deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-25064
Published: 2024-03-02
Description: Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by changing parameter values.
CVSS Score: 4.3 (MEDIUM)
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-professional/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-professional/
CVE: CVE-2024-1592
Published: 2024-03-02
Description: The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.6. This is due to missing or incorrect nonce validation on the process_delete function in class-DNSMPD.php. This makes it possible for unauthenticated attackers to delete GDPR data requests via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041903%40complianz-gdpr&old=3009228%40complianz-gdpr&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6b524fc5-4beb-49f6-bafa-c788c6d1d78c?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041903%40complianz-gdpr&old=3009228%40complianz-gdpr&sfp_email=&sfph_mail=
CVE: CVE-2024-1775
Published: 2024-03-02
Description: The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_description’ parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers, with access to a subscriber-level account, to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. NOTE: This vulnerability can be successfully exploited on a vulnerable WordPress instance against an OAuth pre-authenticated higher-level user (e.g., administrator) by leveraging a cross-site request forgery in conjunction with a certain social engineering technique to achieve a critical impact scenario (cross-site scripting to administrator-level account creation). However, successful exploitation requires "Debug mode" to be enabled in the plugin's "Global Settings".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3042326/nextend-facebook-connect; https://www.wordfence.com/threat-intel/vulnerabilities/id/3bad1d0d-3817-4c7f-a012-5a85b577781e?source=cve; https://plugins.trac.wordpress.org/changeset/3042326/nextend-facebook-connect
CVE: CVE-2024-0378
Published: 2024-03-02
Description: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3043570%40ai-engine&new=3043570%40ai-engine&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/54[PII_REDACTED]-40bc-b539-3dc9b555ed00?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3043570%40ai-engine&new=3043570%40ai-engine&sfp_email=&sfph_mail=
CVE: CVE-2023-6326
Published: 2024-03-02
Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.10. This is due to missing or incorrect nonce validation on the 'process_bulk_action' function. This makes it possible for unauthenticated attackers to duplicate or delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-50900 and 	CVE-2024-6490 may be a duplicate of this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/master-slider/trunk/admin/includes/classes/class-msp-list-table.php; https://plugins.trac.wordpress.org/changeset/3138224/master-slider/trunk/admin/includes/classes/class-msp-list-table.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0a7108-15ef-42d0-adce-fd5b0e6faf3c?source=cve
CVE: CVE-2024-0611
Published: 2024-03-02
Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slides callback functionality in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://advisory.abay.sh/cve-2024-0611; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084860%40master-slider&new=3084860%40master-slider&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6e587c-59b2-4f93-ab88-5e548b52db45?source=cve
CVE: CVE-2024-1449
Published: 2024-03-02
Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slide shortcode in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the 'src' user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3138224/master-slider/trunk/includes/msp-shortcodes.php; https://wordpress.org/plugins/master-slider/; https://www.wordfence.com/threat-intel/vulnerabilities/id/af9adb6b-f726-4b74-be5c-82fdab0ae1f2?source=cve
CVE: CVE-2024-1398
Published: 2024-03-02
Description: The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ and ’heading_sub_title_tag’ parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/ultimate-bootstrap-elements-for-elementor/tags/1.3.6/templates/elements/heading.php#L50; https://plugins.trac.wordpress.org/browser/ultimate-bootstrap-elements-for-elementor/tags/1.3.6/templates/elements/heading.php#L61; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3043865%40ultimate-bootstrap-elements-for-elementor&new=3043865%40ultimate-bootstrap-elements-for-elementor&sfp_email=&sfph_mail=
CVE: CVE-2022-48627
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

vt: fix memory overlapping when deleting chars in the buffer

A memory overlapping copy occurs when deleting a long line. This memory
overlapping copy can cause data corruption when scr_memcpyw is optimized
to memcpy because memcpy does not ensure its behavior if the destination
buffer overlaps with the source buffer. The line buffer is not always
broken, because the memcpy utilizes the hardware acceleration, whose
result is not deterministic.

Fix this problem by using replacing the scr_memcpyw with scr_memmovew.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/14d2cc21ca622310babf373e3a8f0b40acfe8265; https://git.kernel.org/stable/c/39cdb68c64d84e71a4a717000b6e5de208ee60cc; https://git.kernel.org/stable/c/57964a5710252bc82fe22d9fa98c180c58c20244
CVE: CVE-2022-48628
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

ceph: drop messages from MDS when unmounting

When unmounting all the dirty buffers will be flushed and after
the last osd request is finished the last reference of the i_count
will be released. Then it will flush the dirty cap/snap to MDSs,
and the unmounting won't wait the possible acks, which will ihold
the inodes when updating the metadata locally but makes no sense
any more, of this. This will make the evict_inodes() to skip these
inodes.

