deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-46910
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled

The debugging code for kmap_local() doubles the number of per-CPU fixmap
slots allocated for kmap_local(), in order to use half of them as guard
regions. This causes the fixmap region to grow downwards beyond the start
of its reserved window if the supported number of CPUs is large, and collide
with the newly added virtual DT mapping right below it, which is obviously
not good.

One manifestation of this is EFI boot on a kernel built with NR_CPUS=32
and CONFIG_DEBUG_KMAP_LOCAL=y, which may pass the FDT in highmem, resulting
in block entries below the fixmap region that the fixmap code misidentifies
as fixmap table entries, and subsequently tries to dereference using a
phys-to-virt translation that is only valid for lowmem. This results in a
cryptic splat such as the one below.

  ftrace: allocating 45548 entries in 89 pages
  8<--- cut here ---
  Unable to handle kernel paging request at virtual address fc6006f0
  pgd = (ptrval)
  [fc6006f0] *pgd=[PII_REDACTED]7003, *pmd=00000000
  Internal error: Oops: a06 [#1] SMP ARM
  Modules linked in:
  CPU: 0 PID: 0 Comm: swapper Not tainted 5.11.0+ #382
  Hardware name: Generic DT based system
  PC is at cpu_ca15_set_pte_ext+0x24/0x30
  LR is at __set_fixmap+0xe4/0x118
  pc : [<c041ac9c>]    lr : [<c04189d8>]    psr: 400000d3
  sp : c1601ed8  ip : 00400000  fp : 00800000
  r10: 0000071f  r9 : 00421000  r8 : 00c00000
  r7 : 00c00000  r6 : 0000071f  r5 : ffade000  r4 : 4040171f
  r3 : 00c00000  r2 : 4040171f  r1 : c041ac78  r0 : fc6006f0
  Flags: nZcv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment none
  Control: 30c5387d  Table: 40203000  DAC: 00000001
  Process swapper (pid: 0, stack limit = 0x(ptrval))

So let's limit CONFIG_NR_CPUS to 16 when CONFIG_DEBUG_KMAP_LOCAL=y. Also,
fix the BUILD_BUG_ON() check that was supposed to catch this, by checking
whether the region grows below the start address rather than above the end
address.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5965ac11b1d5fcb[PII_REDACTED]1649cd9df79c7c9; https://git.kernel.org/stable/c/d624833f5984d484c5e3196f34b926f9e71dafee; https://git.kernel.org/stable/c/5965ac11b1d5fcb[PII_REDACTED]1649cd9df79c7c9
CVE: CVE-2021-46911
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ch_ktls: Fix kernel panic

Taking page refcount is not ideal and causes kernel panic
sometimes. It's better to take tx_ctx lock for the complete
skb transmit, to avoid page cleanup if ACK received in middle.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1a73e427b824133940c2dd95ebe26b6dce1cbf10; https://git.kernel.org/stable/c/8348665d4181c68b0ca1205b48e1753d78bc810f; https://git.kernel.org/stable/c/8d5a9dbd2116a852f8f0f91f6fbc42a0afe1091f
CVE: CVE-2021-46912
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

net: Make tcp_allowed_congestion_control readonly in non-init netns

Currently, tcp_allowed_congestion_control is global and writable;
writing to it in any net namespace will leak into all other net
namespaces.

tcp_available_congestion_control and tcp_allowed_congestion_control are
the only sysctls in ipv4_net_table (the per-netns sysctl table) with a
NULL data pointer; their handlers (proc_tcp_available_congestion_control
and proc_allowed_congestion_control) have no other way of referencing a
struct net. Thus, they operate globally.

Because ipv4_net_table does not use designated initializers, there is no
easy way to fix up this one "bad" table entry. However, the data pointer
updating logic shouldn't be applied to NULL pointers anyway, so we
instead force these entries to be read-only.

These sysctls used to exist in ipv4_table (init-net only), but they were
moved to the per-net ipv4_net_table, presumably without realizing that
tcp_allowed_congestion_control was writable and thus introduced a leak.

