deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-50223
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

sched/numa: Fix the potential null pointer dereference in task_numa_work()

When running stress-ng-vm-segv test, we found a null pointer dereference
error in task_numa_work(). Here is the backtrace:

  [[PII_REDACTED]85] Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
  ......
  [[PII_REDACTED]08] CPU: 35 PID: 2694524 Comm: stress-ng-vm-se
  ......
  [[PII_REDACTED]13] pstate: 23401009 (nzCv daif +PAN -UAO +TCO +DIT +SSBS BTYPE=--)
  [[PII_REDACTED]15] pc : vma_migratable+0x1c/0xd0
  [[PII_REDACTED]22] lr : task_numa_work+0x1ec/0x4e0
  [[PII_REDACTED]27] sp : ffff8000ada73d20
  [[PII_REDACTED]28] x29: ffff8000ada73d20 x28: [PII_REDACTED] x27: 000000003e89f010
  [[PII_REDACTED]30] x26: [PII_REDACTED] x25: ffff800081b5c0d8 x24: ffff800081b27000
  [[PII_REDACTED]33] x23: [PII_REDACTED] x22:[PII_REDACTED]d18cc0 x21: ffff0009f7158000
  [[PII_REDACTED]35] x20: [PII_REDACTED] x19: [PII_REDACTED] x18: ffff8000ada73db8
  [[PII_REDACTED]38] x17: [PII_REDACTED] x16: ffff800080df40b0 x15: [PII_REDACTED]
  [[PII_REDACTED]40] x14: ffff8000ada73cc8 x13: 1fffe0017cc72001 x12: ffff8000ada73cc8
  [[PII_REDACTED]42] x11: ffff[PII_REDACTED]0c x10: ffff000be639000c x9 : ffff8000800f4ba4
  [[PII_REDACTED]45] x8 : ffff[PII_REDACTED]00 x7 : ffff8000ada73974 x6 : [PII_REDACTED]
  [[PII_REDACTED]47] x5 : 0068000b33e26707 x4 : [PII_REDACTED] x3 : ffff0009f7158000
  [[PII_REDACTED]49] x2 : [PII_REDACTED] x1 : [PII_REDACTED] x0 : [PII_REDACTED]
  [[PII_REDACTED]52] Call trace:
  [[PII_REDACTED]53]  vma_migratable+0x1c/0xd0
  [[PII_REDACTED]55]  task_numa_work+0x1ec/0x4e0
  [[PII_REDACTED]57]  task_work_run+0x78/0xd8
  [[PII_REDACTED]61]  do_notify_resume+0x1ec/0x290
  [[PII_REDACTED]63]  el0_svc+0x150/0x160
  [[PII_REDACTED]67]  el0t_64_sync_handler+0xf8/0x128
  [[PII_REDACTED]70]  el0t_64_sync+0x17c/0x180
  [[PII_REDACTED]73] Code: d2[PII_REDACTED]03fd f9000bf3 aa0003f3 (f9401000)
  [[PII_REDACTED]77] SMP: stopping secondary CPUs
  [[PII_REDACTED]84] Starting crashdump kernel...

stress-ng-vm-segv in stress-ng is used to stress test the SIGSEGV error
handling function of the system, which tries to cause a SIGSEGV error on
return from unmapping the whole address space of the child process.

Normally this program will not cause kernel crashes. But before the
munmap system call returns to user mode, a potential task_numa_work()
for numa balancing could be added and executed. In this scenario, since the
child process has no vma after munmap, the vma_next() in task_numa_work()
will return a null pointer even if the vma iterator restarts from 0.

Recheck the vma pointer before dereferencing it in task_numa_work().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/9c70b2a33cd2aa6a5a59c5523ef053bd42265209; https://git.kernel.org/stable/c/ade91f6e9848b370add44d89c976e070ccb492ef; https://git.kernel.org/stable/c/c60d98ef7078fc3e22b48e98eae7a897d88494ee
CVE: CVE-2024-50224
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: spi-fsl-dspi: Fix crash when not using GPIO chip select

Add check for the return value of spi_get_csgpiod() to avoid passing a NULL
pointer to gpiod_direction_output(), preventing a crash when GPIO chip
select is not used.

