deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4291
Published: 2024-04-27
Description: A vulnerability was found in Tenda A301 15.13.08.12_multi_TDE01. It has been rated as critical. This issue affects the function formAddMacfilterRule of the file /goform/setBlackRule. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-262223. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/L1ziang/Vulnerability/blob/main/formAddMacfilterRule.md; https://vuldb.com/?ctiid.262223; https://vuldb.com/?id.262223
CVE: CVE-2024-4292
Published: 2024-04-27
Description: A vulnerability classified as critical has been found in Contemporary Controls BASrouter BACnet BASRT-B 2.7.2. Affected is an unknown function of the component Device-Communication-Control Service. The manipulation with the input 55ff[PII_REDACTED]f[PII_REDACTED]6110afb7519035d0841e4bece257b6acfc71f leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262224. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASER-B_backdoor.pcapng; https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASRT_CVE_apply.pdf; https://vuldb.com/?ctiid.262224
CVE: CVE-2024-33851
Published: 2024-04-27
Description: phpecc, as used in paragonie/phpecc before 2.0.1, has a branch-based timing leak in Point addition. (This is related to phpecc/phpecc on GitHub, and the Matyas Danter ECC library.)
CVSS Score: 4.3 (MEDIUM)
References: https://github.com/paragonie/phpecc/releases/tag/v2.0.1; https://github.com/paragonie/phpecc/releases/tag/v2.0.1
CVE: CVE-2024-4293
Published: 2024-04-27
Description: A vulnerability classified as problematic was found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file appointment-bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262225 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Sospiro014/zday1/blob/main/doctor_appointment_management_system_xss.md; https://vuldb.com/?ctiid.262225; https://vuldb.com/?id.262225
CVE: CVE-2022-48684
Published: 2024-04-27
Description: An issue was discovered in Logpoint before 7.1.1. Template injection was seen in the search template. The search template uses jinja templating for generating dynamic data. This could be abused to achieve code execution. Any user with access to create a search template can leverage this to execute code as the loginspect user.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]885-Template-injection-in-Search-Template; https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]885-Template-injection-in-Search-Template
CVE: CVE-2022-48685
Published: 2024-04-27
Description: An issue was discovered in Logpoint 7.1 before 7.1.2. The daily executed cron file clean_secbi_old_logs is writable by all users and is executed as root, leading to privilege escalation.
CVSS Score: 7.7 (HIGH)
CWE: CWE-276
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]277-Privilege-Escalation-Through-Cronjob; https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]277-Privilege-Escalation-Through-Cronjob
CVE: CVE-2024-4294
Published: 2024-04-27
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this issue is some unknown functionality of the file /doctor/view-appointment-detail.php. The manipulation of the argument editid leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-262226 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-99, CWE-639
References: https://github.com/Sospiro014/zday1/blob/main/doctor_appointment_management_system_idor.md; https://vuldb.com/?ctiid.262226; https://vuldb.com/?id.262226
CVE: CVE-2023-52722
Published: 2024-04-28
Description: An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2024/06/28/2; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=afd7188f74918cb51b5fb89f52b54eb16e8acfd1; http://www.openwall.com/lists/oss-security/2024/06/28/2
CVE: CVE-2024-26927
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Add some bounds checking to firmware data

Smatch complains about "head->full_size - head->header_size" can
underflow.  To some extent, we're always going to have to trust the
firmware a bit.  However, it's easy enough to add a check for negatives,
and let's add a upper bounds check as well.
CVSS Score: 8.4 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/stable/c/044e220667157fb9d59320341badec59cf45ba48; https://git.kernel.org/stable/c/98f681b0f84cfc3a1d83287b77697679e0398306; https://git.kernel.org/stable/c/9eeb8e1231f6450c574c1db979122e171a1813ab
CVE: CVE-2024-26928
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in cifs_debug_files_proc_show()

Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/[PII_REDACTED]02db62559ecacba127067c22ee7b88; https://git.kernel.org/stable/c/3402faf78b2516b0af1259baff50cc8453ef0bd1; https://git.kernel.org/stable/c/8f8718afd446cd4ea3b62bacc3eec09f8aae85ee
CVE: CVE-2022-48631
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0