If encrypt is enabled the kernel generate a warning when removing
the encrypt keys when the skipped inodes still hold the keyring:

WARNING: CPU: 4 PID: 168846 at fs/crypto/keyring.c:242 fscrypt_destroy_keyring+0x7e/0xd0
CPU: 4 PID: 168846 Comm: umount Tainted: G S  6.1.0-rc5-ceph-g72ead199864c #1
Hardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 2.0 12/17/2015
RIP: 0010:fscrypt_destroy_keyring+0x7e/0xd0
RSP: 0018:ffffc9000b277e28 EFLAGS: 00010202
RAX: [PII_REDACTED] RBX: ffff88810d52ac00 RCX: ffff88810b56aa00
RDX: [PII_REDACTED] RSI: ffffffff822f3a09 RDI: ffff888108f59000
RBP: ffff8881d394fb88 R08: [PII_REDACTED] R09: [PII_REDACTED]
R10: [PII_REDACTED] R11: 11ff4fe6834fcd91 R12: ffff8881d394fc40
R13: ffff888108f59000 R14: ffff8881d394f800 R15: [PII_REDACTED]
FS:  00007fd83f6f1080(0000) GS:ffff88885fd00000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: 00007f918d417000 CR3: 000000017f89a005 CR4:[PII_REDACTED]3706e0
DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
Call Trace:
<TASK>
generic_shutdown_super+0x47/0x120
kill_anon_super+0x14/0x30
ceph_kill_sb+0x36/0x90 [ceph]
deactivate_locked_super+0x29/0x60
cleanup_mnt+0xb8/0x140
task_work_run+0x67/0xb0
exit_to_user_mode_prepare+0x23d/0x240
syscall_exit_to_user_mode+0x25/0x60
do_syscall_64+0x40/0x80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fd83dc39e9b

Later the kernel will crash when iput() the inodes and dereferencing
the "sb->s_master_keys", which has been released by the
generic_shutdown_super().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/47f82395f04a976d4fa97de7f2acffa1c1096571; https://git.kernel.org/stable/c/89744b64914426cbabceb3d8a149176b5dafdfb5; https://git.kernel.org/stable/c/e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd
CVE: CVE-2023-52499
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/47x: Fix 47x syscall return crash

Eddie reported that newer kernels were crashing during boot on his 476
FSP2 system:

  kernel tried to execute user page (b7ee2000) - exploit attempt? (uid: 0)
  BUG: Unable to handle kernel instruction fetch
  Faulting instruction address: 0xb7ee2000
  Oops: Kernel access of bad area, sig: 11 [#1]
  BE PAGE_SIZE=4K FSP-2
  Modules linked in:
  CPU: 0 PID: 61 Comm: mount Not tainted 6.1.55-d23900f.ppcnf-fsp2 #1
  Hardware name: ibm,fsp2 476fpe 0x7ff520c0 FSP-2
  NIP:  b7ee2000 LR: 8c008000 CTR: 00000000
  REGS: bffebd83 TRAP: 0400   Not tainted (6.1.55-d23900f.ppcnf-fs p2)
  MSR:  00000030 <IR,DR>  CR: 00001000  XER: 20000000
  GPR00: c00110ac bffebe63 bffebe7e bffebe88 8c[PII_REDACTED]1000 00000d12 b7ee2000
  GPR08: [PII_REDACTED] 00000000 c139df10 48[PII_REDACTED]c314 [PII_REDACTED]
  GPR16: [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] 10[PII_REDACTED]f5b0
  GPR24: 1017fa50 1017f4f0 1017fa50 1017f740 1017f630 [PII_REDACTED] 1017f4f0
  NIP [b7ee2000] 0xb7ee2000
  LR [8c008000] 0x8c008000
  Call Trace:
  Instruction dump:
  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
  ---[ end trace [PII_REDACTED] ]---

The problem is in ret_from_syscall where the check for
icache_44x_need_flush is done. When the flush is needed the code jumps
out-of-line to do the flush, and then intends to jump back to continue
the syscall return.

However the branch back to label 1b doesn't return to the correct
location, instead branching back just prior to the return to userspace,
causing bogus register values to be used by the rfi.

The breakage was introduced by commit 6f76a01173cc
("powerpc/syscall: implement system call entry/exit logic in C for PPC32") which
inadvertently removed the "1" label and reused it elsewhere.

