deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-25410
Published: 2024-02-26
Description: flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/flusity/flusity-CMS/commit/b99de3bd05677e8b61c04a70235faa6001556b3b; https://github.com/flusity/flusity-CMS/issues/9; https://github.com/flusity/flusity-CMS/commit/b99de3bd05677e8b61c04a70235faa6001556b3b
CVE: CVE-2024-25760
Published: 2024-02-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-25763
Published: 2024-02-26
Description: openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/LuMingYinDetect/openNDS_defects/blob/main/openNDS_detect_1.md; https://github.com/LuMingYinDetect/openNDS_defects/blob/main/openNDS_detect_1.md
CVE: CVE-2024-25909
Published: 2024-02-26
Description: Unrestricted Upload of File with Dangerous Type vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/wp-media-folder/wordpress-wp-media-folder-plugin-5-7-2-subscriber-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-media-folder/wordpress-wp-media-folder-plugin-5-7-2-subscriber-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-25913
Published: 2024-02-26
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/moveto/wordpress-moveto-plugin-6-2-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/moveto/wordpress-moveto-plugin-6-2-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-25925
Published: 2024-02-26
Description: Unrestricted Upload of File with Dangerous Type vulnerability in SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Discounts.This issue affects WooCommerce Easy Checkout Field Editor, Fees & Discounts: from n/a through 3.5.12.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/phppoet-checkout-fields/wordpress-woocommerce-easy-checkout-field-editor-fees-discounts-plugin-3-5-12-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/phppoet-checkout-fields/wordpress-woocommerce-easy-checkout-field-editor-fees-discounts-plugin-3-5-12-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-26465
Published: 2024-02-26
Description: A DOM based cross-site scripting (XSS) vulnerability in the component /beep/Beep.Instrument.js of stewdio beep.js before commit ef22ad7 allows attackers to execute arbitrary Javascript via sending a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/cd80/89527424f733b2b82de876e02d163150; https://gist.github.com/cd80/89527424f733b2b82de876e02d163150
CVE: CVE-2024-26466
Published: 2024-02-26
Description: A DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platform-tests/wpt before commit 938e843 allows attackers to execute arbitrary Javascript via sending a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/cd80/8e41a17bc0c2113f6347581cec726d11; https://gist.github.com/cd80/8e41a17bc0c2113f6347581cec726d11
CVE: CVE-2024-26467
Published: 2024-02-26
Description: A DOM based cross-site scripting (XSS) vulnerability in the component generator.html of tabatkins/railroad-diagrams before commit ea9a123 allows attackers to execute arbitrary Javascript via sending a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/cd80/50463b0e62067ec861b7006cbf46b068; https://gist.github.com/cd80/50463b0e62067ec861b7006cbf46b068
CVE: CVE-2024-26468
Published: 2024-02-26
Description: A DOM based cross-site scripting (XSS) vulnerability in the component index.html of jstrieb/urlpages before commit 035b647 allows attackers to execute arbitrary Javascript via sending a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/cd80/87b41cf58ba04564d55f4a26152bf0a9; https://gist.github.com/cd80/87b41cf58ba04564d55f4a26152bf0a9
CVE: CVE-2024-26600
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP

If the external phy working together with phy-omap-usb2 does not implement
send_srp(), we may still attempt to call it. This can happen on an idle
Ethernet gadget triggering a wakeup for example:

configfs-gadget.g1 gadget.0: ECM Suspend
configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup
...
Unable to handle kernel NULL pointer dereference at virtual address
00000000 when execute
...
PC is at 0x0
LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc]
...
musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core]
usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether]
eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c
dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4
sch_direct_xmit from __dev_queue_xmit+0x334/0xd88
__dev_queue_xmit from arp_solicit+0xf0/0x268
arp_solicit from neigh_probe+0x54/0x7c
neigh_probe from __neigh_event_send+0x22c/0x47c
__neigh_event_send from neigh_resolve_output+0x14c/0x1c0
neigh_resolve_output from ip_finish_output2+0x1c8/0x628
ip_finish_output2 from ip_send_skb+0x40/0xd8
ip_send_skb from udp_send_skb+0x124/0x340
udp_send_skb from udp_sendmsg+0x780/0x984
udp_sendmsg from __sys_sendto+0xd8/0x158
__sys_sendto from ret_fast_syscall+0x0/0x58