When walking through an inode extents, the ext4_ext_binsearch_idx() function
assumes that the extent header has been previously validated.  However, there
are no checks that verify that the number of entries (eh->eh_entries) is
non-zero when depth is > 0.  And this will lead to problems because the
EXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this:

[  135.245946] ------------[ cut here ]------------
[  135.247579] kernel BUG at fs/ext4/extents.c:2258!
[  135.249045] invalid opcode: 0000 [#1] PREEMPT SMP
[  135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4
[  135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014
[  135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0
[  135.256475] Code:
[  135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246
[  135.262847] RAX: [PII_REDACTED] RBX: ffffc90000593b70 RCX: [PII_REDACTED]
[  135.264765] RDX: ffff8880038e5f10 RSI: [PII_REDACTED] RDI: ffff8880046e922c
[  135.266670] RBP: ffff8880046e9348 R08: [PII_REDACTED] R09: ffff888002ca580c
[  135.268576] R10: [PII_REDACTED] R11: [PII_REDACTED] R12: [PII_REDACTED]
[  135.270477] R13: [PII_REDACTED] R14: [PII_REDACTED] R15: [PII_REDACTED]
[  135.272394] FS:  00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:[PII_REDACTED]
[  135.274510] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[  135.276075] CR2: 00007ffc26bd4f00 CR3: [PII_REDACTED] CR4:[PII_REDACTED]170ea0
[  135.277952] Call Trace:
[  135.278635]  <TASK>
[  135.279247]  ? preempt_count_add+0x6d/0xa0
[  135.280358]  ? percpu_counter_add_batch+0x55/0xb0
[  135.281612]  ? _raw_read_unlock+0x18/0x30
[  135.282704]  ext4_map_blocks+0x294/0x5a0
[  135.283745]  ? xa_load+0x6f/0xa0
[  135.284562]  ext4_mpage_readpages+0x3d6/0x770
[  135.285646]  read_pages+0x67/0x1d0
[  135.286492]  ? folio_add_lru+0x51/0x80
[  135.287441]  page_cache_ra_unbounded+0x124/0x170
[  135.288510]  filemap_get_pages+0x23d/0x5a0
[  135.289457]  ? path_openat+0xa72/0xdd0
[  135.290332]  filemap_read+0xbf/0x300
[  135.291158]  ? _raw_spin_lock_irqsave+0x17/0x40
[  135.292192]  new_sync_read+0x103/0x170
[  135.293014]  vfs_read+0x15d/0x180
[  135.293745]  ksys_read+0xa1/0xe0
[  135.294461]  do_syscall_64+0x3c/0x80
[  135.295284]  entry_SYSCALL_64_after_hwframe+0x46/0xb0

This patch simply adds an extra check in __ext4_ext_check(), verifying that
eh_entries is not 0 when eh_depth is > 0.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/29a5b8a137ac8eb410cc823653a29ac0e7b7e1b0; https://git.kernel.org/stable/c/2f5e9de15e4f55fbf56f22d4a2ce406246cc462d; https://git.kernel.org/stable/c/958b0ee23f5ac106e7cc11472b71aa2ea9a033bc
CVE: CVE-2022-48632
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()

memcpy() is called in a loop while 'operation->length' upper bound
is not checked and 'data_idx' also increments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8; https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e; https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2
CVE: CVE-2022-48635
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

fsdax: Fix infinite loop in dax_iomap_rw()

I got an infinite loop and a WARNING report when executing a tail command
in virtiofs.

  WARNING: CPU: 10 PID: 964 at fs/iomap/iter.c:34 iomap_iter+0x3a2/0x3d0
  Modules linked in:
  CPU: 10 PID: 964 Comm: tail Not tainted 5.19.0-rc7
  Call Trace:
  <TASK>
  dax_iomap_rw+0xea/0x620
  ? __this_cpu_preempt_check+0x13/0x20
  fuse_dax_read_iter+0x47/0x80
  fuse_file_read_iter+0xae/0xd0
  new_sync_read+0xfe/0x180
  ? 0xffffffff81000000
  vfs_read+0x14d/0x1a0
  ksys_read+0x6d/0xf0
  __x64_sys_read+0x1a/0x20
  do_syscall_64+0x3b/0x90
  entry_SYSCALL_64_after_hwframe+0x63/0xcd

The tail command will call read() with a count of 0. In this case,
iomap_iter() will report this WARNING, and always return 1 which casuing
the infinite loop in dax_iomap_rw().