Because the intent of that commit was only to know (i.e. read) "which
congestion algorithms are available or allowed", this read-only solution
should be sufficient.

The logic added in recent commit
31c4d2f160eb: ("net: Ensure net namespace isolation of sysctls")
does not and cannot check for NULL data pointers, because
other table entries (e.g. /proc/sys/net/netfilter/nf_log/) have
.data=NULL but use other methods (.extra2) to access the struct net.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1ccdf1bed140820240e383ba0accc474ffc7f006; https://git.kernel.org/stable/c/35d7491e2f77ce480097cabcaf93ed409e916e12; https://git.kernel.org/stable/c/97684f0970f6e112926de631fdd98d9693c7e5c1
CVE: CVE-2021-46913
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftables: clone set element expression template

memcpy() breaks when using connlimit in set elements. Use
nft_expr_clone() to initialize the connlimit expression list, otherwise
connlimit garbage collector crashes when walking on the list head copy.

[  493.064656] Workqueue: events_power_efficient nft_rhash_gc [nf_tables]
[  493.064685] RIP: 0010:find_or_evict+0x5a/0x90 [nf_conncount]
[  493.064694] Code: 2b 43 40 83 f8 01 77 0d 48 c7 c0 f5 ff ff ff 44 39 63 3c 75 df 83 6d 18 01 48 8b 43 08 48 89 de 48 8b 13 48 8b 3d ee 2f 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 03 48 83
[  493.064699] RSP: 0018:ffffc90000417dc0 EFLAGS: 00010297
[  493.064704] RAX: [PII_REDACTED] RBX: ffff888134f38410 RCX: [PII_REDACTED]
[  493.064708] RDX: [PII_REDACTED] RSI: ffff888134f38410 RDI: ffff888100060cc0
[  493.064711] RBP: ffff88812ce594a8 R08: ffff888134f38438 R09: 00000000ebb9025c
[  493.064714] R10: ffffffff8219f838 R11: [PII_REDACTED] R12: [PII_REDACTED]
[  493.064718] R13: ffffffff82146740 R14: ffff888134f38410 R15: [PII_REDACTED]
[  493.064721] FS:  [PII_REDACTED](0000) GS:ffff88840e440000(0000) knlGS:[PII_REDACTED]
[  493.064725] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[  493.064729] CR2: [PII_REDACTED] CR3:[PII_REDACTED]0aa002 CR4:[PII_REDACTED]1706e0
[  493.064733] Call Trace:
[  493.064737]  nf_conncount_gc_list+0x8f/0x150 [nf_conncount]
[  493.064746]  nft_rhash_gc+0x106/0x390 [nf_tables]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/47d8de3c226574a3ddb8b87d0c152028d1bafef4; https://git.kernel.org/stable/c/4d8f9065830e526c83199186c5f56a6514f457d2; https://git.kernel.org/stable/c/e51ff3ffc316377cca21de8b80404eed0c37b3c3
CVE: CVE-2021-46914
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ixgbe: fix unbalanced device enable/disable in suspend/resume

pci_disable_device() called in __ixgbe_shutdown() decreases
dev->enable_cnt by 1. pci_enable_device_mem() which increases
dev->enable_cnt by 1, was removed from ixgbe_resume() in commit
6f82b2558735 ("ixgbe: use generic power management"). This caused
unbalanced increase/decrease. So add pci_enable_device_mem() back.

Fix the following call trace.

  ixgbe 0000:17:00.1: disabling already-disabled device
  Call Trace:
   __ixgbe_shutdown+0x10a/0x1e0 [ixgbe]
   ixgbe_suspend+0x32/0x70 [ixgbe]
   pci_pm_suspend+0x87/0x160
   ? pci_pm_freeze+0xd0/0xd0
   dpm_run_callback+0x42/0x170
   __device_suspend+0x114/0x460
   async_suspend+0x1f/0xa0
   async_run_entry_fn+0x3c/0xf0
   process_one_work+0x1dd/0x410
   worker_thread+0x34/0x3f0
   ? cancel_delayed_work+0x90/0x90
   kthread+0x14c/0x170
   ? kthread_park+0x90/0x90
   ret_from_fork+0x1f/0x30
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/be07581aacae7cd0a073afae8e8862032f794309; https://git.kernel.org/stable/c/debb9df311582c83fe369baa35fa4b92e8a9c58a; https://git.kernel.org/stable/c/f1b4be4a753caa4056496f679d70550d0c11a264
CVE: CVE-2021-46915
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_limit: avoid possible divide error in nft_limit_init

div_u64() divides u64 by u32.