Fix below crash:
[    4.251960] Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
[    4.260762] Mem abort info:
[    4.263556]   ESR = 0x[PII_REDACTED]000004
[    4.267308]   EC = 0x25: DABT (current EL), IL = 32 bits
[    4.272624]   SET = 0, FnV = 0
[    4.275681]   EA = 0, S1PTW = 0
[    4.278822]   FSC = 0x04: level 0 translation fault
[    4.283704] Data abort info:
[    4.286583]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[    4.292074]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[    4.297130]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[    4.302445] [[PII_REDACTED]] user address but active_mm is swapper
[    4.308805] Internal error: Oops: [PII_REDACTED] [#1] PREEMPT SMP
[    4.315072] Modules linked in:
[    4.318124] CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc4-next-20[PII_REDACTED]8-ga20ec42c5fc1 #359
[    4.328130] Hardware name: LS1046A QDS Board (DT)
[    4.332832] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    4.339794] pc : gpiod_direction_output+0x34/0x5c
[    4.344505] lr : gpiod_direction_output+0x18/0x5c
[    4.349208] sp : ffff80008003b8f0
[    4.352517] x29: ffff80008003b8f0 x28: [PII_REDACTED] x27: ffffc96bcc7e9068
[    4.359659] x26: ffffc96bcc6e00b0 x25: ffffc96bcc598398 x24: ffff[PII_REDACTED]10
[    4.366800] x23: [PII_REDACTED] x22:[PII_REDACTED]e1a300 x21: [PII_REDACTED]
[    4.373940] x20: [PII_REDACTED] x19: [PII_REDACTED] x18: ffffffffffffffff
[    4.381081] x17: ffff44740016e600 x16: [PII_REDACTED] x15: [PII_REDACTED]
[    4.388221] x14: [PII_REDACTED] x13: [PII_REDACTED] x12:[PII_REDACTED]00001e
[    4.395362] x11: 0044b82fa09b5a53 x10: [PII_REDACTED] x9 : [PII_REDACTED]
[    4.402502] x8 : [PII_REDACTED] x7 : [PII_REDACTED] x6 : [PII_REDACTED]
[    4.409641] x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 : [PII_REDACTED]
[    4.416781] x2 : [PII_REDACTED] x1 : [PII_REDACTED] x0 : [PII_REDACTED]
[    4.423921] Call trace:
[    4.426362]  gpiod_direction_output+0x34/0x5c (P)
[    4.431067]  gpiod_direction_output+0x18/0x5c (L)
[    4.435771]  dspi_setup+0x220/0x334
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/25f00a13dccf8e[PII_REDACTED]8de46c8bf58e08f6; https://git.kernel.org/stable/c/89f74c968319d040739d6238e1c3a4caa16a5a00; https://git.kernel.org/stable/c/e79c1f1c9100b4adc91c6512985db2cc961aafaa
CVE: CVE-2024-50227
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Fix KASAN reported stack out-of-bounds read in tb_retimer_scan()

KASAN reported following issue:

 BUG: KASAN: stack-out-of-bounds in tb_retimer_scan+0xffe/0x1550 [thunderbolt]
 Read of size 4 at addr ffff88810111fc1c by task kworker/u56:0/11
 CPU: 0 UID: 0 PID: 11 Comm: kworker/u56:0 Tainted: G     U             6.11.0+ #1387
 Tainted: [U]=USER
 Workqueue: thunderbolt0 tb_handle_hotplug [thunderbolt]
 Call Trace:
  <TASK>
  dump_stack_lvl+0x6c/0x90
  print_report+0xd1/0x630
  kasan_report+0xdb/0x110
  __asan_report_load4_noabort+0x14/0x20
  tb_retimer_scan+0xffe/0x1550 [thunderbolt]
  tb_scan_port+0xa6f/0x2060 [thunderbolt]
  tb_handle_hotplug+0x17b1/0x3080 [thunderbolt]
  process_one_work+0x626/0x1100
  worker_thread+0x6c8/0xfa0
  kthread+0x2c8/0x3a0
  ret_from_fork+0x3a/0x80
  ret_from_fork_asm+0x1a/0x30

This happens because the loop variable still gets incremented by one so
max becomes 3 instead of 2, and this makes the second loop read past the
the array declared on the stack.