Fixing by checking count whether is 0 in dax_iomap_rw().
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-835
References: https://git.kernel.org/stable/c/17d9c15c9b9e7fb285f7ac5367dfb5f00ff575e3; https://git.kernel.org/stable/c/463f36137c40342fb03bba380c1bf703c40d89a6; https://git.kernel.org/stable/c/60644dffac87b1bb47bdb393aa29d5f2ffcf41a0
CVE: CVE-2022-48636
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup

Fix Oops in dasd_alias_get_start_dev() function caused by the pavgroup
pointer being NULL.

The pavgroup pointer is checked on the entrance of the function but
without the lcu->lock being held. Therefore there is a race window
between dasd_alias_get_start_dev() and _lcu_update() which sets
pavgroup to NULL with the lcu->lock held.

Fix by checking the pavgroup pointer with lcu->lock held.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2e473351400e3dd66f0b71eddcef82ee45a584c1; https://git.kernel.org/stable/c/49f401a98b318761ca2e15d4c7869a20043fbed4; https://git.kernel.org/stable/c/650a2e79d176db753654d3dde88e53a2033036ac
CVE: CVE-2022-48637
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

bnxt: prevent skb UAF after handing over to PTP worker

When reading the timestamp is required bnxt_tx_int() hands
over the ownership of the completed skb to the PTP worker.
The skb should not be used afterwards, as the worker may
run before the rest of our code and free the skb, leading
to a use-after-free.

Since dev_kfree_skb_any() accepts NULL make the loss of
ownership more obvious and set skb to NULL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/08483e4c0c83b221b8891434a04cec405dee94a6; https://git.kernel.org/stable/c/32afa1f23e42cc635ccf4c39f24514d03d1e8338; https://git.kernel.org/stable/c/c31f26c8f69f776759cbbdfb38e40ea91aa0dd65
CVE: CVE-2022-48638
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

cgroup: cgroup_get_from_id() must check the looked-up kn is a directory

cgroup has to be one kernfs dir, otherwise kernel panic is caused,
especially cgroup id is provide from userspace.
CVSS Score: 5.3 (MEDIUM)
References: https://git.kernel.org/stable/c/1e9571887f97b17cf3ffe9aa4da89090ea60988b; https://git.kernel.org/stable/c/8484a356cee8ce3d6a8e6266ff99be326e9273ad; https://git.kernel.org/stable/c/df02452f3df069a59bc9e69c84435bf115cb6e37
CVE: CVE-2022-48639
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

net: sched: fix possible refcount leak in tc_new_tfilter()

tfilter_put need to be called to put the refount got by tp->ops->get to
avoid possible refcount leak when chain->tmplt_ops != NULL and
chain->tmplt_ops != tp->ops.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0559d91ee3a2cd81b15ad5cd507539d6da867f88; https://git.kernel.org/stable/c/8844c750eeb03452e2b3319c27a526f447b82596; https://git.kernel.org/stable/c/903f7d322c17d8e306d766404b4604e81653902a
CVE: CVE-2022-48641
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: fix memory leak when blob is malformed

The bug fix was incomplete, it "replaced" crash with a memory leak.
The old code had an assignment to "ret" embedded into the conditional,
restore this.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/11ebf32fde46572b0aaf3c2bdd97d923ef5a03ab; https://git.kernel.org/stable/c/1e98318af2f163eadaff815abcef38d27ca92c1e; https://git.kernel.org/stable/c/38cf372b17f0a5f35c1b716a100532d539f0eb33
CVE: CVE-2022-48642
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()

It seems to me that percpu memory for chain stats started leaking since
commit 3bc158f8d0330f0a ("netfilter: nf_tables: map basechain priority to
hardware priority") when nft_chain_offload_priority() returned an error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/08d7524f366a886b99b1630a24a27dd6e0d7f852; https://git.kernel.org/stable/c/985b031667c3177b9e7fb9787b989628e4271714; https://git.kernel.org/stable/c/9a4d6dd554b86e65581ef6b6638a39ae079b17ac
CVE: CVE-2022-48643
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()

syzbot is reporting underflow of nft_counters_enabled counter at
nf_tables_addchain() [1], for commit 43eb8949cfdffa76 ("netfilter:
nf_tables: do not leave chain stats enabled on error") missed that
nf_tables_chain_destroy() after nft_basechain_init() in the error path of
nf_tables_addchain() decrements the counter because nft_basechain_init()
makes nft_is_base_chain() return true by setting NFT_CHAIN_BASE flag.