Fix it by adding named local labels in the correct locations. Note that
the return label needs to be outside the ifdef so that CONFIG_PPC_47x=n
compiles.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/29017ab1a539101d9c7bec63cc13a019f97b2820; https://git.kernel.org/stable/c/70f6756ad96dd70177dddcfac2fe4bd4bb320746; https://git.kernel.org/stable/c/8ac2689502f986a46f4221e239d4ff2897f1ccb3
CVE: CVE-2023-52500
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command

Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed
when we receive the response.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2259e1901b2d8c0e8538fc99e77de443b939e749; https://git.kernel.org/stable/c/22e6d783a33015bcdf0979015e4eac603912bea7; https://git.kernel.org/stable/c/2afd8fcee0c4d65a482e30c3ad2a92c25e5e92d4
CVE: CVE-2023-52501
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Do not attempt to read past "commit"

When iterating over the ring buffer while the ring buffer is active, the
writer can corrupt the reader. There's barriers to help detect this and
handle it, but that code missed the case where the last event was at the
very end of the page and has only 4 bytes left.

The checks to detect the corruption by the writer to reads needs to see the
length of the event. If the length in the first 4 bytes is zero then the
length is stored in the second 4 bytes. But if the writer is in the process
of updating that code, there's a small window where the length in the first
4 bytes could be zero even though the length is only 4 bytes. That will
cause rb_event_length() to read the next 4 bytes which could happen to be off the
allocated page.

To protect against this, fail immediately if the next event pointer is
less than 8 bytes from the end of the commit (last byte of data), as all
events must be a minimum of 8 bytes anyway.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/344f2f3e61a90f0150c754796ec9a17fcaeec03d; https://git.kernel.org/stable/c/75fc9e99b3a71006720ad1e029db11a4b5c32d4a; https://git.kernel.org/stable/c/95a404bd60af6c4d9d8db01ad14fe8957ece31ca
CVE: CVE-2023-52502
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()

Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.

Getting a reference on the socket found in a lookup while
holding a lock should happen before releasing the lock.

nfc_llcp_sock_get_sn() has a similar problem.

Finally nfc_llcp_recv_snl() needs to make sure the socket
found by nfc_llcp_sock_from_sn() does not disappear.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-362, CWE-416
References: https://git.kernel.org/stable/c/31c07dffafce914c1d1543c135382a11ff058d93; https://git.kernel.org/stable/c/6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9; https://git.kernel.org/stable/c/7adcf014bda16cdbf804af5c164d94d5d025db2d
CVE: CVE-2023-52503
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

tee: amdtee: fix use-after-free vulnerability in amdtee_close_session

There is a potential race condition in amdtee_close_session that may
cause use-after-free in amdtee_open_session. For instance, if a session
has refcount == 1, and one thread tries to free this session via:

    kref_put(&sess->refcount, destroy_session);

the reference count will get decremented, and the next step would be to
call destroy_session(). However, if in another thread,
amdtee_open_session() is called before destroy_session() has completed
execution, alloc_session() may return 'sess' that will be freed up
later in destroy_session() leading to use-after-free in
amdtee_open_session.

To fix this issue, treat decrement of sess->refcount and removal of
'sess' from session list in destroy_session() as a critical section, so
that it is executed atomically.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1680c82929bc14d706065f123dab77f2f1293116; https://git.kernel.org/stable/c/1c95574350cd63bc3c5c2fa[PII_REDACTED]8f2a0ce; https://git.kernel.org/stable/c/60c3e7a00db954947c265b55099c21b216f2a05c
CVE: CVE-2023-52504
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/alternatives: Disable KASAN in apply_alternatives()

Fei has reported that KASAN triggers during apply_alternatives() on
a 5-level paging machine:

	BUG: KASAN: out-of-bounds in rcu_is_watching()
	Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0
	...
	__asan_load4()
	rcu_is_watching()
	trace_hardirqs_on()
	text_poke_early()
	apply_alternatives()
	...

On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57)
gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on
__VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled().

KASAN gets confused when apply_alternatives() patches the
KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START
static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue.

Fix it for real by disabling KASAN while the kernel is patching alternatives.

[ mingo: updated the changelog ]
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/3719d3c36aa853d5a2401af9f8d6b116c91ad5ae; https://git.kernel.org/stable/c/3770c38cd6a60494da29ac2da73ff8156440a2d1; https://git.kernel.org/stable/c/5b784489c8158518bf7a466bb3cc045b0fb66b4b
CVE: CVE-2023-52505
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

phy: lynx-28g: serialize concurrent phy_set_mode_ext() calls to shared registers

The protocol converter configuration registers PCC8, PCCC, PCCD
(implemented by the driver), as well as others, control protocol
converters from multiple lanes (each represented as a different
struct phy). So, if there are simultaneous calls to phy_set_mode_ext()
to lanes sharing the same PCC register (either for the "old" or for the
"new" protocol), corruption of the values programmed to hardware is
possible, because lynx_28g_rmw() has no locking.

