deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-52797
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drivers: perf: Check find_first_bit() return value

We must check the return value of find_first_bit() before using the
return value as an index array since it happens to overflow the array
and then panic:

[  107.318430] Kernel BUG [#1]
[  107.319434] CPU: 3 PID: 1238 Comm: kill Tainted: G            E      6.6.0-rc6ubuntu-defconfig #2
[  107.319465] Hardware name: riscv-virtio,qemu (DT)
[  107.319551] epc : pmu_sbi_ovf_handler+0x3a4/0x3ae
[  107.319840]  ra : pmu_sbi_ovf_handler+0x52/0x3ae
[  107.319868] epc : ffffffff80a0a77c ra : ffffffff80a0a42a sp : ffffaf83fecda350
[  107.319884]  gp : ffffffff823961a8 tp : ffffaf8083db1dc0 t0 : ffffaf83fecda480
[  107.319899]  t1 : ffffffff80cafe62 t2 :[PII_REDACTED]00ff00 s0 : ffffaf83fecda520
[  107.319921]  s1 : ffffaf83fecda380 a0 : 00000018fca29df0 a1 : ffffffffffffffff
[  107.319936]  a2 : [PII_REDACTED] a3 : [PII_REDACTED] a4 : [PII_REDACTED]
[  107.319951]  a5 : [PII_REDACTED] a6 : 000000001d1c8774 a7 :[PII_REDACTED]504d55
[  107.319965]  s2 : ffffffff82451f10 s3 : ffffffff82724e70 s4 :[PII_REDACTED]00003f
[  107.319980]  s5 : [PII_REDACTED] s6 : ffffaf8083db27c0 s7 : [PII_REDACTED]
[  107.319995]  s8 : [PII_REDACTED] s9 : 00007fffb45d6558 s10: 00007fffb45d81a0
[  107.320009]  s11: ffffaf7ffff60000 t3 : [PII_REDACTED] t4 : [PII_REDACTED]
[  107.320023]  t5 : ffffaf7f80000000 t6 : ffffaf[PII_REDACTED]
[  107.320037] status: [PII_REDACTED] badaddr: [PII_REDACTED] cause: [PII_REDACTED]
[  107.320081] [<ffffffff80a0a77c>] pmu_sbi_ovf_handler+0x3a4/0x3ae
[  107.320112] [<ffffffff800b42d0>] handle_percpu_devid_irq+0x9e/0x1a0
[  107.320131] [<ffffffff800ad92c>] generic_handle_domain_irq+0x28/0x36
[  107.320148] [<ffffffff8065f9f8>] riscv_intc_irq+0x36/0x4e
[  107.320166] [<ffffffff80caf4a0>] handle_riscv_irq+0x54/0x86
[  107.320189] [<ffffffff80cb0036>] do_irq+0x64/0x96
[  107.320271] Code: 85a6 855e b097 ff7f 80e7 9220 b709 9002 4501 bbd9 (9002) 6097
[  107.320585] ---[ end trace [PII_REDACTED] ]---
[  107.320704] Kernel panic - not syncing: Fatal exception in interrupt
[  107.320775] SMP: stopping secondary CPUs
[  107.321219] Kernel Offset: 0x0 from 0xffffffff80000000
[  107.333051] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-252
References: https://git.kernel.org/stable/c/2c86b24095fcf72cf51bc72d12e4350163b4e11d; https://git.kernel.org/stable/c/45a0de41ec383c8b7c6d442734ba3852dd2fc4a7; https://git.kernel.org/stable/c/c6e316ac05532febb0c966fa9b55f5258ed037be
CVE: CVE-2023-52798
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix dfs radar event locking

The ath11k active pdevs are protected by RCU but the DFS radar event
handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a
read-side critical section.

Mark the code in question as an RCU read-side critical section to avoid
any potential use-after-free issues.

Compile tested only.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1fd878e1750190a612b5de2af357cca422ec0822; https://git.kernel.org/stable/c/21ebb0aba580d347e12f01ce5f6e75044427b3d5; https://git.kernel.org/stable/c/3b6c14833165f689cc5928574ebafe52bbce5f1e
CVE: CVE-2023-52799
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

jfs: fix array-index-out-of-bounds in dbFindLeaf

Currently while searching for dmtree_t for sufficient free blocks there
is an array out of bounds while getting element in tp->dm_stree. To add
the required check for out of bound we first need to determine the type
of dmtree. Thus added an extra parameter to dbFindLeaf so that the type
of tree can be determined and the required check can be applied.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/20f9310a18e3e99fc031e036fcbed67105ae1859; https://git.kernel.org/stable/c/22cad8bc1d36547cdae0eef316c47d917ce3147c; https://git.kernel.org/stable/c/81aa58cd8495b8c3b527f58ccbe19478d8087f61
CVE: CVE-2023-52800
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix htt pktlog locking

The ath11k active pdevs are protected by RCU but the htt pktlog handling
code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a
read-side critical section.