nft_limit_init() wants to divide u64 by u64, use the appropriate
math function (div64_u64)

divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8390 Comm: syz-executor188 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:div_u64_rem include/linux/math64.h:28 [inline]
RIP: 0010:div_u64 include/linux/math64.h:127 [inline]
RIP: 0010:nft_limit_init+0x2a2/0x5e0 net/netfilter/nft_limit.c:85
Code: ef 4c 01 eb 41 0f 92 c7 48 89 de e8 38 a5 22 fa 4d 85 ff 0f 85 97 02 00 00 e8 ea 9e 22 fa 4c 0f af f3 45 89 ed 31 d2 4c 89 f0 <49> f7 f5 49 89 c6 e8 d3 9e 22 fa 48 8d 7d 48 48 b8 00 00 00 00 00
RSP: 0018:ffffc[PII_REDACTED]8 EFLAGS: 00010246
RAX: [PII_REDACTED] RBX: [PII_REDACTED] RCX: [PII_REDACTED]
RDX: [PII_REDACTED] RSI: ffffffff875152e6 RDI: [PII_REDACTED]
RBP: ffff888020f80908 R08: [PII_REDACTED] R09: [PII_REDACTED]
R10: ffffffff875152d8 R11: [PII_REDACTED] R12: ffffc[PII_REDACTED]0
R13: [PII_REDACTED] R14: [PII_REDACTED] R15: [PII_REDACTED]
FS: [PII_REDACTED]97a300(0000) GS:ffff8880b9d00000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2:[PII_REDACTED]0001c4 CR3:[PII_REDACTED]a52000 CR4:[PII_REDACTED]1506e0
DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
Call Trace:
 nf_tables_newexpr net/netfilter/nf_tables_api.c:2675 [inline]
 nft_expr_init+0x145/0x2d0 net/netfilter/nf_tables_api.c:2713
 nft_set_elem_expr_alloc+0x27/0x280 net/netfilter/nf_tables_api.c:5160
 nf_tables_newset+0x1997/0x3150 net/netfilter/nf_tables_api.c:4321
 nfnetlink_rcv_batch+0x85a/0x21b0 net/netfilter/nfnetlink.c:456
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:580 [inline]
 nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:598
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/stable/c/01fb1626b620cb37a65ad08e0f626489e8f042ef; https://git.kernel.org/stable/c/1bb3ee4259936cc3b2d80a4a480bbb[PII_REDACTED]; https://git.kernel.org/stable/c/9065ccb9ec92c5120e7e97958397ebdb454f23d6
CVE: CVE-2021-46916
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ixgbe: Fix NULL pointer dereference in ethtool loopback test

The ixgbe driver currently generates a NULL pointer dereference when
performing the ethtool loopback test. This is due to the fact that there
isn't a q_vector associated with the test ring when it is setup as
interrupts are not normally added to the test rings.

