deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-35593
Published: 2024-05-24
Description: An arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uploading a crafted PDF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/Joying-C/Cross-site-scripting-vulnerability/tree/main/Raingad-IM_Cross_site%20_scripting%20_vulnerability; https://github.com/Joying-C/Cross-site-scripting-vulnerability/tree/main/Raingad-IM_Cross_site%20_scripting%20_vulnerability
CVE: CVE-2024-35595
Published: 2024-05-24
Description: An arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code via uploading a crafted PDF file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Joying-C/Cross-site-scripting-vulnerability/blob/main/Xintongda-OA_Cross_site%20_scripting%20_vulnerability/Xintongda-OA_Cross_site%20_scripting%20_vulnerability.pdf; https://github.com/Joying-C/Cross-site-scripting-vulnerability/tree/main/Xintongda-OA_Cross_site%20_scripting%20_vulnerability; https://github.com/Joying-C/Cross-site-scripting-vulnerability/blob/main/Xintongda-OA_Cross_site%20_scripting%20_vulnerability/Xintongda-OA_Cross_site%20_scripting%20_vulnerability.pdf
CVE: CVE-2024-5273
Published: 2024-05-24
Description: Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by editing the workspace path.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2024/05/24/2; https://www.jenkins.io/security/advisory/2024-05-24/#SECURITY-3070; http://www.openwall.com/lists/oss-security/2024/05/24/2
CVE: CVE-2021-47499
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove

When ACPI type is ACPI_SMO8500, the data->dready_trig will not be set, the
memory allocated by iio_triggered_buffer_setup() will not be freed, and cause
memory leak as follows:

unreferenced object 0xffff[PII_REDACTED]00 (size 512):
  comm "i2c-SMO8500-125", pid 911, jiffies[PII_REDACTED] (age 83.852s)
  hex dump (first 32 bytes):
    02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 20 e2 e5 c0 ff ff ff ff  ........ .......
  backtrace:
    [<[PII_REDACTED]ce75ee>] kmem_cache_alloc_trace+0x16d/0x360
    [<000000000aeb17b0>] iio_kfifo_allocate+0x41/0x130 [kfifo_buf]
    [<000000004b40c1f5>] iio_triggered_buffer_setup_ext+0x2c/0x210 [industrialio_triggered_buffer]
    [<[PII_REDACTED]75b15f>] kxcjk1013_probe+0x10c3/0x1d81 [kxcjk_1013]

Fix it by remove data->dready_trig condition in probe and remove.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/14508fe13b1c578b3d2ba574f1d48b351975860c; https://git.kernel.org/stable/c/3899700ddacbf7aaafadf44464fff3ff0d4e3307; https://git.kernel.org/stable/c/60a55b9d91ba99eb8cf015bc46dc2de05e168a15
CVE: CVE-2021-47500
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: mma8452: Fix trigger reference couting

The mma8452 driver directly assigns a trigger to the struct iio_dev. The
IIO core when done using this trigger will call `iio_trigger_put()` to drop
the reference count by 1.

Without the matching `iio_trigger_get()` in the driver the reference count
can reach 0 too early, the trigger gets freed while still in use and a
use-after-free occurs.

Fix this by getting a reference to the trigger before assigning it to the
IIO device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/094d513b78b1714113bc016684b8142382e071ba; https://git.kernel.org/stable/c/794c0898f6bf39a458655d5fb4af70ec43a5cfcb; https://git.kernel.org/stable/c/acf0088ac073ca6e7f4cad6acac112177e08df5e
CVE: CVE-2021-47501
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc

When trying to dump VFs VSI RX/TX descriptors
using debugfs there was a crash
due to NULL pointer dereference in i40e_dbg_dump_desc.
Added a check to i40e_dbg_dump_desc that checks if
VSI type is correct for dumping RX/TX descriptors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/16431e442db248ecd8aa9457cf0a656f1885f56e; https://git.kernel.org/stable/c/23ec111bf3549aae37140330c31a16abfc172421; https://git.kernel.org/stable/c/e5b7fb2198abc50058f1a29c395b004f76ab1c83
CVE: CVE-2021-47502
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: wcd934x: handle channel mappping list correctly

Currently each channel is added as list to dai channel list, however
there is danger of adding same channel to multiple dai channel list
which endups corrupting the other list where its already added.