Mark the code in question as an RCU read-side critical section to avoid
any potential use-after-free issues.

Compile tested only.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/03ed26935bebf6b6fd8a656490bf3dcc71b72679; https://git.kernel.org/stable/c/3a51e6b4da71fdfa43ec006d6abc020f3e22d14e; https://git.kernel.org/stable/c/3f77c7d605b29df277d77e9ee75d96e7ad145d2d
CVE: CVE-2023-52801
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

iommufd: Fix missing update of domains_itree after splitting iopt_area

In iopt_area_split(), if the original iopt_area has filled a domain and is
linked to domains_itree, pages_nodes have to be properly
reinserted. Otherwise the domains_itree becomes corrupted and we will UAF.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://git.kernel.org/stable/c/836db2e7e4565d8218923b3552304a1637e2f28d; https://git.kernel.org/stable/c/e7250ab7ca4998fe026f2149805b03e09dc32498; https://git.kernel.org/stable/c/fcb32111f01ddf3cbd04644cde1773428e31de6a
CVE: CVE-2023-52802
Published: 2024-05-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52804
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/jfs: Add validity check for db_maxag and db_agpref

Both db_maxag and db_agpref are used as the index of the
db_agfree array, but there is currently no validity check for
db_maxag and db_agpref, which can lead to errors.

The following is related bug reported by Syzbot:

UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20
index 7936 is out of range for type 'atomic_t[128]'

Add checking that the values of db_maxag and db_agpref are valid
indexes for the db_agfree array.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/1f74d336990f37703a8eee77153463d65b67f70e; https://git.kernel.org/stable/c/2323de34a3ae61a9f9b544c18583f71cea86721f; https://git.kernel.org/stable/c/32bd8f1cbcf8b663e29dd1f908ba3a129541a11b
CVE: CVE-2023-52805
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

jfs: fix array-index-out-of-bounds in diAlloc

Currently there is not check against the agno of the iag while
allocating new inodes to avoid fragmentation problem. Added the check
which is required.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129, CWE-129
References: https://git.kernel.org/stable/c/05d9ea1ceb62a55af6727a69269a4fd310edf483; https://git.kernel.org/stable/c/1708d0a9917fea579cc9da3d87b154285abd2cd8; https://git.kernel.org/stable/c/1ba7df5457dc1c1071c5f92ac11323533a6430e1
CVE: CVE-2023-52806
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: Fix possible null-ptr-deref when assigning a stream

While AudioDSP drivers assign streams exclusively of HOST or LINK type,
nothing blocks a user to attempt to assign a COUPLED stream. As
supplied substream instance may be a stub, what is the case when
code-loading, such scenario ends with null-ptr-deref.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/[PII_REDACTED]f3638f4fd54649eba8c7b84d5e4250; https://git.kernel.org/stable/c/25354bae4fc310c3928e8a42fda2d486f67745d7; https://git.kernel.org/stable/c/43b91df291c8802268ab3cfd8fccfdf135800ed4
CVE: CVE-2023-52807
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs

The hns3 driver define an array of string to show the coalesce
info, but if the kernel adds a new mode or a new state,
out-of-bounds access may occur when coalesce info is read via
debugfs, this patch fix the problem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/07f5b8c47152cadbd9102e053dcb60685820aa09; https://git.kernel.org/stable/c/53aba458f23846112c0d44239580ff59bc5c36c3; https://git.kernel.org/stable/c/be1f703f39efa27b7371b9a4cd983317f1366792
CVE: CVE-2023-52808
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs

If init debugfs failed during device registration due to memory allocation
failure, debugfs_remove_recursive() is called, after which debugfs_dir is
not set to NULL. debugfs_remove_recursive() will be called again during
device removal. As a result, illegal pointer is accessed.

