deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-52401
Published: 2024-11-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog DownloadManager hacklog-downloadmanager allows Upload a Web Shell to a Web Server.This issue affects Hacklog DownloadManager: from n/a through <= 2.1.4.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/hacklog-downloadmanager/vulnerability/wordpress-hacklog-downloadmanager-plugin-2-1-4-csrf-to-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-52402
Published: 2024-11-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in gunghoinc Exclusive Content Password Protect exclusive-content-password-protect allows Upload a Web Shell to a Web Server.This issue affects Exclusive Content Password Protect: from n/a through <= 1.1.0.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/exclusive-content-password-protect/vulnerability/wordpress-exclusive-content-password-protect-plugin-1-1-0-csrf-to-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-52420
Published: 2024-11-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Disable Admin Notices individually disable-admin-notices allows Cross Site Request Forgery.This issue affects Disable Admin Notices individually: from n/a through <= 1.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/disable-admin-notices/vulnerability/wordpress-disable-admin-notices-individually-plugin-1-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-52421
Published: 2024-11-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Popup Window Maker easy-popup-lightbox-maker allows Stored XSS.This issue affects WP Popup Window Maker: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/easy-popup-lightbox-maker/vulnerability/wordpress-wp-popup-window-maker-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52600
Published: 2024-11-19
Description: Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d; https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da; https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d
CVE: CVE-2024-52788
Published: 2024-11-19
Description: Tenda W9 v1.0.0.7(4456) was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.
CVSS Score: 8.0 (HIGH)
CWE: CWE-798
References: https://colorful-meadow-5b9.notion.site/W9_HardCode_vuln-13dc216a1c30800fb31bdcdca7345ec3
CVE: CVE-2024-52789
Published: 2024-11-19
Description: Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.
CVSS Score: 8.0 (HIGH)
CWE: CWE-798
References: https://colorful-meadow-5b9.notion.site/W30E_HardCode_vuln-13dc216a1c30805998f8d994f966760a
CVE: CVE-2017-13315
Published: 2024-11-19
Description: In writeToParcel and createFromParcel of DcParamObject.java, there is a permission bypass due to a write size mismatch. This could lead to an elevation of privileges where the user can start an activity with system privileges, with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-131, CWE-131
References: https://source.android.com/security/bulletin/2018-05-01
CVE: CVE-2018-9338
Published: 2024-11-19
Description: In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2022-47424
Published: 2024-11-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARMember, Repute InfoSystems ARMember Premium allows Cross-Site Request Forgery.This issue affects ARMember: from n/a through 4.0.5; ARMember Premium: from n/a before 6.7.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-5-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-21270
Published: 2024-11-19
Description: In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect permission flags cleared during an update. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863, CWE-276
References: https://source.android.com/security/bulletin/2023-08-01
CVE: CVE-2024-10224
Published: 2024-11-19
Description: Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529; https://www.cve.org/CVERecord?id=CVE-2024-10224; https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
CVE: CVE-2024-11003
Published: 2024-11-19
Description: Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/liske/needrestart/commit/0f80a348883f72279a859ee655f58da34babefb0; https://www.cve.org/CVERecord?id=CVE-2024-10224; https://www.cve.org/CVERecord?id=CVE-2024-11003
CVE: CVE-2024-42450
Published: 2024-11-19
Description: The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a common password across all instances of Versa Director. By default, Versa Director configures Postgres to listen on all network interfaces. This combination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to escalate privileges on the system. 

Exploitation Status:
Versa Networks is not aware of this exploitation in any production systems. A proof of concept exists in the lab environment.

Workarounds or Mitigation:
Starting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors. For older releases, Versa recommends performing manual hardening of HA ports. Please refer to the following link for the steps https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Secure_HA_Ports  

This vulnerability is not exploitable on Versa Directors if published Firewall guidelines are implemented. We have validated that no Versa-hosted head ends have been affected by this vulnerability. All Versa-hosted head ends are patched and hardened. 

Please contact Versa Technical Support or Versa account team for any further assistance.

