
    el1_irq+0xcc/0x180
    arch_cpu_idle+0x18/0x40
    default_idle_call+0x4c/0x1a0
    cpuidle_idle_call+0x168/0x1e0
    do_idle+0xb4/0x104
    cpu_startup_entry+0x30/0x9c
    secondary_start_kernel+0x104/0x180
  Code: d4210000 b0006161 910c8021 94013f4d (d4210000)
  ---[ end trace 4a88c6a074082f8c ]---
  Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5e669d8ab30ab61dec3c36e27b4711f07611e6fc; https://git.kernel.org/stable/c/69a7fa5cb0de06c8956b040f19a7248c8c8308ca; https://git.kernel.org/stable/c/74c42e1baacf206338b1dd6b6199ac964512b5bb