[ 1665.467244] hisi_sas_v3_hw 0000:b4:02.0: failed to init debugfs!
...
[ 1669.836708] Unable to handle kernel NULL pointer dereference at virtual address[PII_REDACTED]0000a0
[ 1669.872669] pc : down_write+0x24/0x70
[ 1669.876315] lr : down_write+0x1c/0x70
[ 1669.879961] sp : ffff000036f53a30
[ 1669.883260] x29: ffff000036f53a30 x28: ffffa027c31549f8
[ 1669.888547] x27: ffffa027c3140000 x26: [PII_REDACTED]
[ 1669.893834] x25: ffffa027bf37c270 x24: ffffa027bf37c270
[ 1669.899122] x23: ffff[PII_REDACTED]b8 x22: ffff[PII_REDACTED]a8
[ 1669.904408] x21: [PII_REDACTED] x20: ffffa027bf37c310
[ 1669.909695] x19:[PII_REDACTED]0000a0 x18: ffff8027dcd86f10
[ 1669.914982] x17: [PII_REDACTED] x16: [PII_REDACTED]
[ 1669.920268] x15: [PII_REDACTED] x14: ffffa0274014f870
[ 1669.925555] x13: [PII_REDACTED] x12: [PII_REDACTED]
[ 1669.930842] x11: [PII_REDACTED] x10:[PII_REDACTED]000bb0
[ 1669.936129] x9 : ffff000036f537f0 x8 : ffff80273088ca10
[ 1669.941416] x7 :[PII_REDACTED]00001d x6 : 00000000ffffffff
[ 1669.946702] x5 : ffff000008a36310 x4 : ffff80273088be00
[ 1669.951989] x3 : ffff000009513e90 x2 : [PII_REDACTED]
[ 1669.957276] x1 :[PII_REDACTED]0000a0 x0 : ffffffff00000001
[ 1669.962563] Call trace:
[ 1669.965000]  down_write+0x24/0x70
[ 1669.968301]  debugfs_remove_recursive+0x5c/0x1b0
[ 1669.972905]  hisi_sas_debugfs_exit+0x24/0x30 [hisi_sas_main]
[ 1669.978541]  hisi_sas_v3_remove+0x130/0x150 [hisi_sas_v3_hw]
[ 1669.984175]  pci_device_remove+0x48/0xd8
[ 1669.988082]  device_release_driver_internal+0x1b4/0x250
[ 1669.993282]  device_release_driver+0x28/0x38
[ 1669.997534]  pci_stop_bus_device+0x84/0xb8
[ 1670.001611]  pci_stop_and_remove_bus_device_locked+0x24/0x40
[ 1670.007244]  remove_store+0xfc/0x140
[ 1670.010802]  dev_attr_store+0x44/0x60
[ 1670.014448]  sysfs_kf_write+0x58/0x80
[ 1670.018095]  kernfs_fop_write+0xe8/0x1f0
[ 1670.022000]  __vfs_write+0x60/0x190
[ 1670.025472]  vfs_write+0xac/0x1c0
[ 1670.028771]  ksys_write+0x6c/0xd8
[ 1670.032071]  __arm64_sys_write+0x24/0x30
[ 1670.035977]  el0_svc_common+0x78/0x130
[ 1670.039710]  el0_svc_handler+0x38/0x78
[ 1670.043442]  el0_svc+0x8/0xc

To fix this, set debugfs_dir to NULL after debugfs_remove_recursive().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/33331b265aac9441ac0c1a5442e3f05d038240ec; https://git.kernel.org/stable/c/6de426f9276c448e2db7238911c97fb157cb23be; https://git.kernel.org/stable/c/75a2656260fe8c7eeabda6ff4600b29e183f48db
CVE: CVE-2023-52809
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()

fc_lport_ptp_setup() did not check the return value of fc_rport_create()
which can return NULL and would cause a NULL pointer dereference. Address
this issue by checking return value of fc_rport_create() and log error
message on fc_rport_create() failed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/442fd24d7b6b29e4a9cd9225afba4142d5f522ba; https://git.kernel.org/stable/c/4df105f0ce9f6f30cda4e99f577150d23f0c9c5f; https://git.kernel.org/stable/c/56d78b5495ebecbb9395101f3be177cd0a52450b
CVE: CVE-2023-52810
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/jfs: Add check for negative db_l2nbperpage

l2nbperpage is log2(number of blks per page), and the minimum legal
value should be 0, not negative.

In the case of l2nbperpage being negative, an error will occur
when subsequently used as shift exponent.

Syzbot reported this bug:

UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12
shift exponent -16777216 is negative
CVSS Score: 8.4 (HIGH)
CWE: CWE-1335
References: https://git.kernel.org/stable/c/0cb567e727339a192f9fd0db00781d73a91d15a6; https://git.kernel.org/stable/c/1a7c53fdea1d189087544d9a606d249e93c4934b; https://git.kernel.org/stable/c/[PII_REDACTED]85ffc4fb91555b0dba895fe7656a45
CVE: CVE-2023-52811
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool

In practice the driver should never send more commands than are allocated
to a queue's event pool. In the unlikely event that this happens, the code
asserts a BUG_ON, and in the case that the kernel is not configured to
crash on panic returns a junk event pointer from the empty event list
causing things to spiral from there. This BUG_ON is a historical artifact
of the ibmvfc driver first being upstreamed, and it is well known now that
the use of BUG_ON is bad practice except in the most unrecoverable
scenario. There is nothing about this scenario that prevents the driver
from recovering and carrying on.