Let's fix the issue by checking for send_srp() and set_vbus() before
calling them. For USB peripheral only cases these both could be NULL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0430bfcd46657d9116a26cd377f112cbc40826a4; https://git.kernel.org/stable/c/14ef61594a5a286ae0d493b8acbf9eac46fd04c4; https://git.kernel.org/stable/c/396e17af6761b3cc9e6e4ca94b4de7f642bfece1
CVE: CVE-2024-26601
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: regenerate buddy after block freeing failed if under fc replay

This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant
mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on
code in mb_free_blocks(), fast commit replay can end up marking as free
blocks that are already marked as such. This causes corruption of the
buddy bitmap so we need to regenerate it in that case.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6b0d48647935e4b8c7b75d1eccb9043fcd4ee581; https://git.kernel.org/stable/c/78327acd4cdc4a1601af718b781eece577b6b7d4; https://git.kernel.org/stable/c/94ebf71bddbcd4ab1ce43ae32c6cb66396d2d51a
CVE: CVE-2024-26602
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

sched/membarrier: reduce the ability to hammer on sys_membarrier

On some systems, sys_membarrier can be very expensive, causing overall
slowdowns for everything.  So put a lock on the path in order to
serialize the accesses to prevent the ability for this to be called at
too high of a frequency and saturate the machine.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2441a64070b85c14eecc3728cc87e883f953f265; https://git.kernel.org/stable/c/24ec7504a08a67247fbe798d1de995208a8c128a; https://git.kernel.org/stable/c/3cd139875e9a7688b3fc[PII_REDACTED]20812a5fa3
CVE: CVE-2024-26603
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/fpu: Stop relying on userspace for info to fault in xsave buffer

Before this change, the expected size of the user space buffer was
taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed
from user-space, so it is possible construct a sigreturn frame where:

 * fx_sw->xstate_size is smaller than the size required by valid bits in
   fx_sw->xfeatures.
 * user-space unmaps parts of the sigrame fpu buffer so that not all of
   the buffer required by xrstor is accessible.

In this case, xrstor tries to restore and accesses the unmapped area
which results in a fault. But fault_in_readable succeeds because buf +
fx_sw->xstate_size is within the still mapped area, so it goes back and
tries xrstor again. It will spin in this loop forever.

Instead, fault in the maximum size which can be touched by XRSTOR (taken
from fpstate->user_size).

[ dhansen: tweak subject / changelog ]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://git.kernel.org/stable/c/627339cccdc9166792ecf96bc3c9f711a60ce996; https://git.kernel.org/stable/c/627e28cbb65564e55008315d9e02fbb90478beda; https://git.kernel.org/stable/c/8bd3eee7720c14b59a206bd05b98d7586bccf99a
CVE: CVE-2024-26604
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "kobject: Remove redundant checks for whether ktype is NULL"

This reverts commit 1b28cb81dab7c1eedc6034206f4e8d644046ad31.

It is reported to cause problems, so revert it for now until the root
cause can be found.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3ca8fbabcceb8bfe44f7f50640092fd8f1de375c; https://git.kernel.org/stable/c/7f414d306320f837cc3df96cf52161cb8290fb1b; https://git.kernel.org/stable/c/b746d52ce7bcac325a2fa264216ead85b7fbbfaa
CVE: CVE-2024-26605
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI/ASPM: Fix deadlock when enabling ASPM

A last minute revert in 6.7-final introduced a potential deadlock when
enabling ASPM during probe of Qualcomm PCIe controllers as reported by
lockdep:

  ============================================
  WARNING: possible recursive locking detected
  6.7.0 #40 Not tainted
  --------------------------------------------
  kworker/u16:5/90 is trying to acquire lock:
  ffffacfa78ced000 (pci_bus_sem){++++}-{3:3}, at: pcie_aspm_pm_state_change+0x58/0xdc

              but task is already holding lock:
  ffffacfa78ced000 (pci_bus_sem){++++}-{3:3}, at: pci_walk_bus+0x34/0xbc

              other info that might help us debug this:
   Possible unsafe locking scenario:

         CPU0
         ----
    lock(pci_bus_sem);
    lock(pci_bus_sem);

               *** DEADLOCK ***

  Call trace:
   print_deadlock_bug+0x25c/0x348
   __lock_acquire+0x10a4/0x2064
   lock_acquire+0x1e8/0x318
   down_read+0x60/0x184
   pcie_aspm_pm_state_change+0x58/0xdc
   pci_set_full_power_state+0xa8/0x114
   pci_set_power_state+0xc4/0x120
   qcom_pcie_enable_aspm+0x1c/0x3c [pcie_qcom]
   pci_walk_bus+0x64/0xbc
   qcom_pcie_host_post_init_2_7_0+0x28/0x34 [pcie_qcom]

The deadlock can easily be reproduced on machines like the Lenovo ThinkPad
X13s by adding a delay to increase the race window during asynchronous
probe where another thread can take a write lock.

Add a new pci_set_power_state_locked() and associated helper functions that
can be called with the PCI bus semaphore held to avoid taking the read lock
twice.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/0f7908a016c092cfdaa16d785fa5099d867bc1a3; https://git.kernel.org/stable/c/1e560864159d002b453da42bd2c13a1805515a20; https://git.kernel.org/stable/c/b0f4478838be1f1d[PII_REDACTED]98fef65bf8fd7c
CVE: CVE-2024-26606
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

binder: signal epoll threads of self-work

In (e)poll mode, threads often depend on I/O events to determine when
data is ready for consumption. Within binder, a thread may initiate a
command via BINDER_WRITE_READ without a read buffer and then make use
of epoll_wait() or similar to consume any responses afterwards.

It is then crucial that epoll threads are signaled via wakeup when they
queue their own work. Otherwise, they risk waiting indefinitely for an
event leaving their work unhandled. What is worse, subsequent commands
won't trigger a wakeup either as the thread has pending work.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/42beab162dcee1e691ee4934292d51581c29df61; https://git.kernel.org/stable/c/82722b453dc2f967b172603e389ee7dc1b3137cc; https://git.kernel.org/stable/c/90e09c016d72b91e76de25f71c7b93d94cc3c769
CVE: CVE-2024-27350
Published: 2024-02-26
Description: Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB (Android Debug Bridge) connections. NOTE: some third parties dispute whether this has security relevance, because an ADB connection is only possible after the (non-default) ADB Debugging option is enabled, and after the initiator of that specific connection attempt has been approved via a full-screen prompt.
CVSS Score: 5.9 (MEDIUM)
References: https://developer.amazon.com/docs/fire-tv/fire-os-overview.html; https://news.ycombinator.com/item?id=39496861; https://www.aftvnews.com/amazon-blocks-long-running-fire-tv-capability-breaking-popular-apps-with-no-warning-and-giving-developers-the-runaround/
CVE: CVE-2024-27359
Published: 2024-02-26
Description: Certain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, WithSecure Linux Security 64 12.0, WithSecure Linux Protection 12.0, and WithSecure Atlant 1.0.35-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://www.withsecure.com/en/support/security-advisories/cve-2034-n1; https://www.withsecure.com/en/support/security-advisories/cve-2034-n1
CVE: CVE-2024-27444
Published: 2024-02-26
Description: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7; https://github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7
CVE: CVE-2024-27447
Published: 2024-02-26
Description: pretix before 2024.1.1 mishandles file validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/pretix/pretix/compare/v2023.10.2...v2024.1.1; https://github.com/pretix/pretix/compare/v2023.10.2...v2024.1.1
CVE: CVE-2024-27454
Published: 2024-02-26
Description: orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915; https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e; https://github.com/ijl/orjson/issues/458
CVE: CVE-2024-27455
Published: 2024-02-26
Description: In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.04.04 and Assetwise Information Integrity Server 23.00.02.03.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-488, CWE-613
References: https://www.bentley.com/advisories/be-2024-0001/; https://www.bentley.com/advisories/be-2024-0001/
CVE: CVE-2024-27456
Published: 2024-02-26
Description: rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://github.com/cyu/rack-cors/issues/274; https://github.com/cyu/rack-cors/issues/274
CVE: CVE-2024-24401
Published: 2024-02-26
Description: SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.nagios.com/changelog/; https://www.nagios.com/changelog/
CVE: CVE-2024-24402
Published: 2024-02-26
Description: An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://www.nagios.com/changelog/; https://www.nagios.com/changelog/
CVE: CVE-2024-25767
Published: 2024-02-26
Description: nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/LuMingYinDetect/nanomq_defects/blob/main/nanomq_detect_1.md; https://github.com/LuMingYinDetect/nanomq_defects/blob/main/nanomq_detect_1.md
CVE: CVE-2024-27081
Published: 2024-02-26
Description: ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.  This vulnerability is patched in 2024.2.1.

CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/esphome/esphome/commit/d814ed1d4adc71fde47c4df41215bee449884513; https://github.com/esphome/esphome/security/advisories/GHSA-8p25-3q46-8q2p; https://github.com/esphome/esphome/commit/d814ed1d4adc71fde47c4df41215bee449884513
CVE: CVE-2024-27087
Published: 2024-02-26
Description: Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats.  As the "Custom" link type is meant to be flexible, it also allows the javascript: URL scheme. In some use cases this can be intended, but it can also be misused by attackers to execute arbitrary JavaScript code when a user or visitor clicks on a link that is generated from the contents of the link field. This vulnerability is patched in 4.1.1.


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/getkirby/kirby/commit/cda3dd9a15228d35e62ff86cfa87a67e7c687437; https://github.com/getkirby/kirby/security/advisories/GHSA-63h4-w25c-3qv4; https://github.com/getkirby/kirby/commit/cda3dd9a15228d35e62ff86cfa87a67e7c687437
CVE: CVE-2024-27088
Published: 2024-02-26
Description: es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.
CVSS Score: 0.0 (NONE)
CWE: CWE-400, CWE-1333, CWE-1333
References: https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2; https://github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602; https://github.com/medikoo/es5-ext/issues/201
CVE: CVE-2019-25160
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

netlabel: fix out-of-bounds memory accesses

There are two array out-of-bounds memory accesses, one in
cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk().  Both
errors are embarassingly simple, and the fixes are straightforward.

As a FYI for anyone backporting this patch to kernels prior to v4.8,
you'll want to apply the netlbl_bitmap_walk() patch to
cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before
Linux v4.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/1c973f9c7cc2b3caae93192fdc8ecb3f0b4ac000; https://git.kernel.org/stable/c/5578de4834fe0f2a34fedc7374be691443396d1f; https://git.kernel.org/stable/c/97bc3683c24999ee621d847c9348c75d2fe86272
CVE: CVE-2019-25161
Published: 2024-02-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2019-25162
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

i2c: Fix a potential use after free

Free the adap structure only after we are done using it.
This patch just moves the put_device() down a bit to avoid the
use after free.

[wsa: added comment to the code, added Fixes tag]
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/12b0606000d0828630c033bf0c74c748464fe87d; https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829; https://git.kernel.org/stable/c/35927d7509ab9bf41896b7e44f639504eae08af7
CVE: CVE-2020-36775
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid potential deadlock

Using f2fs_trylock_op() in f2fs_write_compressed_pages() to avoid potential
deadlock like we did in f2fs_write_single_data_page().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/8e8542437bb4070423c9754d5ba270ffdbae8c8d; https://git.kernel.org/stable/c/df77fbd8c5b222c680444801ffd20e8bbc90a56e; https://git.kernel.org/stable/c/0478ccdc8ea016de1ebaf6fe6da0275c2b258c5b
CVE: CVE-2021-46906
Published: 2024-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: usbhid: fix info leak in hid_submit_ctrl

In hid_submit_ctrl(), the way of calculating the report length doesn't
take into account that report->size can be zero. When running the
syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to
calculate transfer_buffer_length as 16384. When this urb is passed to
the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero
report size case by using DIV_ROUND_UP for the division. Then, call it
from hid_submit_ctrl().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://git.kernel.org/stable/c/0e280502be1b003c3483ae03fc60dea554fcfa82; https://git.kernel.org/stable/c/21883bff0fd854e07429a773ff18f1e9658f50e8; https://git.kernel.org/stable/c/41b1e71a2c57366b08dcca1a28b0d45ca69429ce