Fix this by assigning to max directly in the loop body.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/08b2771e9270fbe1ed4fbbe93abe05ac7fe9861d; https://git.kernel.org/stable/c/e9e1b20fae7de06ba36dd3f8dba858157bad233d
CVE: CVE-2024-50228
Published: 2024-11-09
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-50229
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix potential deadlock with newly created symlinks

Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers
memory reclamation involving the filesystem layer, which can result in
circular lock dependencies among the reader/writer semaphore
nilfs->ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the
fs_reclaim pseudo lock.

This is because after commit 21fc61c73c39 ("don't put symlink bodies in
pagecache into highmem"), the gfp flags of the page cache for symbolic
links are overwritten to GFP_KERNEL via inode_nohighmem().

This is not a problem for symlinks read from the backing device, because
the __GFP_FS flag is dropped after inode_nohighmem() is called.  However,
when a new symlink is created with nilfs_symlink(), the gfp flags remain
overwritten to GFP_KERNEL.  Then, memory allocation called from
page_symlink() etc.  triggers memory reclamation including the FS layer,
which may call nilfs_evict_inode() or nilfs_dirty_inode().  And these can
cause a deadlock if they are called while nilfs->ns_segctor_sem is held:

Fix this issue by dropping the __GFP_FS flag from the page cache GFP flags
of newly created symlinks in the same way that nilfs_new_inode() and
__nilfs_read_inode() do, as a workaround until we adopt nofs allocation
scope consistently or improve the locking constraints.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/1246d86e7bbde265761932c6e2dce28c69cdcb91; https://git.kernel.org/stable/c/58c7f44c7b9e5ac7e3b1e5da2572ed7767a12f38; https://git.kernel.org/stable/c/69548bb663fcb63f9ee0301be808a36b9d78dac3
CVE: CVE-2024-50230
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix kernel bug due to missing clearing of checked flag

Syzbot reported that in directory operations after nilfs2 detects
filesystem corruption and degrades to read-only,
__block_write_begin_int(), which is called to prepare block writes, may
fail the BUG_ON check for accesses exceeding the folio/page size,
triggering a kernel bug.

This was found to be because the "checked" flag of a page/folio was not
cleared when it was discarded by nilfs2's own routine, which causes the
sanity check of directory entries to be skipped when the directory
page/folio is reloaded.  So, fix that.

This was necessary when the use of nilfs2's own page discard routine was
applied to more than just metadata files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://git.kernel.org/stable/c/41e192ad2779cae[PII_REDACTED]dfe46726e4396aa; https://git.kernel.org/stable/c/56c6171932a7fb267ac6cb4ff8759b93ee1d0e2e; https://git.kernel.org/stable/c/64afad73e4623308d8943645e5631f2c7a2d7971
CVE: CVE-2024-50231
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()

modprobe iio-test-gts and rmmod it, then the following memory leak
occurs:

	unreferenced object 0xffffff80c810be00 (size 64):
	  comm "kunit_try_catch", pid 1654, jiffies[PII_REDACTED]
	  hex dump (first 32 bytes):
	    02 00 00 00 08 00 00 00 20 00 00 00 40 00 00 00  ........ ...@...
	    80 00 00 00 00 02 00 00 00 04 00 00 00 08 00 00  ................
	  backtrace (crc a63d875e):
	    [<[PII_REDACTED]c1b3c2>] kmemleak_alloc+0x34/0x40
	    [<000000001d6ecc87>] __kmalloc_noprof+0x2bc/0x3c0
	    [<[PII_REDACTED]3795c1>] devm_iio_init_iio_gts+0x4b4/0x16f4
	    [<[PII_REDACTED]bb4b09>] 0xffffffdf052a62e0
	    [<[PII_REDACTED]15bc18>] 0xffffffdf052a6488
	    [<00000000f9dc55b5>] kunit_try_run_case+0x13c/0x3ac
	    [<[PII_REDACTED]5a3fd4>] kunit_generic_run_threadfn_adapter+0x80/0xec
	    [<00000000f505065d>] kthread+0x2e8/0x374
	    [<00000000bbfb0e5d>] ret_from_fork+0x10/0x20
	unreferenced object 0xffffff80cbfe9e70 (size 16):
	  comm "kunit_try_catch", pid 1658, jiffies[PII_REDACTED]
	  hex dump (first 16 bytes):
	    10 00 00 00 40 00 00 00 80 00 00 00 00 00 00 00  ....@...........
	  backtrace (crc 857f0cb4):
	    [<[PII_REDACTED]c1b3c2>] kmemleak_alloc+0x34/0x40
	    [<000000001d6ecc87>] __kmalloc_noprof+0x2bc/0x3c0
	    [<[PII_REDACTED]3795c1>] devm_iio_init_iio_gts+0x4b4/0x16f4
	    [<[PII_REDACTED]bb4b09>] 0xffffffdf052a62e0
	    [<000000007d089d45>] 0xffffffdf052a6864
	    [<00000000f9dc55b5>] kunit_try_run_case+0x13c/0x3ac
	    [<[PII_REDACTED]5a3fd4>] kunit_generic_run_threadfn_adapter+0x80/0xec
	    [<00000000f505065d>] kthread+0x2e8/0x374
	    [<00000000bbfb0e5d>] ret_from_fork+0x10/0x20
	......

It includes 5*5 times "size 64" memory leaks, which correspond to 5 times
test_init_iio_gain_scale() calls with gts_test_gains size 10 (10*size(int))
and gts_test_itimes size 5. It also includes 5*1 times "size 16"
memory leak, which correspond to one time __test_init_iio_gain_scale()
call with gts_test_gains_gain_low size 3 (3*size(int)) and gts_test_itimes
size 5.

The reason is that the per_time_gains[i] is not freed which is allocated in
the "gts->num_itime" for loop in iio_gts_build_avail_scale_table().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/16e41593825c3044efca0eb34b2d6ffba306e4ec; https://git.kernel.org/stable/c/38d6e8be234d87b0eedca50309e25051888b39d1; https://git.kernel.org/stable/c/691e79ffc42154a9c91dc3b7e96a307037b4be74
CVE: CVE-2024-50232
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr()

In the ad7124_write_raw() function, parameter val can potentially
be zero. This may lead to a division by zero when DIV_ROUND_CLOSEST()
is called within ad7124_set_channel_odr(). The ad7124_write_raw()
function is invoked through the sequence: iio_write_channel_raw() ->
iio_write_channel_attribute() -> iio_channel_write(), with no checks
in place to ensure val is non-zero.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://git.kernel.org/stable/c/0ac0beb4235a9a474f681280a3bd4e2a5bb66569; https://git.kernel.org/stable/c/3dc0eda2cd5c653b162852ae5f0631bfe4ca5e95; https://git.kernel.org/stable/c/4f588fffc307a4bc2761aee6ff275bb4b433e451
CVE: CVE-2024-50233
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()

In the ad9832_write_frequency() function, clk_get_rate() might return 0.
This can lead to a division by zero when calling ad9832_calc_freqreg().
The check if (fout > (clk_get_rate(st->mclk) / 2)) does not protect
against the case when fout is 0. The ad9832_write_frequency() function
is called from ad9832_write(), and fout is derived from a text buffer,
which can contain any value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://git.kernel.org/stable/c/2f39548f45693d86e950647012a214da6917dc9f; https://git.kernel.org/stable/c/442f786c5bff8cfd756ebdeaa4aadbf05c22aa5a; https://git.kernel.org/stable/c/6bd301819f8f69331a55ae2336c8b111fc933f3d
CVE: CVE-2024-50235
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: clear wdev->cqm_config pointer on free