Remove the BUG_ON in question from ibmvfc_get_event() and return a NULL
pointer in the case of an empty event pool. Update all call sites to
ibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate
failure or recovery action.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/88984ec4792766df5a9de7a2ff2b5f281f94c7d4; https://git.kernel.org/stable/c/8bbe784c2ff28d56ca0c548aaf3e584edc77052d; https://git.kernel.org/stable/c/b39f2d10b86d0af353ea339e[PII_REDACTED]bca48f
CVE: CVE-2023-52812
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd: check num of link levels when update pcie param

In SR-IOV environment, the value of pcie_table->num_of_link_levels will
be 0, and num_of_levels - 1 will cause array index out of bounds
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/09f617219fe9ccd8d7b65dc3e879b5889f663b5a; https://git.kernel.org/stable/c/2f2d48b6247ae3001f83c98730b3cce475cb2927; https://git.kernel.org/stable/c/406e8845356d18bdf3d3a23b347faf67706472ec
CVE: CVE-2023-52813
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: pcrypt - Fix hungtask for PADATA_RESET

We found a hungtask bug in test_aead_vec_cfg as follows:

INFO: task cryptomgr_test:391009 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Call trace:
 __switch_to+0x98/0xe0
 __schedule+0x6c4/0xf40
 schedule+0xd8/0x1b4
 schedule_timeout+0x474/0x560
 wait_for_common+0x368/0x4e0
 wait_for_completion+0x20/0x30
 wait_for_completion+0x20/0x30
 test_aead_vec_cfg+0xab4/0xd50
 test_aead+0x144/0x1f0
 alg_test_aead+0xd8/0x1e0
 alg_test+0x634/0x890
 cryptomgr_test+0x40/0x70
 kthread+0x1e0/0x220
 ret_from_fork+0x10/0x18
 Kernel panic - not syncing: hung_task: blocked tasks

For padata_do_parallel, when the return err is 0 or -EBUSY, it will call
wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal
case, aead_request_complete() will be called in pcrypt_aead_serial and the
return err is 0 for padata_do_parallel. But, when pinst->flags is
PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it
won't call aead_request_complete(). Therefore, test_aead_vec_cfg will
hung at wait_for_completion(&wait->completion), which will cause
hungtask.

The problem comes as following:
(padata_do_parallel)                 |
    rcu_read_lock_bh();              |
    err = -EINVAL;                   |   (padata_replace)
                                     |     pinst->flags |= PADATA_RESET;
    err = -EBUSY                     |
    if (pinst->flags & PADATA_RESET) |
        rcu_read_unlock_bh()         |
        return err

In order to resolve the problem, we replace the return err -EBUSY with
-EAGAIN, which means parallel_data is changing, and the caller should call
it again.

v3:
remove retry and just change the return err.
v2:
introduce padata_try_do_parallel() in pcrypt_aead_encrypt and
pcrypt_aead_decrypt to solve the hungtask.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/039fec48e062504f14845124a1a25eb199b2ddc0; https://git.kernel.org/stable/c/372636debe852913529b1716f44addd94fff2d28; https://git.kernel.org/stable/c/546c1796ad1ed0d87dab3c4b5156d75819be2316
CVE: CVE-2023-52814
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix potential null pointer derefernce

The amdgpu_ras_get_context may return NULL if device
not support ras feature, so add check before using.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/80285ae1ec8717b597b20de38866c29d84d321a1; https://git.kernel.org/stable/c/9b70fc7d70e8ef7c4a65034c9487f58609e708a1; https://git.kernel.org/stable/c/b0702ee4d811708251cdf54d4a1d3e888d365111
CVE: CVE-2023-52815
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vkms: fix a possible null pointer dereference

In amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode()
is assigned to mode, which will lead to a NULL pointer dereference
on failure of drm_cvt_mode(). Add a check to avoid null pointer
dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/33fb1a555354bd593f785935ddcb5d9dd4d3847f; https://git.kernel.org/stable/c/70f831f21155c692bb336c434936fd6f24f3f81a; https://git.kernel.org/stable/c/8c6c85a073768df68c1a3fea143d013a38c66d34
CVE: CVE-2023-52816
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix shift out-of-bounds issue