This patch ensures that the channel is actually free before adding to
the dai channel list and also ensures that the channel is on the list
before deleting it.

This check was missing previously, and we did not hit this issue as
we were testing very simple usecases with sequence of amixer commands.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1089dac26c6b4b833323ae6c0ceab29fb30ede72; https://git.kernel.org/stable/c/23ba28616d3063bd4c4953598ed5e439ca891101; https://git.kernel.org/stable/c/339ffb5b56005582aacc860524d2d208604049d1
CVE: CVE-2021-47503
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()

Calling scsi_remove_host() before scsi_add_host() results in a crash:

 BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 RIP: 0010:device_del+0x63/0x440
 Call Trace:
  device_unregister+0x17/0x60
  scsi_remove_host+0xee/0x2a0
  pm8001_pci_probe+0x6ef/0x1b90 [pm80xx]
  local_pci_probe+0x3f/0x90

We cannot call scsi_remove_host() in pm8001_alloc() because scsi_add_host()
has not been called yet at that point in time.

Function call tree:

  pm8001_pci_probe()
  |
  `- pm8001_pci_alloc()
  |  |
  |  `- pm8001_alloc()
  |     |
  |     `- scsi_remove_host()
  |
  `- scsi_add_host()
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1e434d2687e8bc0b3cdc9dd093c0e9047c0b4add; https://git.kernel.org/stable/c/[PII_REDACTED]41add87a6cf452e21950eebc6ac10b; https://git.kernel.org/stable/c/f8dccc1bdea7e21b5ec06c957aef8831c772661c
CVE: CVE-2021-47504
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring: ensure task_work gets run as part of cancelations

If we successfully cancel a work item but that work item needs to be
processed through task_work, then we can be sleeping uninterruptibly
in io_uring_cancel_generic() and never process it. Hence we don't
make forward progress and we end up with an uninterruptible sleep
warning.

While in there, correct a comment that should be IFF, not IIF.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/78a780602075d8b00c98070fa26e389b3b3efa72; https://git.kernel.org/stable/c/8e12976c0c19ebc14b60046b1348c516a74c25a2; https://git.kernel.org/stable/c/78a780602075d8b00c98070fa26e389b3b3efa72
CVE: CVE-2021-47505
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

aio: fix use-after-free due to missing POLLFREE handling

signalfd_poll() and binder_poll() are special in that they use a
waitqueue whose lifetime is the current task, rather than the struct
file as is normally the case.  This is okay for blocking polls, since a
blocking poll occurs within one task; however, non-blocking polls
require another solution.  This solution is for the queue to be cleared
before it is freed, by sending a POLLFREE notification to all waiters.

Unfortunately, only eventpoll handles POLLFREE.  A second type of
non-blocking poll, aio poll, was added in kernel v4.18, and it doesn't
handle POLLFREE.  This allows a use-after-free to occur if a signalfd or
binder fd is polled with aio poll, and the waitqueue gets freed.

Fix this by making aio poll handle POLLFREE.

A patch by Ramji Jiyani <ramjiyani@google.com>
(https://lore.kernel.org/r/[PII_REDACTED][PII_REDACTED]-1-ramjiyani@google.com)
tried to do this by making aio_poll_wake() always complete the request
inline if POLLFREE is seen.  However, that solution had two bugs.
First, it introduced a deadlock, as it unconditionally locked the aio
context while holding the waitqueue lock, which inverts the normal
locking order.  Second, it didn't consider that POLLFREE notifications
are missed while the request has been temporarily de-queued.

The second problem was solved by my previous patch.  This patch then
properly fixes the use-after-free by handling POLLFREE in a
deadlock-free way.  It does this by taking advantage of the fact that
freeing of the waitqueue is RCU-delayed, similar to what eventpoll does.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/321fba81ec034f88aea4898993c1bf15605c023f; https://git.kernel.org/stable/c/4105e6a128e8a98455dfc9e6dbb2ab0c33c4497f; https://git.kernel.org/stable/c/47ffefd88abfffe8a040bcc1dd0554d4ea6f7689
CVE: CVE-2021-47506
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix use-after-free due to delegation race

A delegation break could arrive as soon as we've called vfs_setlease.  A
delegation break runs a callback which immediately (in
nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru.  If we
then exit nfs4_set_delegation without hashing the delegation, it will be
freed as soon as the callback is done with it, without ever being
removed from del_recall_lru.