To address this I have added code that will check for a q_vector before
returning a napi_id value. If a q_vector is not present it will return a
value of 0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/31166efb1cee348eb6314e9c0095d84cbeb66b9d; https://git.kernel.org/stable/c/758d19098df4b0bbca9f40d6ae6c82c9c18b9bba; https://git.kernel.org/stable/c/31166efb1cee348eb6314e9c0095d84cbeb66b9d
CVE: CVE-2021-46917
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: fix wq cleanup of WQCFG registers

A pre-release silicon erratum workaround where wq reset does not clear
WQCFG registers was leaked into upstream code. Use wq reset command
instead of blasting the MMIO region. This also address an issue where
we clobber registers in future devices.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://git.kernel.org/stable/c/e5eb9757fe4c2392e069246ae78badc573af1833; https://git.kernel.org/stable/c/ea9aadc06a9f10ad20a90edc0a484f1147d88a7a; https://git.kernel.org/stable/c/f7dc8f5619165e1fa3383d0c2519f502d9e2a1a9
CVE: CVE-2021-46918
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: clear MSIX permission entry on shutdown

Add disabling/clearing of MSIX permission entries on device shutdown to
mirror the enabling of the MSIX entries on probe. Current code left the
MSIX enabled and the pasid entries still programmed at device shutdown.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6df0e6c57dfc064af330071f372f11aa8c584997; https://git.kernel.org/stable/c/c84b8982d7aa9b4717dc36a1c6cbc93ee153b500; https://git.kernel.org/stable/c/6df0e6c57dfc064af330071f372f11aa8c584997
CVE: CVE-2021-46919
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: fix wq size store permission state

WQ size can only be changed when the device is disabled. Current code
allows change when device is enabled but wq is disabled. Change the check
to detect device state.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/05b7791c4c4aa8304368fdc55ae911f6b34e7281; https://git.kernel.org/stable/c/0fff71c5a311e[PII_REDACTED]f7dcc217fda15fadd; https://git.kernel.org/stable/c/4ecf[PII_REDACTED]3010bc8318c4aee60ad64037ae
CVE: CVE-2021-46920
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Fix clobbering of SWERR overflow bit on writeback

Current code blindly writes over the SWERR and the OVERFLOW bits. Write
back the bits actually read instead so the driver avoids clobbering the
OVERFLOW bit that comes after the register is read.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/02981a44a0e[PII_REDACTED]16371bd2e0c935685f8; https://git.kernel.org/stable/c/a5ad12d5d69c63af289a37f05187a0c6fe93553d; https://git.kernel.org/stable/c/ea941ac294d75d0ace50797aebf0056f6f8f7a7f
CVE: CVE-2023-50379
Published: 2024-02-27
Description: Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue.

Impact:
A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2024/02/27/1; https://lists.apache.org/thread/jglww6h6ngxpo1r6r5fx7ff7z29lnvv8; http://www.openwall.com/lists/oss-security/2024/02/27/1
CVE: CVE-2023-51518
Published: 2024-02-27
Description: Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.
Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.
Note that by default JMX endpoint is only bound locally.

We recommend users to:
 - Upgrade to a non-vulnerable Apache James version

 - Run Apache James isolated from other processes (docker - dedicated virtual machine)
 - If possible turn off JMX