Increment the counter immediately after returning from
nft_basechain_init().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: https://git.kernel.org/stable/c/710e3f526bd23a0d33435dedc52c3144de284378; https://git.kernel.org/stable/c/8bcad2a931313aeba076b76922d5813ef97d0a91; https://git.kernel.org/stable/c/91aa52652f4b37089aff3cb53e83049d826fef6d
CVE: CVE-2022-48645
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

net: enetc: deny offload of tc-based TSN features on VF interfaces

TSN features on the ENETC (taprio, cbs, gate, police) are configured
through a mix of command BD ring messages and port registers:
enetc_port_rd(), enetc_port_wr().

Port registers are a region of the ENETC memory map which are only
accessible from the PCIe Physical Function. They are not accessible from
the Virtual Functions.

Moreover, attempting to access these registers crashes the kernel:

$ echo 1 > /sys/bus/pci/devices/0000\:00\:00.0/sriov_numvfs
pci 0000:00:01.0: [1957:ef00] type 00 class 0x020001
fsl_enetc_vf 0000:00:01.0: Adding to iommu group 15
fsl_enetc_vf 0000:00:01.0: enabling device (0000 -> 0002)
fsl_enetc_vf 0000:00:01.0 eno0vf0: renamed from eth0
$ tc qdisc replace dev eno0vf0 root taprio num_tc 8 map 0 1 2 3 4 5 6 7 \
	queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \
	sched-entry S 0x7f 900000 sched-entry S 0x80 100000 flags 0x2
Unable to handle kernel paging request at virtual address ffff800009551a08
Internal error: Oops: 96000007 [#1] PREEMPT SMP
pc : enetc_setup_tc_taprio+0x170/0x47c
lr : enetc_setup_tc_taprio+0x16c/0x47c
Call trace:
 enetc_setup_tc_taprio+0x170/0x47c
 enetc_setup_tc+0x38/0x2dc
 taprio_change+0x43c/0x970
 taprio_init+0x188/0x1e0
 qdisc_create+0x114/0x470
 tc_modify_qdisc+0x1fc/0x6c0
 rtnetlink_rcv_msg+0x12c/0x390

Split enetc_setup_tc() into separate functions for the PF and for the
VF drivers. Also remove enetc_qos.o from being included into
enetc-vf.ko, since it serves absolutely no purpose there.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/23022b74b1a23bed044f6bc96cf92f6ca5f3e75f; https://git.kernel.org/stable/c/510e703e4ed0e011db860bc21228aff48fc9eea7; https://git.kernel.org/stable/c/5641c751fe2f92d3d9e8a8e03c1263ac8caa0b42
CVE: CVE-2022-48646
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

sfc/siena: fix null pointer dereference in efx_hard_start_xmit

Like in previous patch for sfc, prevent potential (but unlikely) NULL
pointer dereference.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/589c6eded10c77a12b7b2cf235b6b19a2bdb91fa; https://git.kernel.org/stable/c/a4eadca702dff0768dd01be6789bbec2a18e5b0a; https://git.kernel.org/stable/c/589c6eded10c77a12b7b2cf235b6b19a2bdb91fa
CVE: CVE-2022-48647
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

sfc: fix TX channel offset when using legacy interrupts

In legacy interrupt mode the tx_channel_offset was hardcoded to 1, but
that's not correct if efx_sepparate_tx_channels is false. In that case,
the offset is 0 because the tx queues are in the single existing channel
at index 0, together with the rx queue.

