deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-6579
Published: 2024-07-16
Description: The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress is vulnerable to unauthorized plugin settings modification due to a missing capability check on several plugin functions in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change some of the plugin settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/vc-addons-by-bit14/tags/1.4.5/bit14-vc-addons.php#L102; https://plugins.trac.wordpress.org/browser/vc-addons-by-bit14/tags/1.4.5/bit14-vc-addons.php#L114; https://plugins.trac.wordpress.org/browser/vc-addons-by-bit14/tags/1.4.5/bit14-vc-addons.php#L125
CVE: CVE-2024-6457
Published: 2024-07-16
Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all versions up to, and including, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_author/index.php#L102; https://plugins.trac.wordpress.org/changeset/3116888/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfdf7b1-9bb8-4c1d-a00a-ca1e44440cab?source=cve
CVE: CVE-2024-6621
Published: 2024-07-16
Description: The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprss_activate_feed_source' and 'wprss_pause_feed_source' functions in all versions up to, and including, 4.23.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or pause existing RSS feeds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/feed-states.php#L12; https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/feed-states.php#L28; https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/feed-states.php?rev=3118231
CVE: CVE-2021-47622
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: Fix a deadlock in the error handler

The following deadlock has been observed on a test setup:

 - All tags allocated

 - The SCSI error handler calls ufshcd_eh_host_reset_handler()

 - ufshcd_eh_host_reset_handler() queues work that calls
   ufshcd_err_handler()

 - ufshcd_err_handler() locks up as follows:

Workqueue: ufs_eh_wq_0 ufshcd_err_handler.cfi_jt
Call trace:
 __switch_to+0x298/0x5d8
 __schedule+0x6cc/0xa94
 schedule+0x12c/0x298
 blk_mq_get_tag+0x210/0x480
 __blk_mq_alloc_request+0x1c8/0x284
 blk_get_request+0x74/0x134
 ufshcd_exec_dev_cmd+0x68/0x640
 ufshcd_verify_dev_init+0x68/0x35c
 ufshcd_probe_hba+0x12c/0x1cb8
 ufshcd_host_reset_and_restore+0x88/0x254
 ufshcd_reset_and_restore+0xd0/0x354
 ufshcd_err_handler+0x408/0xc58
 process_one_work+0x24c/0x66c
 worker_thread+0x3e8/0xa4c
 kthread+0x150/0x1b4
 ret_from_fork+0x10/0x30

Fix this lockup by making ufshcd_exec_dev_cmd() allocate a reserved
request.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/493c9e850677df8b4eda150c2364b1c1a72ed724; https://git.kernel.org/stable/c/945c3cca05d78351bba29fa65d93834cb7934c7b; https://git.kernel.org/stable/c/d69d98d8edf90e25e4e09930dd36dd6d09dd6768
CVE: CVE-2021-47623
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/fixmap: Fix VM debug warning on unmap

Unmapping a fixmap entry is done by calling __set_fixmap()
with FIXMAP_PAGE_CLEAR as flags.

Today, powerpc __set_fixmap() calls map_kernel_page().

map_kernel_page() is not happy when called a second time
for the same page.

	WARNING: CPU: 0 PID: 1 at arch/powerpc/mm/pgtable.c:194 set_pte_at+0xc/0x1e8
	CPU: 0 PID: 1 Comm: swapper Not tainted 5.16.0-rc3-s3k-dev-01993-g350ff07feb7d-dirty #682
	NIP:  c0017cd4 LR: c00187f0 CTR: 00000010
	REGS: e1011d50 TRAP: 0700   Not tainted  (5.16.0-rc3-s3k-dev-01993-g350ff07feb7d-dirty)
	MSR:  00029032 <EE,ME,IR,DR,RI>  CR: 42000208  XER: 00000000