Symptoms show up later as use-after-free or list corruption warnings,
usually in the laundromat thread.

I suspect aba2072f4523 "nfsd: grant read delegations to clients holding
writes" made this bug easier to hit, but I looked as far back as v3.0
and it looks to me it already had the same problem.  So I'm not sure
where the bug was introduced; it may have been there from the beginning.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/04a8d07f3d58308b[PII_REDACTED]0799a3faa3ebce; https://git.kernel.org/stable/c/148c816f10fd11df27ca6a9b3238cdd42fa72cd3; https://git.kernel.org/stable/c/2becaa990b93cbd2928292c0b669d3abb6cf06d4
CVE: CVE-2021-47507
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

nfsd: Fix nsfd startup race (again)

Commit bd5ae9288d64 ("nfsd: register pernet ops last, unregister first")
has re-opened rpc_pipefs_event() race against nfsd_net_id registration
(register_pernet_subsys()) which has been fixed by commit bb7ffbf29e76
("nfsd: fix nsfd startup race triggering BUG_ON").

Restore the order of register_pernet_subsys() vs register_cld_notifier().
Add WARN_ON() to prevent a future regression.

Crash info:
Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
CPU: 8 PID: 345 Comm: mount Not tainted 5.4.144-... #1
pc : rpc_pipefs_event+0x54/0x120 [nfsd]
lr : rpc_pipefs_event+0x48/0x120 [nfsd]
Call trace:
 rpc_pipefs_event+0x54/0x120 [nfsd]
 blocking_notifier_call_chain
 rpc_fill_super
 get_tree_keyed
 rpc_fs_get_tree
 vfs_get_tree
 do_mount
 ksys_mount
 __arm64_sys_mount
 el0_svc_handler
 el0_svc
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/8bf902fee5893cfc2f04a698abab47629699ae9a; https://git.kernel.org/stable/c/b10252c7ae9c9d7c90552f88b544a44ee773af64; https://git.kernel.org/stable/c/c520943a00ad[PII_REDACTED]ad3304c956bcd49d25
CVE: CVE-2021-47508
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: free exchange changeset on failures

Fstests runs on my VMs have show several kmemleak reports like the following.

  unreferenced object 0xffff88811ae59080 (size 64):
    comm "xfs_io", pid 12124, jiffies[PII_REDACTED] (age 6.368s)
    hex dump (first 32 bytes):
      00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00  ................
      90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff  ................
    backtrace:
      [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs]
      [<[PII_REDACTED]e9f312>] set_state_bits+0x86/0xc0 [btrfs]
      [<[PII_REDACTED]fe73d6>] set_extent_bit+0x270/0x690 [btrfs]
      [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs]
      [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs]
      [<[PII_REDACTED]e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs]
      [<[PII_REDACTED]c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs]
      [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs]
      [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0
      [<[PII_REDACTED]dff6ff>] __iomap_dio_rw+0x1df/0x700
      [<[PII_REDACTED]67ba53>] iomap_dio_rw+0x5/0x20
      [<[PII_REDACTED]e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs]
      [<000000005eb3d845>] new_sync_write+0x106/0x180
      [<000000003fb505bf>] vfs_write+0x24d/0x2f0
      [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0
      [<000000003eba3fdf>] do_syscall_64+0x43/0x90

In case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata()
fail the allocated extent_changeset will not be freed.

So in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space()
free the allocated extent_changeset to get rid of the allocated memory.

The issue currently only happens in the direct IO write path, but only
after 65b3c08606e5 ("btrfs: fix ENOSPC failure when attempting direct IO
write into NOCOW range"), and also at defrag_one_locked_target(). Every
other place is always calling extent_changeset_free() even if its call
to btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has
failed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/ca06c5cb1b6dbfe67655b33c02fc394d65824519; https://git.kernel.org/stable/c/da5e817d9d75422eaaa05490d0b9a5e328fc1a51; https://git.kernel.org/stable/c/ca06c5cb1b6dbfe67655b33c02fc394d65824519
CVE: CVE-2021-47509
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: oss: Limit the period size to 16MB

Set the practical limit to the period size (the fragment shift in OSS)
instead of a full 31bit; a too large value could lead to the exhaust
of memory as we allocate temporary buffers of the period size, too.