Add a spinlock in the struct lynx_28g_priv shared by all lanes, and take
the global spinlock from the phy_ops :: set_mode() implementation. There
are no other callers which modify PCC registers.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/139ad1143151a07be93bf741d4ea7c89e59f89ce; https://git.kernel.org/stable/c/6f901f8448c6b25ed843796b114471d2a3fc5dfb; https://git.kernel.org/stable/c/c2d7c79898b427d263c64a4841987eec131f2d4e
CVE: CVE-2023-52507
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: assert requested protocol is valid

The protocol is used in a bit mask to determine if the protocol is
supported. Assert the provided protocol is less than the maximum
defined so it doesn't potentially perform a shift-out-of-bounds and
provide a clearer error for undefined protocols vs unsupported ones.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/25dd54b95abfdca423b65a4ee620a774777d8213; https://git.kernel.org/stable/c/2c231a247a1d1628e41fa1eefd1a5307c41c5f53; https://git.kernel.org/stable/c/354a6e707e29cb0c007176ee5b8db8be7bd2dee0
CVE: CVE-2023-52508
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()

The nvme_fc_fcp_op structure describing an AEN operation is initialized with a
null request structure pointer. An FC LLDD may make a call to
nvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation.

Add validation of the request structure pointer before dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/8ae5b3a685dc59a8cf7ccfe0e850999ba9727a3c; https://git.kernel.org/stable/c/be90c9e29dd59b7d19a73297a1590ff3ec1d22ea; https://git.kernel.org/stable/c/dd46b3ac7322baf3772b33b29726e94f98289db7
CVE: CVE-2023-52509
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

ravb: Fix use-after-free issue in ravb_tx_timeout_work()

The ravb_stop() should call cancel_work_sync(). Otherwise,
ravb_tx_timeout_work() is possible to use the freed priv after
ravb_remove() was called like below:

CPU0			CPU1
			ravb_tx_timeout()
ravb_remove()
unregister_netdev()
free_netdev(ndev)
// free priv
			ravb_tx_timeout_work()
			// use priv

unregister_netdev() will call .ndo_stop() so that ravb_stop() is
called. And, after phy_stop() is called, netif_carrier_off()
is also called. So that .ndo_tx_timeout() will not be called
after phy_stop().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705; https://git.kernel.org/stable/c/[PII_REDACTED]713de[PII_REDACTED]16970cf025b4f89; https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6
CVE: CVE-2023-52510
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: Fix a potential UAF in ca8210_probe

If of_clk_add_provider() fails in ca8210_register_ext_clock(),
it calls clk_unregister() to release priv->clk and returns an
error. However, the caller ca8210_probe() then calls ca8210_remove(),
where priv->clk is freed again in ca8210_unregister_ext_clock(). In
this case, a use-after-free may happen in the second time we call
clk_unregister().

Fix this by removing the first clk_unregister(). Also, priv->clk could
be an error code on failure of clk_register_fixed_rate(). Use
IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/217efe32a45249eb07dcd7197e8403de98345e66; https://git.kernel.org/stable/c/28b68cba378e3e50a4082b65f262bc4f2c7c2add; https://git.kernel.org/stable/c/55e06850c7894f00d41b767c5f5665459f83f58f
CVE: CVE-2023-52511
Published: 2024-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: sun6i: reduce DMA RX transfer width to single byte

Through empirical testing it has been determined that sometimes RX SPI
transfers with DMA enabled return corrupted data. This is down to single
or even multiple bytes lost during DMA transfer from SPI peripheral to
memory. It seems the RX FIFO within the SPI peripheral can become
confused when performing bus read accesses wider than a single byte to it
during an active SPI transfer.

This patch reduces the width of individual DMA read accesses to the
RX FIFO to a single byte to mitigate that issue.
CVSS Score: 5.3 (MEDIUM)
References: https://git.kernel.org/stable/c/171f8a49f212e87a8b04087568e1b3d132e36a18; https://git.kernel.org/stable/c/b3c21c9c7289692f4019f163c3b06d8bdf78b355; https://git.kernel.org/stable/c/e15bb292b24630ee832bfc7fd616bd72c7682bbb