Software Download Links:
22.1.4: https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]8-release-22-1-4
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-798
References: https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3
CVE: CVE-2024-48069
Published: 2024-11-19
Description: A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server privileges
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-362
References: https://gist.github.com/CoinIsMoney/5dd555805e8f974630ced8a1df8182f1; https://github.com/stuven1989/TemporaryGuild/blob/main/guild2.md
CVE: CVE-2024-48070
Published: 2024-11-19
Description: An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution, and control server privileges
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/CoinIsMoney/ec863c35dfd05c7deea2afea11bf2446; https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp2-eng.pdf
CVE: CVE-2024-48072
Published: 2024-11-19
Description: Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction&action=getFieldTriggerValue&searchField=*&fromTable=HrmResourceManager&whereClause=1%3d1&triggerCondition=1&expression=%3d&fieldValue=1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/CoinIsMoney/8ca1f2bf2e0399724c698327f2da8579; https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp-eng4.pdf
CVE: CVE-2024-48990
Published: 2024-11-19
Description: Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/liske/needrestart/commit/fcc9a[PII_REDACTED]bef4ef5ed026a0d7a275149ab; https://www.cve.org/CVERecord?id=CVE-2024-48990; https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
CVE: CVE-2024-48991
Published: 2024-11-19
Description: Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3).
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d; https://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59; https://www.cve.org/CVERecord?id=CVE-2024-48991
CVE: CVE-2024-48992
Published: 2024-11-19
Description: Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/liske/needrestart/commit/b5f25f6ec6e7dd0c5be249e4e45de4ee9ffe594f; https://www.cve.org/CVERecord?id=CVE-2024-48992; https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
CVE: CVE-2024-50304
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()

The per-netns IP tunnel hash table is protected by the RTNL mutex and
ip_tunnel_find() is only called from the control path where the mutex is
taken.

Add a lockdep expression to hlist_for_each_entry_rcu() in
ip_tunnel_find() in order to validate that the mutex is held and to
silence the suspicious RCU usage warning [1].

[1]
WARNING: suspicious RCU usage
6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted
-----------------------------
net/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by ip/362:
 #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60

stack backtrace:
CPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
 <TASK>
 dump_stack_lvl+0xba/0x110
 lockdep_rcu_suspicious.cold+0x4f/0xd6
 ip_tunnel_find+0x435/0x4d0
 ip_tunnel_newlink+0x517/0x7a0
 ipgre_newlink+0x14c/0x170
 __rtnl_newlink+0x1173/0x19c0
 rtnl_newlink+0x6c/0xa0
 rtnetlink_rcv_msg+0x3cc/0xf60
 netlink_rcv_skb+0x171/0x450
 netlink_unicast+0x539/0x7f0
 netlink_sendmsg+0x8c1/0xd80
 ____sys_sendmsg+0x8f9/0xc20
 ___sys_sendmsg+0x197/0x1e0
 __sys_sendmsg+0x122/0x1f0
 do_syscall_64+0xbb/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/31bd7378c6fe100a8af0e996ea0b5dafd3579df6; https://git.kernel.org/stable/c/6ac5dfa575136da8dd8a9e7c1437c41f3a593993; https://git.kernel.org/stable/c/90e0569dd3d32f4f4d2ca691d3fa5a8a14a13c12
CVE: CVE-2024-53042
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()

There are code paths from which the function is called without holding
the RCU read lock, resulting in a suspicious RCU usage warning [1].

Fix by using l3mdev_master_upper_ifindex_by_index() which will acquire
the RCU read lock before calling
l3mdev_master_upper_ifindex_by_index_rcu().

[1]
WARNING: suspicious RCU usage
6.12.0-rc3-custom-gac8f72681cf2 #141 Not tainted
-----------------------------
net/core/dev.c:876 RCU-list traversed in non-reader section!!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by ip/361:
 #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60