	GPR00: c0165fec e1011e10 c14c0000 c0ee2550 ff800000 c0f3d[PII_REDACTED]0 c001686c
	GPR08: 00001000 b00045a9 00000001 c0f58460 c0f50[PII_REDACTED]0 c0007e10 00000000
	GPR16: [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
	GPR24: [PII_REDACTED] c0ee2[PII_REDACTED]0 c0f57000 00000ff8 00000000 ff800000
	NIP [c0017cd4] set_pte_at+0xc/0x1e8
	LR [c00187f0] map_kernel_page+0x9c/0x100
	Call Trace:
	[e1011e10] [c0736c68] vsnprintf+0x358/0x6c8 (unreliable)
	[e1011e30] [c0165fec] __set_fixmap+0x30/0x44
	[e1011e40] [c0c13bdc] early_iounmap+0x11c/0x170
	[e1011e70] [c0c06cb0] ioremap_legacy_serial_console+0x88/0xc0
	[e1011e90] [c0c03634] do_one_initcall+0x80/0x178
	[e1011ef0] [c0c0385c] kernel_init_freeable+0xb4/0x250
	[e1011f20] [c0007e34] kernel_init+0x24/0x140
	[e1011f30] [c0016268] ret_from_kernel_thread+0x5c/0x64
	Instruction dump:
	7fe3fb78 [PII_REDACTED] 7c630034 83e1000c 5463d97e 7c0803a6 38210010
	4e[PII_REDACTED]0000 712a0[PII_REDACTED]8 <0fe00000> 9421ffe0 93e1001c 48000030

Implement unmap_kernel_page() which clears an existing pte.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/033fd42c18d9b2121595b6f1e8419a115f9ac5b7; https://git.kernel.org/stable/c/43ae0ccc4d2722b833fb59b905af129428e06d03; https://git.kernel.org/stable/c/67baac10dd5ad1e9f50e8f2659984b3b0728d54e
CVE: CVE-2021-47624
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change

The refcount leak issues take place in an error handling path. When the
3rd argument buf doesn't match with "offline", "online" or "remove", the
function simply returns -EINVAL and forgets to decrease the reference
count of a rpc_xprt object and a rpc_xprt_switch object increased by
rpc_sysfs_xprt_kobj_get_xprt() and
rpc_sysfs_xprt_kobj_get_xprt_switch(), causing reference count leaks of
both unused objects.

Fix this issue by jumping to the error handling path labelled with
out_put when buf matches none of "offline", "online" or "remove".
CVSS Score: 7.1 (HIGH)
References: https://git.kernel.org/stable/c/4b22aa42bd4d2d630ef1854c139275c3532937cb; https://git.kernel.org/stable/c/5f6024c05a2c0fdd180b29395aaf686d25af3a0f; https://git.kernel.org/stable/c/776d794f28c95051bc70405a7b1fa40115658a18
CVE: CVE-2022-48773
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create

If there are failures then we must not leave the non-NULL pointers with
the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries
free them, resulting in an Oops.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1e7433fb95ccc01629a5edaa4ced0cd8c98d0ae0; https://git.kernel.org/stable/c/2526d4d8b209dc5ac1fbeb[PII_REDACTED]88b2a141; https://git.kernel.org/stable/c/9921c866dc369577c3ebb9adf2383b01b58c18de
CVE: CVE-2022-48774
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: ptdma: Fix the error handling path in pt_core_init()

In order to free resources correctly in the error handling path of
pt_core_init(), 2 goto's have to be switched. Otherwise, some resources
will leak and we will try to release things that have not been allocated
yet.

Also move a dev_err() to a place where it is more meaningful.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3c62fd3406e0b2277c76a6984d3979c7f3f1d129; https://git.kernel.org/stable/c/3e41445287afa3cf6d572778e5aab31d25e60a8d; https://git.kernel.org/stable/c/d7de1e4820c5a42441ff7276174c8c0e63575c1b
CVE: CVE-2022-48775
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj

kobject_init_and_add() takes reference even when it fails.
According to the doc of kobject_init_and_add()：

   If this function returns an error, kobject_put() must be called to
   properly clean up the memory associated with the object.

Fix memory leak by calling kobject_put().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/417947891bd5ae327f15efed1a0da2b12ef24962; https://git.kernel.org/stable/c/8bc69f86328e87a0ffa79438430cc82f3aa6a194; https://git.kernel.org/stable/c/91d8866ca55232d21995a3d54fac96de33c9e20c
CVE: CVE-2022-48776
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: parsers: qcom: Fix missing free for pparts in cleanup

Mtdpart doesn't free pparts when a cleanup function is declared.
Add missing free for pparts in cleanup function for smem to fix the
leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1b37889f9a151d26a3fb0d3870f6e1046dee2e24; https://git.kernel.org/stable/c/3dd8ba961b9356c4113b96541c752c73d98fef70; https://git.kernel.org/stable/c/3eb5185896a68373714dc7d[PII_REDACTED]adc3345
CVE: CVE-2022-48777
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: parsers: qcom: Fix kernel panic on skipped partition

In the event of a skipped partition (case when the entry name is empty)
the kernel panics in the cleanup function as the name entry is NULL.
Rework the parser logic by first checking the real partition number and
then allocate the space and set the data for the valid partitions.