Without this fix, as soon as you try to send any traffic, it tries to
get the tx queues from an uninitialized channel getting these errors:
  WARNING: CPU: 1 PID: 0 at drivers/net/ethernet/sfc/tx.c:540 efx_hard_start_xmit+0x12e/0x170 [sfc]
  [...]
  RIP: 0010:efx_hard_start_xmit+0x12e/0x170 [sfc]
  [...]
  Call Trace:
   <IRQ>
   dev_hard_start_xmit+0xd7/0x230
   sch_direct_xmit+0x9f/0x360
   __dev_queue_xmit+0x890/0xa40
  [...]
  BUG: unable to handle kernel NULL pointer dereference at [PII_REDACTED]
  [...]
  RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]
  [...]
  Call Trace:
   <IRQ>
   dev_hard_start_xmit+0xd7/0x230
   sch_direct_xmit+0x9f/0x360
   __dev_queue_xmit+0x890/0xa40
  [...]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/360910b88d1466a90644a4e0533803b594344a2b; https://git.kernel.org/stable/c/5f623a77cfc2d501d72bcb4f9ee71721e6c766ff; https://git.kernel.org/stable/c/b4afd3878f961d3517f27b3213730fceef77945c
CVE: CVE-2022-48648
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

sfc: fix null pointer dereference in efx_hard_start_xmit

Trying to get the channel from the tx_queue variable here is wrong
because we can only be here if tx_queue is NULL, so we shouldn't
dereference it. As the above comment in the code says, this is very
unlikely to happen, but it's wrong anyway so let's fix it.

I hit this issue because of a different bug that caused tx_queue to be
NULL. If that happens, this is the error message that we get here:
  BUG: unable to handle kernel NULL pointer dereference at [PII_REDACTED]
  [...]
  RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0a242eb2913a4aa3d6fbdb86559f27628e9466f3; https://git.kernel.org/stable/c/8547c7bfc0617e7184e4da65b9b96681fcfe9998; https://git.kernel.org/stable/c/b3b41d4d95d3822b2e459ecbc80d030ea6aec5e7
CVE: CVE-2022-48649
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/slab_common: fix possible double free of kmem_cache

When doing slub_debug test, kfence's 'test_memcache_typesafe_by_rcu'
kunit test case cause a use-after-free error:

  BUG: KASAN: use-after-free in kobject_del+0x14/0x30
  Read of size 8 at addr ffff[PII_REDACTED]90 by task kunit_try_catch/261

  CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G    B            N 6.0.0-rc5-next-20220916 #17
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
  Call Trace:
   <TASK>
   dump_stack_lvl+0x34/0x48
   print_address_description.constprop.0+0x87/0x2a5
   print_report+0x103/0x1ed
   kasan_report+0xb7/0x140
   kobject_del+0x14/0x30
   kmem_cache_destroy+0x130/0x170
   test_exit+0x1a/0x30
   kunit_try_run_case+0xad/0xc0
   kunit_generic_run_threadfn_adapter+0x26/0x50
   kthread+0x17b/0x1b0
   </TASK>

The cause is inside kmem_cache_destroy():

kmem_cache_destroy
    acquire lock/mutex
    shutdown_cache
        schedule_work(kmem_cache_release) (if RCU flag set)
    release lock/mutex
    kmem_cache_release (if RCU flag not set)

In some certain timing, the scheduled work could be run before
the next RCU flag checking, which can then get a wrong value
and lead to double kmem_cache_release().

Fix it by caching the RCU flag inside protected area, just like 'refcnt'
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-416
References: https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f; https://git.kernel.org/stable/c/d71608a877362becdc94191f190902fac1e64d35; https://git.kernel.org/stable/c/c673c6ceac53fb2e631c9fbbd79957099a08927f
CVE: CVE-2022-48650
Published: 2024-04-28
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()

Commit 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG")
made the __qlt_24xx_handle_abts() function return early if
tcm_qla2xxx_find_cmd_by_tag() didn't find a command, but it missed to clean
up the allocated memory for the management command.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/601be20fc6a1b762044d2398befffd6bf236cebf; https://git.kernel.org/stable/c/6a4236ed47f5b0a57eb6b8fb1c351b15b3d341d7; https://git.kernel.org/stable/c/89df49e561b4a8948521fc3f8a013012eaa08f82