stack backtrace:
CPU: 3 UID: 0 PID: 361 Comm: ip Not tainted 6.12.0-rc3-custom-gac8f72681cf2 #141
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
 <TASK>
 dump_stack_lvl+0xba/0x110
 lockdep_rcu_suspicious.cold+0x4f/0xd6
 dev_get_by_index_rcu+0x1d3/0x210
 l3mdev_master_upper_ifindex_by_index_rcu+0x2b/0xf0
 ip_tunnel_bind_dev+0x72f/0xa00
 ip_tunnel_newlink+0x368/0x7a0
 ipgre_newlink+0x14c/0x170
 __rtnl_newlink+0x1173/0x19c0
 rtnl_newlink+0x6c/0xa0
 rtnetlink_rcv_msg+0x3cc/0xf60
 netlink_rcv_skb+0x171/0x450
 netlink_unicast+0x539/0x7f0
 netlink_sendmsg+0x8c1/0xd80
 ____sys_sendmsg+0x8f9/0xc20
 ___sys_sendmsg+0x197/0x1e0
 __sys_sendmsg+0x122/0x1f0
 do_syscall_64+0xbb/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5edcb3fdb12c3d46a6e79eeeec27d925b80fc168; https://git.kernel.org/stable/c/699b48fc31727792edf2cab3829586ae6ba649e2; https://git.kernel.org/stable/c/6dfaa458fe923211c766238a224e0a3c0522935c
CVE: CVE-2024-53043
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

mctp i2c: handle NULL header address

daddr can be NULL if there is no neighbour table entry present,
in that case the tx packet should be dropped.

saddr will usually be set by MCTP core, but check for NULL in case a
packet is transmitted by a different protocol.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/01e215975fd80af81b5b79f009d49ddd35976c13; https://git.kernel.org/stable/c/[PII_REDACTED]802a0917231b94cb20cbe50ccbfe03; https://git.kernel.org/stable/c/8c222adadc1612e4f[PII_REDACTED]62a28e3f5ab44
CVE: CVE-2024-53044
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()

This command:

$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact
Error: block dev insert failed: -EBUSY.

fails because user space requests the same block index to be set for
both ingress and egress.

[ side note, I don't think it even failed prior to commit 913b47d3424e
  ("net/sched: Introduce tc block netdev tracking infra"), because this
  is a command from an old set of notes of mine which used to work, but
  alas, I did not scientifically bisect this ]

The problem is not that it fails, but rather, that the second time
around, it fails differently (and irrecoverably):

$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact
Error: dsa_core: Flow block cb is busy.

[ another note: the extack is added by me for illustration purposes.
  the context of the problem is that clsact_init() obtains the same
  &q->ingress_block pointer as &q->egress_block, and since we call
  tcf_block_get_ext() on both of them, "dev" will be added to the
  block->ports xarray twice, thus failing the operation: once through
  the ingress block pointer, and once again through the egress block
  pointer. the problem itself is that when xa_insert() fails, we have
  emitted a FLOW_BLOCK_BIND command through ndo_setup_tc(), but the
  offload never sees a corresponding FLOW_BLOCK_UNBIND. ]

Even correcting the bad user input, we still cannot recover:

$ tc qdisc replace dev swp3 ingress_block 1 egress_block 2 clsact
Error: dsa_core: Flow block cb is busy.

Basically the only way to recover is to reboot the system, or unbind and
rebind the net device driver.

To fix the bug, we need to fill the correct error teardown path which
was missed during code movement, and call tcf_block_offload_unbind()
when xa_insert() fails.

[ last note, fundamentally I blame the label naming convention in
  tcf_block_get_ext() for the bug. The labels should be named after what
  they do, not after the error path that jumps to them. This way, it is
  obviously wrong that two labels pointing to the same code mean
  something is wrong, and checking the code correctness at the goto site
  is also easier ]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/8966eb69a143b1c032365fe84f2815f3c46f2590; https://git.kernel.org/stable/c/a13e690191eafc154b3f60afe9ce35aa9b9128b4
CVE: CVE-2024-53045
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: dapm: fix bounds checker error in dapm_widget_list_create

The widgets array in the snd_soc_dapm_widget_list has a __counted_by
attribute attached to it, which points to the num_widgets variable. This
attribute is used in bounds checking, and if it is not set before the
array is filled, then the bounds sanitizer will issue a warning or a
kernel panic if CONFIG_UBSAN_TRAP is set.