[  567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned int'
[  567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G           OE      6.2.0-34-generic #34~22.04.1-Ubuntu
[  567.614502] Hardware name: AMD Splinter/Splinter-RPL, BIOS WS43927N_871 09/25/2023
[  567.614504] Workqueue: events send_exception_work_handler [amdgpu]
[  567.614748] Call Trace:
[  567.614750]  <TASK>
[  567.614753]  dump_stack_lvl+0x48/0x70
[  567.614761]  dump_stack+0x10/0x20
[  567.614763]  __ubsan_handle_shift_out_of_bounds+0x156/0x310
[  567.614769]  ? srso_alias_return_thunk+0x5/0x7f
[  567.614773]  ? update_sd_lb_stats.constprop.0+0xf2/0x3c0
[  567.614780]  svm_range_split_by_granularity.cold+0x2b/0x34 [amdgpu]
[  567.615047]  ? srso_alias_return_thunk+0x5/0x7f
[  567.615052]  svm_migrate_to_ram+0x185/0x4d0 [amdgpu]
[  567.615286]  do_swap_page+0x7b6/0xa30
[  567.615291]  ? srso_alias_return_thunk+0x5/0x7f
[  567.615294]  ? __free_pages+0x119/0x130
[  567.615299]  handle_pte_fault+0x227/0x280
[  567.615303]  __handle_mm_fault+0x3c0/0x720
[  567.615311]  handle_mm_fault+0x119/0x330
[  567.615314]  ? lock_mm_and_find_vma+0x44/0x250
[  567.615318]  do_user_addr_fault+0x1a9/0x640
[  567.615323]  exc_page_fault+0x81/0x1b0
[  567.615328]  asm_exc_page_fault+0x27/0x30
[  567.615332] RIP: 0010:__get_user_8+0x1c/0x30
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/2806f880379232e789957c2078d612669eb7a69c; https://git.kernel.org/stable/c/282c1d793076c2edac6c3db51b7e8ed2b41d60a5; https://git.kernel.org/stable/c/3f7a400d5e80f99581e3e8a9843e1f6118bf454f
CVE: CVE-2023-52818
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

For pptable structs that use flexible array sizes, use flexible arrays.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/6dffdddfca818c02a42b6caa1d9845995f0a1f94; https://git.kernel.org/stable/c/760efbca74a405dc439a013a5efaa9fadc95a8c3; https://git.kernel.org/stable/c/8af28ae3acb736ada4ce3457662fa446cc913bb4
CVE: CVE-2023-52819
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

For pptable structs that use flexible array sizes, use flexible arrays.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-129
References: https://git.kernel.org/stable/c/0f0e59075b5c22f1e871fbd508d6e4f495048356; https://git.kernel.org/stable/c/60a00dfc7c5deafd1dd393beaf53224f7256dad6; https://git.kernel.org/stable/c/7c68283f3166221af3df5791f0e13d3137a72216
CVE: CVE-2023-52820
Published: 2024-05-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52821
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/panel: fix a possible null pointer dereference

In versatile_panel_get_modes(), the return value of drm_mode_duplicate()
is assigned to mode, which will lead to a NULL pointer dereference
on failure of drm_mode_duplicate(). Add a check to avoid npd.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2381f6b628b3214f07375e0adf5ce17093c31190; https://git.kernel.org/stable/c/4fa930ba046d20fc[PII_REDACTED]ee11e905fa96e4; https://git.kernel.org/stable/c/79813cd[PII_REDACTED]7d51e6d7dcc14d287d4c402
CVE: CVE-2023-52822
Published: 2024-05-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52823
Published: 2024-05-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52824
Published: 2024-05-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52825
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix a race condition of vram buffer unref in svm code

prange->svm_bo unref can happen in both mmu callback and a callback after
migrate to system ram. Both are async call in different tasks. Sync svm_bo
unref operation to avoid random "use-after-free".
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/50f35a907c4f9ed431fd3dbb8b871ef1cbb0718e; https://git.kernel.org/stable/c/709c348261618da7ed89d6c303e2ceb9e453ba74; https://git.kernel.org/stable/c/7d43cdd22cd81a2b079e864c4321b9aba4c6af34
CVE: CVE-2023-52826
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference

In tpg110_get_modes(), the return value of drm_mode_duplicate() is
assigned to mode, which will lead to a NULL pointer dereference on
failure of drm_mode_duplicate(). Add a check to avoid npd.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/84c923d898905187ebfd4c0ef38cd1450af7e0ea; https://git.kernel.org/stable/c/9268bfd76bebc85ff221691b61498cc16d75451c; https://git.kernel.org/stable/c/9acc2bc00135e9ecd13a70ce1140e2673e504cdc