As of this patch, we set to 16MB limit, which should cover all use
cases.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2e54cf6794bf82a54aaefc78da13819aea9cd28a; https://git.kernel.org/stable/c/35a3e[PII_REDACTED]41085f87dd9fb5b82ea5c00a2; https://git.kernel.org/stable/c/76f19e4cbb548e28547f8c328aa0bfb3a10222d3
CVE: CVE-2021-47511
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: oss: Fix negative period/buffer sizes

The period size calculation in OSS layer may receive a negative value
as an error, but the code there assumes only the positive values and
handle them with size_t.  Due to that, a too big value may be passed
to the lower layers.

This patch changes the code to handle with ssize_t and adds the proper
error checks appropriately.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/00a860678098fcd9fa8db2b5fb9d2ddf4776d4cc; https://git.kernel.org/stable/c/02b2b691b77cd7b951fa7b6c9d44d4e472cdc823; https://git.kernel.org/stable/c/502e1146873d870f87da3b8f93d6bf2de5f38d0c
CVE: CVE-2021-47513
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

net: dsa: felix: Fix memory leak in felix_setup_mmio_filtering

Avoid a memory leak if there is not a CPU port defined.

Addresses-Coverity-ID: 1492897 ("Resource leak")
Addresses-Coverity-ID: 1492899 ("Resource leak")
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/973a0373e88cc19129bd6ef0ec[PII_REDACTED]7d9; https://git.kernel.org/stable/c/e8b1d7698038e76363859fb47ae0a262080646f5; https://git.kernel.org/stable/c/973a0373e88cc19129bd6ef0ec[PII_REDACTED]7d9
CVE: CVE-2021-47514
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

devlink: fix netns refcount leak in devlink_nl_cmd_reload()

While preparing my patch series adding netns refcount tracking,
I spotted bugs in devlink_nl_cmd_reload()

Some error paths forgot to release a refcount on a netns.

To fix this, we can reduce the scope of get_net()/put_net()
section around the call to devlink_reload().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4b7e90672af8e0c78205db006f1b0a20ebd07f5f; https://git.kernel.org/stable/c/4dbb0dad8e63fcd0b5a117c2861d2abe7ff5f186; https://git.kernel.org/stable/c/fe30b70ca84da9c4aca85c03ad86e7a9b89c5ded
CVE: CVE-2021-47515
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

seg6: fix the iif in the IPv6 socket control block

When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving
interface index into the IPv4 socket control block (v5.16-rc4,
net/ipv4/ip_input.c line 510):

    IPCB(skb)->iif = skb->skb_iif;

If that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH
header, the seg6_do_srh_encap(...) performs the required encapsulation.
In this case, the seg6_do_srh_encap function clears the IPv6 socket control
block (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163):

    memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));

The memset(...) was introduced in commit ef489749aae5 ("ipv6: sr: clear
IP6CB(skb) on SRH ip4ip6 encapsulation") a long time ago (2019-01-29).

Since the IPv6 socket control block and the IPv4 socket control block share
the same memory area (skb->cb), the receiving interface index info is lost
(IP6CB(skb)->iif is set to zero).

As a side effect, that condition triggers a NULL pointer dereference if
commit 0857d6f8c759 ("ipv6: When forwarding count rx stats on the orig
netdev") is applied.

To fix that issue, we set the IP6CB(skb)->iif with the index of the
receiving interface once again.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/6431e71093f3da586a00c6d931481ffb0dc2db0e; https://git.kernel.org/stable/c/666521b3852d2b2f52d570f9122b1e4b50d96831; https://git.kernel.org/stable/c/98adb2bbfa407c9290bda299d4c6f7a1c4ebd5e1
CVE: CVE-2021-47516
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

nfp: Fix memory leak in nfp_cpp_area_cache_add()

In line 800 (#1), nfp_cpp_area_alloc() allocates and initializes a
CPP area structure. But in line 807 (#2), when the cache is allocated
failed, this CPP area structure is not freed, which will result in
memory leak.

We can fix it by freeing the CPP area when the cache is allocated
failed (#2).