When we free wdev->cqm_config when unregistering, we also
need to clear out the pointer since the same wdev/netdev
may get re-registered in another network namespace, then
destroyed later, running this code again, which results in
a double-free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://git.kernel.org/stable/c/64e4c45d23cd7f6167f69cc2d2877bc7f54292e5; https://git.kernel.org/stable/c/6c44abb2d4c3262737d5d67832daebc8cf48b8c9; https://git.kernel.org/stable/c/ba392e1355ba74b1d4fa11b85f71ab6ed7ecc058
CVE: CVE-2024-50236
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath10k: Fix memory leak in management tx

In the current logic, memory is allocated for storing the MSDU context
during management packet TX but this memory is not being freed during
management TX completion. Similar leaks are seen in the management TX
cleanup logic.

Kmemleak reports this problem as below,

unreferenced object 0xffffff80b64ed250 (size 16):
  comm "kworker/u16:7", pid 148, jiffies[PII_REDACTED] (age 714.199s)
  hex dump (first 16 bytes):
    00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00  .+.......t......
  backtrace:
    [<ffffffe6e7b245dc>] __kmem_cache_alloc_node+0x1e4/0x2d8
    [<ffffffe6e7adde88>] kmalloc_trace+0x48/0x110
    [<ffffffe6bbd765fc>] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core]
    [<ffffffe6bbd3eed4>] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core]
    [<ffffffe6e78d5974>] process_scheduled_works+0x1ac/0x400
    [<ffffffe6e78d60b8>] worker_thread+0x208/0x328
    [<ffffffe6e78dc890>] kthread+0x100/0x1c0
    [<ffffffe6e78166c0>] ret_from_fork+0x10/0x20

Free the memory during completion and cleanup to fix the leak.

Protect the mgmt_pending_tx idr_remove() operation in
ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar->data_lock similar to
other instances.

Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/2f6f1e26ac6d2b38e2198a71f81f0ade14d6b07b; https://git.kernel.org/stable/c/4112450da7d67b59ccedc2208bae622db17dbcb8; https://git.kernel.org/stable/c/5f5a939759c79e7385946c85e62feca51a18d816
CVE: CVE-2024-50237
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower

Avoid potentially crashing in the driver because of uninitialized private data
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://git.kernel.org/stable/c/393b6bc174b0dd21bb2a36c13b36e62fc3474a23; https://git.kernel.org/stable/c/3ccf525a73d48e814634847f6d4a6150c6f0dffc; https://git.kernel.org/stable/c/78b698fbf37208ee921ee4cedea75b5d33d6ea9f
CVE: CVE-2024-50238
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend

Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation")
removed most users of the platform device driver data from the
qcom-qmp-usb driver, but mistakenly also removed the initialisation
despite the data still being used in the runtime PM callbacks. This bug
was later reproduced when the driver was copied to create the qmp-usbc
driver.

Restore the driver data initialisation at probe to avoid a NULL-pointer
dereference on runtime suspend.

Apparently no one uses runtime PM, which currently needs to be enabled
manually through sysfs, with these drivers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/34c21f94fa1e147a19b54b6adf0c93a623b70dd8; https://git.kernel.org/stable/c/c7086dc0539b1b2b61c8c735186698bca4858246
CVE: CVE-2024-50239
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend

Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation")
removed most users of the platform device driver data from the
qcom-qmp-usb driver, but mistakenly also removed the initialisation
despite the data still being used in the runtime PM callbacks. This bug
was later reproduced when the driver was copied to create the
qmp-usb-legacy driver.

Restore the driver data initialisation at probe to avoid a NULL-pointer
dereference on runtime suspend.