The logic was also fundamentally wrong as with a skipped partition, the
parts number returned was incorrect by not decreasing it for the skipped
partitions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/65d003cca335cabc0160d3cd7daa689eaa9dd3cd; https://git.kernel.org/stable/c/a2995fe23095ceda2dc382fbe057f5e164595548; https://git.kernel.org/stable/c/eb03cb6e03ffd9173e18e5fe87e4e3ce83820453
CVE: CVE-2022-48778
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: gpmi: don't leak PM reference in error path

If gpmi_nfc_apply_timings() fails, the PM runtime usage counter must be
dropped.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/4a7ec50298b1127c5024a750c969ea[PII_REDACTED]; https://git.kernel.org/stable/c/4cd3281a910a5adf73b2a0a82241dd67844d0b25; https://git.kernel.org/stable/c/58d3111eafce9e4398654b07f0b1dac27f26ee5b
CVE: CVE-2022-48779
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()

ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if
this is the same as the port's pvid_vlan which we access afterwards,
what we're accessing is freed memory.

Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior
to calling ocelot_vlan_member_del().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2; https://git.kernel.org/stable/c/ef[PII_REDACTED]6f57f5b3393cf57f457b0ace837e; https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2
CVE: CVE-2022-48780
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

net/smc: Avoid overwriting the copies of clcsock callback functions

The callback functions of clcsock will be saved and replaced during
the fallback. But if the fallback happens more than once, then the
copies of these callback functions will be overwritten incorrectly,
resulting in a loop call issue:

clcsk->sk_error_report
 |- smc_fback_error_report() <------------------------------|
     |- smc_fback_forward_wakeup()                          | (loop)
         |- clcsock_callback()  (incorrectly overwritten)   |
             |- smc->clcsk_error_report() ------------------|

So this patch fixes the issue by saving these function pointers only
once in the fallback and avoiding overwriting.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://git.kernel.org/stable/c/1de9770d121ee9294794cca0e0be8fbfa0134ee8; https://git.kernel.org/stable/c/7de7ba7a8bd4fde0141de8674c13514d0072f0e6; https://git.kernel.org/stable/c/f00b6c976ae0dfbd9b891175f713f59095d23842
CVE: CVE-2022-48782
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

mctp: fix use after free

Clang static analysis reports this problem
route.c:425:4: warning: Use of memory after it is freed
  trace_mctp_key_acquire(key);
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~
When mctp_key_add() fails, key is freed but then is later
used in trace_mctp_key_acquire().  Add an else statement
to use the key only when mctp_key_add() is successful.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1dd3ecbec5f606b2a526c47925c8634b1a6bb81e; https://git.kernel.org/stable/c/7e5b6a5c8c44310784c88c1c198dde79f6402f7b; https://git.kernel.org/stable/c/1dd3ecbec5f606b2a526c47925c8634b1a6bb81e
CVE: CVE-2022-48783
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

net: dsa: lantiq_gswip: fix use after free in gswip_remove()

of_node_put(priv->ds->slave_mii_bus->dev.of_node) should be
done before mdiobus_free(priv->ds->slave_mii_bus).
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/8c6ae46150a453f8ae9a6cd49b45f354f478587d; https://git.kernel.org/stable/c/c61f599b8d33adfa256126a6695c734c0de331cb; https://git.kernel.org/stable/c/df2495f329b08ac0d0d3e6334a01955ae839005e
CVE: CVE-2022-48784
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

cfg80211: fix race in netlink owner interface destruction

My previous fix here to fix the deadlock left a race where
the exact same deadlock (see the original commit referenced
below) can still happen if cfg80211_destroy_ifaces() already
runs while nl80211_netlink_notify() is still marking some
interfaces as nl_owner_dead.

The race happens because we have two loops here - first we
dev_close() all the netdevs, and then we destroy them. If we
also have two netdevs (first one need only be a wdev though)
then we can find one during the first iteration, close it,
and go to the second iteration -- but then find two, and try
to destroy also the one we didn't close yet.