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or; https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or
CVE: CVE-2023-6584
Published: 2024-02-27
Description: The WP JobSearch WordPress plugin before 2.3.4 does not prevent attackers from logging-in as any users with the only knowledge of that user's email address.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/e528e3cd-a45c-4bf7-a37a-101f5c257acd/; https://wpscan.com/vulnerability/e528e3cd-a45c-4bf7-a37a-101f5c257acd/
CVE: CVE-2023-6585
Published: 2024-02-27
Description: The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/757412f4-e4f8-4007-8e3b-639a72b33180/; https://wpscan.com/vulnerability/757412f4-e4f8-4007-8e3b-639a72b33180/
CVE: CVE-2023-7115
Published: 2024-02-27
Description: The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6ddd1a9e-3f96-4020-9b2b-f818a4d5ba58/; https://wpscan.com/vulnerability/6ddd1a9e-3f96-4020-9b2b-f818a4d5ba58/
CVE: CVE-2023-7165
Published: 2024-02-27
Description: The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/; https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/
CVE: CVE-2023-7167
Published: 2024-02-27
Description: The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6a2eb871-6b6e-4dbb-99f0-dd74d6c61e83/; https://wpscan.com/vulnerability/6a2eb871-6b6e-4dbb-99f0-dd74d6c61e83/
CVE: CVE-2023-7198
Published: 2024-02-27
Description: The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses a significant security risk as it violates the principle of least privilege and compromises the integrity and privacy of user data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://wpscan.com/vulnerability/75fbee63-d622-441f-8675-082907b0b1e6/; https://wpscan.com/vulnerability/75fbee63-d622-441f-8675-082907b0b1e6/
CVE: CVE-2023-7202
Published: 2024-02-27
Description: The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://research.cleantalk.org/cve-2023-7202-fatal-error-notify-error-email-sending-csrf/; https://wpscan.com/vulnerability/d923ba5b-1c20-40ee-ac69-cd0bb65b375a/; https://research.cleantalk.org/cve-2023-7202-fatal-error-notify-error-email-sending-csrf/
CVE: CVE-2023-7203
Published: 2024-02-27
Description: The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/; https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/
CVE: CVE-2024-0855
Published: 2024-02-27
Description: The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/5d5da91e-3f34-46b0-8db2-354a88bdf934/; https://wpscan.com/vulnerability/5d5da91e-3f34-46b0-8db2-354a88bdf934/
CVE: CVE-2024-1106
Published: 2024-02-27
Description: The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0672f8af-33e2-459c-ac8a-7351247a8a26/; https://wpscan.com/vulnerability/0672f8af-33e2-459c-ac8a-7351247a8a26/
CVE: CVE-2021-46921
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

locking/qrwlock: Fix ordering in queued_write_lock_slowpath()

While this code is executed with the wait_lock held, a reader can
acquire the lock without holding wait_lock.  The writer side loops
checking the value with the atomic_cond_read_acquire(), but only truly
acquires the lock when the compare-and-exchange is completed
successfully which isn’t ordered. This exposes the window between the
acquire and the cmpxchg to an A-B-A problem which allows reads
following the lock acquisition to observe values speculatively before
the write lock is truly acquired.

We've seen a problem in epoll where the reader does a xchg while
holding the read lock, but the writer can see a value change out from
under it.

  Writer                                | Reader
  --------------------------------------------------------------------------------
  ep_scan_ready_list()                  |
  |- write_lock_irq()                   |
      |- queued_write_lock_slowpath()   |
	|- atomic_cond_read_acquire()   |
				        | read_lock_irqsave(&ep->lock, flags);
     --> (observes value before unlock) |  chain_epi_lockless()
     |                                  |    epi->next = xchg(&ep->ovflist, epi);
     |                                  | read_unlock_irqrestore(&ep->lock, flags);
     |                                  |
     |     atomic_cmpxchg_relaxed()     |
     |-- READ_ONCE(ep->ovflist);        |

A core can order the read of the ovflist ahead of the
atomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire
semantics addresses this issue at which point the atomic_cond_read can
be switched to use relaxed semantics.

[peterz: use try_cmpxchg()]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://git.kernel.org/stable/c/5902f9453a313be8fe78cbd7e7ca9dba9319fc6e; https://git.kernel.org/stable/c/82808cc026811fbc3ecf0c0b267a12a339eead56; https://git.kernel.org/stable/c/82fa9ced35d88581cffa4a1c856fc41fca96d80a
CVE: CVE-2021-46922
Published: 2024-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix TPM reservation for seal/unseal

The original patch 8c657a0590de ("KEYS: trusted: Reserve TPM for seal
and unseal operations") was correct on the mailing list:

https://lore.kernel.org/linux-integrity/[PII_REDACTED]5621.127925-4-jarkko@kernel.org/

But somehow got rebased so that the tpm_try_get_ops() in
tpm2_seal_trusted() got lost.  This causes an imbalanced put of the
TPM ops and causes oopses on TIS based hardware.

This fix puts back the lost tpm_try_get_ops()
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/39c8d760d44cb3fa0d67e8cd505df81cf4d80999; https://git.kernel.org/stable/c/9d5171eab462a63e2fbebfccf6026e92be018f20; https://git.kernel.org/stable/c/bf84ef2dd2ccdcd8f2658476d34b51455f970ce4