Apparently no one uses runtime PM, which currently needs to be enabled
manually through sysfs, with these drivers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/29240130ab77c80bea1464317ae2a5fd29c16a0c; https://git.kernel.org/stable/c/7e8066811a2c43fbb5f53c2c26d389e4bab9da34; https://git.kernel.org/stable/c/b1cffd00daa9cf499b49a0da698eff5032914f6e
CVE: CVE-2024-50240
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

phy: qcom: qmp-usb: fix NULL-deref on runtime suspend

Commit 413db06c05e7 ("phy: qcom-qmp-usb: clean up probe initialisation")
removed most users of the platform device driver data, but mistakenly
also removed the initialisation despite the data still being used in the
runtime PM callbacks.

Restore the driver data initialisation at probe to avoid a NULL-pointer
dereference on runtime suspend.

Apparently no one uses runtime PM, which currently needs to be enabled
manually through sysfs, with this driver.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/370814e9d512ba289612c3780890b80bf2605046; https://git.kernel.org/stable/c/5ebde521fbb9a813b993d4436329a3ca0eeb6574; https://git.kernel.org/stable/c/bd9e4d4a3b127686efc60096271b0a44c3100061
CVE: CVE-2024-50241
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

NFSD: Initialize struct nfsd4_copy earlier

Ensure the refcount and async_copies fields are initialized early.
cleanup_async_copy() will reference these fields if an error occurs
in nfsd4_copy(). If they are not correctly initialized, at the very
least, a refcount underflow occurs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/059434d23c4578d9d02efb92d848ea21bc640112; https://git.kernel.org/stable/c/421f1a2a1afb47d88de09457ef7687e1df7bc997; https://git.kernel.org/stable/c/63fab04cbd0f96191b6e5beedc3b643b01c15889
CVE: CVE-2024-50242
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Additional check in ntfs_file_release
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/031d6f608290c847ba6378322d0986d08d1a645a; https://git.kernel.org/stable/c/542532afe249588ae88d8409d4bf861c315f8862; https://git.kernel.org/stable/c/550ef40fa6366d5d11b122e5f36b1f9aa20c087e
CVE: CVE-2024-50243
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix general protection fault in run_is_mapped_full

Fixed deleating of a non-resident attribute in ntfs_create_inode()
rollback.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/509c1c6b499a4d9026b58c6e1c3a10ed8db1839f; https://git.kernel.org/stable/c/68b39c0765de7c97b34889c1f5e81c2a223fdacc; https://git.kernel.org/stable/c/8e87c9aa8cf92cfceaff0aab244318bbb8b35137
CVE: CVE-2024-50244
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Additional check in ni_clear()

Checking of NTFS_FLAGS_LOG_REPLAYING added to prevent access to
uninitialized bitmap during replay process.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/14a23e15a5e8331bb0cf21288723fa530a45b2a4; https://git.kernel.org/stable/c/60fb94ef46c2359dd06cbe30bfc2499f639433df; https://git.kernel.org/stable/c/7a4ace681dbb652aeb40e1b88f9134b880fdeeb5
CVE: CVE-2024-50245
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix possible deadlock in mi_read

Mutex lock with another subclass used in ni_lock_dir().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/03b097099eef255fbf85ea6a786ae3c91b11f041; https://git.kernel.org/stable/c/34e3220efd666d49965a26840d39f27601ce70f4; https://git.kernel.org/stable/c/47e8a17491e37df53743bc2e72309f8f0d6224af
CVE: CVE-2024-50246
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Add rough attr alloc_size check
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/2fcae4c2014a40c8ae0fc3d8cca3ba9e168308de; https://git.kernel.org/stable/c/c4a8ba334262e9a5c158d618a4820e1b9c12495c; https://git.kernel.org/stable/c/e91fbb21f248bdd8140f343dac32b77b9bc10fec
CVE: CVE-2024-50247
Published: 2024-11-09
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Check if more than chunk-size bytes are written

A incorrectly formatted chunk may decompress into
more than LZNT_CHUNK_SIZE bytes and a index out of bounds
will occur in s_max_off.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/1b6bc5f[PII_REDACTED]b6c5310eea216fc09c721a9; https://git.kernel.org/stable/c/4a4727bc582832f354e0d3d49838a401a28ae25e; https://git.kernel.org/stable/c/5f21e3e60982cd7353998b4f59f052134fd47d64