Fix this by only iterating once.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/241e633cb379c4f332fc1baf2abec95ec840cbeb; https://git.kernel.org/stable/c/c979f792a2baf6d0f[PII_REDACTED]a1a6eba46a3d2; https://git.kernel.org/stable/c/f0a6fd1527067da537e9c[PII_REDACTED]8719948ed
CVE: CVE-2022-48785
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()

Some time ago 8965779d2c0e ("ipv6,mcast: always hold idev->lock before mca_lock")
switched ipv6_get_lladdr() to __ipv6_get_lladdr(), which is rcu-unsafe
version. That was OK, because idev->lock was held for these codepaths.

In 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") these external locks were
removed, so we probably need to restore the original rcu-safe call.

Otherwise, we occasionally get a machine crashed/stalled with the following
in dmesg:

[ 3405.966610][T230589] general protection fault, probably for non-canonical address 0xdead[PII_REDACTED]8c: 0000 [#1] SMP NOPTI
[ 3405.982083][T230589] CPU: 44 PID: 230589 Comm: kworker/44:3 Tainted: G           O      5.15.19-cloudflare-2022.2.1 #1
[ 3405.998061][T230589] Hardware name: SUPA-COOL-SERV
[ 3406.009552][T230589] Workqueue: mld mld_ifc_work
[ 3406.017224][T230589] RIP: 0010:__ipv6_get_lladdr+0x34/0x60
[ 3406.025780][T230589] Code: 57 10 48 83 c7 08 48 89 e5 48 39 d7 74 3e 48 8d 82 38 ff ff ff eb 13 48 8b 90 d0 00 00 00 48 8d 82 38 ff ff ff 48 39 d7 74 22 <66> 83 78 32 20 77 1b 75 e4 89 ca 23 50 2c 75 dd 48 8b 50 08 48 8b
[ 3406.055748][T230589] RSP: 0018:ffff94e4b3fc3d10 EFLAGS: 00010202
[ 3406.065617][T230589] RAX: dead[PII_REDACTED]5a RBX: ffff94e4b3fc3d30 RCX: [PII_REDACTED]
[ 3406.077477][T230589] RDX: dead[PII_REDACTED]22 RSI: ffff94e4b3fc3d30 RDI: ffff8c3a31431008
[ 3406.089389][T230589] RBP: ffff94e4b3fc3d10 R08: [PII_REDACTED] R09: [PII_REDACTED]
[ 3406.101445][T230589] R10: ffff8c3a31430000 R11:[PII_REDACTED]00000b R12: ffff8c2c37887100
[ 3406.113553][T230589] R13: ffff8c3a39537000 R14:[PII_REDACTED]0005dc R15: ffff8c3a31431000
[ 3406.125730][T230589] FS:  [PII_REDACTED](0000) GS:ffff8c3b9fc80000(0000) knlGS:[PII_REDACTED]
[ 3406.138992][T230589] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[ 3406.149895][T230589] CR2: 00007f0dfea1db60 CR3: 000000387b5f2000 CR4:[PII_REDACTED]350ee0
[ 3406.162421][T230589] Call Trace:
[ 3406.170235][T230589]  <TASK>
[ 3406.177736][T230589]  mld_newpack+0xfe/0x1a0
[ 3406.186686][T230589]  add_grhead+0x87/0xa0
[ 3406.195498][T230589]  add_grec+0x485/0x4e0
[ 3406.204310][T230589]  ? newidle_balance+0x126/0x3f0
[ 3406.214024][T230589]  mld_ifc_work+0x15d/0x450
[ 3406.223279][T230589]  process_one_work+0x1e6/0x380
[ 3406.232982][T230589]  worker_thread+0x50/0x3a0
[ 3406.242371][T230589]  ? rescuer_thread+0x360/0x360
[ 3406.252175][T230589]  kthread+0x127/0x150
[ 3406.261197][T230589]  ? set_kthread_struct+0x40/0x40
[ 3406.271287][T230589]  ret_from_fork+0x22/0x30
[ 3406.280812][T230589]  </TASK>
[ 3406.288937][T230589] Modules linked in: ... [last unloaded: kheaders]
[ 3406.476714][T230589] ---[ end trace 3525a7655f2f3b9e ]---
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/26394fc118d6115390bd5b3a0fb17096271da227; https://git.kernel.org/stable/c/27f567c84f[PII_REDACTED]76827e356f9c92033bf9; https://git.kernel.org/stable/c/3e11ef1903cf6c2fba35594b193a3570854d9e9e
CVE: CVE-2022-48786
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

vsock: remove vsock from connected table when connect is interrupted by a signal

vsock_connect() expects that the socket could already be in the
TCP_ESTABLISHED state when the connecting task wakes up with a signal
pending. If this happens the socket will be in the connected table, and
it is not removed when the socket state is reset. In this situation it's
common for the process to retry connect(), and if the connection is
successful the socket will be added to the connected table a second
time, corrupting the list.