792 int nfp_cpp_area_cache_add(struct nfp_cpp *cpp, size_t size)
793 {
794 	struct nfp_cpp_area_cache *cache;
795 	struct nfp_cpp_area *area;

800	area = nfp_cpp_area_alloc(cpp, NFP_CPP_ID(7, NFP_CPP_ACTION_RW, 0),
801 				  0, size);
	// #1: allocates and initializes

802 	if (!area)
803 		return -ENOMEM;

805 	cache = kzalloc(sizeof(*cache), GFP_KERNEL);
806 	if (!cache)
807 		return -ENOMEM; // #2: missing free

817	return 0;
818 }
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2e0e072e62fdaf7816220af08e05c020f0fcb77a; https://git.kernel.org/stable/c/3e93abcdcec0436fbf0b6a88ae[PII_REDACTED]95a2; https://git.kernel.org/stable/c/484069b5de9d223cc1c64c6f80389a99cfef51f1
CVE: CVE-2021-47517
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

ethtool: do not perform operations on net devices being unregistered

There is a short period between a net device starts to be unregistered
and when it is actually gone. In that time frame ethtool operations
could still be performed, which might end up in unwanted or undefined
behaviours[1].

Do not allow ethtool operations after a net device starts its
unregistration. This patch targets the netlink part as the ioctl one
isn't affected: the reference to the net device is taken and the
operation is executed within an rtnl lock section and the net device
won't be found after unregister.

[1] For example adding Tx queues after unregister ends up in NULL
    pointer exceptions and UaFs, such as:

      BUG: KASAN: use-after-free in kobject_get+0x14/0x90
      Read of size 1 at addr ffff[PII_REDACTED]8c by task ethtool/755

      CPU: 0 PID: 755 Comm: ethtool Not tainted 5.15.0-rc6+ #778
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/014
      Call Trace:
       dump_stack_lvl+0x57/0x72
       print_address_description.constprop.0+0x1f/0x140
       kasan_report.cold+0x7f/0x11b
       kobject_get+0x14/0x90
       kobject_add_internal+0x3d1/0x450
       kobject_init_and_add+0xba/0xf0
       netdev_queue_update_kobjects+0xcf/0x200
       netif_set_real_num_tx_queues+0xb4/0x310
       veth_set_channels+0x1c3/0x550
       ethnl_set_channels+0x524/0x610
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/7c26da3be1e9843a15b5318f90db8a564479d2ac; https://git.kernel.org/stable/c/cfd719f04267108f5f5bf802b9d7de69e99a99f9; https://git.kernel.org/stable/c/dde91ccfa25fd58f64c397d91b81a4b393100ffa
CVE: CVE-2021-47518
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done

The done() netlink callback nfc_genl_dump_ses_done() should check if
received argument is non-NULL, because its allocation could fail earlier
in dumpit() (nfc_genl_dump_ses()).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3b861a40325eac9c4c13b6c53874ad90617e944d; https://git.kernel.org/stable/c/48fcd08fdbe05e35b650a252ec2a2d96057a1c7a; https://git.kernel.org/stable/c/4cd8371a234d051f9c9557fcbb1f8c523b1c0d10
CVE: CVE-2021-47519
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

can: m_can: m_can_read_fifo: fix memory leak in error branch

In m_can_read_fifo(), if the second call to m_can_fifo_read() fails,
the function jump to the out_fail label and returns without calling
m_can_receive_skb(). This means that the skb previously allocated by
alloc_can_skb() is not freed. In other terms, this is a memory leak.

This patch adds a goto label to destroy the skb if an error occurs.

Issue was found with GCC -fanalyzer, please follow the link below for
details.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/31cb32a590d62b18f69a9a6d433f4e69c74fdd56; https://git.kernel.org/stable/c/75a422165477dd12d2d20aa7c9ee7c9a281c9908; https://git.kernel.org/stable/c/31cb32a590d62b18f69a9a6d433f4e69c74fdd56
CVE: CVE-2021-47520
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

can: pch_can: pch_can_rx_normal: fix use after free

After calling netif_receive_skb(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is dereferenced
just after the call netif_receive_skb(skb).

Reordering the lines solves the issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/3a3c46e2eff[PII_REDACTED]a203be1a8295f4acb76; https://git.kernel.org/stable/c/3e193ef4e0a3f5bf92ede83ef214cb09d01b00aa; https://git.kernel.org/stable/c/6c73fc931658d8cbc8a1714b326cb31eb71d16a7