This patch sets the size of the widgets list calculated with
list_for_each as the initial value for num_widgets as it is used for
allocating memory for the array. It is updated with the actual number of
added elements after the array is filled.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2ef9439f7a19fd3d43b288d38b1c6e55b668a4fe; https://git.kernel.org/stable/c/c549cb66e8de0ba1936fc97a59f0156741d3492a
CVE: CVE-2024-53047
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

mptcp: init: protect sched with rcu_read_lock

Enabling CONFIG_PROVE_RCU_LIST with its dependence CONFIG_RCU_EXPERT
creates this splat when an MPTCP socket is created:

  =============================
  WARNING: suspicious RCU usage
  6.12.0-rc2+ #11 Not tainted
  -----------------------------
  net/mptcp/sched.c:44 RCU-list traversed in non-reader section!!

  other info that might help us debug this:

  rcu_scheduler_active = 2, debug_locks = 1
  no locks held by mptcp_connect/176.

  stack backtrace:
  CPU: 0 UID: 0 PID: 176 Comm: mptcp_connect Not tainted 6.12.0-rc2+ #11
  Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
  Call Trace:
   <TASK>
   dump_stack_lvl (lib/dump_stack.c:123)
   lockdep_rcu_suspicious (kernel/locking/lockdep.c:6822)
   mptcp_sched_find (net/mptcp/sched.c:44 (discriminator 7))
   mptcp_init_sock (net/mptcp/protocol.c:2867 (discriminator 1))
   ? sock_init_data_uid (arch/x86/include/asm/atomic.h:28)
   inet_create.part.0.constprop.0 (net/ipv4/af_inet.c:386)
   ? __sock_create (include/linux/rcupdate.h:347 (discriminator 1))
   __sock_create (net/socket.c:1576)
   __sys_socket (net/socket.c:1671)
   ? __pfx___sys_socket (net/socket.c:1712)
   ? do_user_addr_fault (arch/x86/mm/fault.c:1419 (discriminator 1))
   __x64_sys_socket (net/socket.c:1728)
   do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1))
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

That's because when the socket is initialised, rcu_read_lock() is not
used despite the explicit comment written above the declaration of
mptcp_sched_find() in sched.c. Adding the missing lock/unlock avoids the
warning.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/3deb12c788c385e17142ce6ec50f769852fcec65; https://git.kernel.org/stable/c/494eb22f9a7bd03783e60595a57611c209175f1a; https://git.kernel.org/stable/c/cb8b81ad3e893a6d18dcdd3754cc2ea2a42c0136
CVE: CVE-2024-53048
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

ice: fix crash on probe for DPLL enabled E810 LOM

The E810 Lan On Motherboard (LOM) design is vendor specific. Intel
provides the reference design, but it is up to vendor on the final
product design. For some cases, like Linux DPLL support, the static
values defined in the driver does not reflect the actual LOM design.
Current implementation of dpll pins is causing the crash on probe
of the ice driver for such DPLL enabled E810 LOM designs:

WARNING: (...) at drivers/dpll/dpll_core.c:495 dpll_pin_get+0x2c4/0x330
...
Call Trace:
 <TASK>
 ? __warn+0x83/0x130
 ? dpll_pin_get+0x2c4/0x330
 ? report_bug+0x1b7/0x1d0
 ? handle_bug+0x42/0x70
 ? exc_invalid_op+0x18/0x70
 ? asm_exc_invalid_op+0x1a/0x20
 ? dpll_pin_get+0x117/0x330
 ? dpll_pin_get+0x2c4/0x330
 ? dpll_pin_get+0x117/0x330
 ice_dpll_get_pins.isra.0+0x52/0xe0 [ice]
...

The number of dpll pins enabled by LOM vendor is greater than expected
and defined in the driver for Intel designed NICs, which causes the crash.

Prevent the crash and allow generic pin initialization within Linux DPLL
subsystem for DPLL enabled E810 LOM designs.

Newly designed solution for described issue will be based on "per HW
design" pin initialization. It requires pin information dynamically
acquired from the firmware and is already in progress, planned for
next-tree only.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6e58c33106220c6c0c8fbee9ab63eae76ad8f260; https://git.kernel.org/stable/c/82b107a27bab29146e159b6b9f21146c97c45a53