Prevent this by calling vsock_remove_connected() if a signal is received
while waiting for a connection. This is harmless if the socket is not in
the connected table, and if it is in the table then removing it will
prevent list corruption from a double add.

Note for backporting: this patch requires d5afa82c977e ("vsock: correct
removal of socket from the list"), which is in all current stable trees
except 4.9.y.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0bb88f3f7e8d506f3efe46d694964117e20efbfc; https://git.kernel.org/stable/c/2910bcb9f67551a45397735e47b6d456eb8cd549; https://git.kernel.org/stable/c/5f326fe2aef411a6575628f92bd861463ea91df7
CVE: CVE-2022-48787
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

iwlwifi: fix use-after-free

If no firmware was present at all (or, presumably, all of the
firmware files failed to parse), we end up unbinding by calling
device_release_driver(), which calls remove(), which then in
iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However
the new code I added will still erroneously access it after it
was freed.

Set 'failure=false' in this case to avoid the access, all data
was already freed anyway.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063; https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957; https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb
CVE: CVE-2022-48788
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme-rdma: fix possible use-after-free in transport error_recovery work

While nvme_rdma_submit_async_event_work is checking the ctrl and queue
state before preparing the AER command and scheduling io_work, in order
to fully prevent a race where this check is not reliable the error
recovery work must flush async_event_work before continuing to destroy
the admin queue after setting the ctrl state to RESETTING such that
there is no race .submit_async_event and the error recovery handler
itself changing the ctrl state.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/324f5bdc52ecb6a6dadb31a62823ef8c709d1439; https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9; https://git.kernel.org/stable/c/646952b2210f19e584d2bf9eb5d092abdca2fcc1
CVE: CVE-2022-48789
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix possible use-after-free in transport error_recovery work

While nvme_tcp_submit_async_event_work is checking the ctrl and queue
state before preparing the AER command and scheduling io_work, in order
to fully prevent a race where this check is not reliable the error
recovery work must flush async_event_work before continuing to destroy
the admin queue after setting the ctrl state to RESETTING such that
there is no race .submit_async_event and the error recovery handler
itself changing the ctrl state.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/5e42fca37ccc76f39f73732661bd47254cad5982; https://git.kernel.org/stable/c/61a26ffd5ad3ece456d74c4c79f7b5e3f440a141; https://git.kernel.org/stable/c/bb0d8fb35c4ff00a503c2c4dca4cce8d102a21c4
CVE: CVE-2022-48790
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme: fix a possible use-after-free in controller reset during load

Unlike .queue_rq, in .submit_async_event drivers may not check the ctrl
readiness for AER submission. This may lead to a use-after-free
condition that was observed with nvme-tcp.

The race condition may happen in the following scenario:
1. driver executes its reset_ctrl_work
2. -> nvme_stop_ctrl - flushes ctrl async_event_work
3. ctrl sends AEN which is received by the host, which in turn
   schedules AEN handling
4. teardown admin queue (which releases the queue socket)
5. AEN processed, submits another AER, calling the driver to submit
6. driver attempts to send the cmd
==> use-after-free

In order to fix that, add ctrl state check to validate the ctrl
is actually able to accept the AER submission.

This addresses the above race in controller resets because the driver
during teardown should:
1. change ctrl state to RESETTING
2. flush async_event_work (as well as other async work elements)

So after 1,2, any other AER command will find the
ctrl state to be RESETTING and bail out without submitting the AER.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0ead57ceb21bbf15963b4874c2ac[PII_REDACTED]2f; https://git.kernel.org/stable/c/0fa0f99fc84e41057cbdd2efbfe91c6b2f47dd9d; https://git.kernel.org/stable/c/70356b756a58704e5c8818cb09da5854af87e765