deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5432
Published: 2024-06-20
Description: The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to insufficient verification on the user being supplied during the checkout through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://plugins.trac.wordpress.org/browser/lifeline-donation/trunk/includes/class-lifeline-donation.php?rev=2575844#L292; https://plugins.trac.wordpress.org/browser/lifeline-donation/trunk/vendor/webinane/webinane-commerce/includes/Classes/Checkout.php?rev=2490935#L125; https://www.wordfence.com/threat-intel/vulnerabilities/id/2e24da0c-13d2-4a3d-b918-0d28e3341d88?source=cve
CVE: CVE-2024-6177
Published: 2024-06-20
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lgsecurity.lge.com/bulletins/idproducts#updateDetails; https://lgsecurity.lge.com/bulletins/idproducts#updateDetails
CVE: CVE-2024-6178
Published: 2024-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lgsecurity.lge.com/bulletins/idproducts#updateDetails; https://lgsecurity.lge.com/bulletins/idproducts#updateDetails
CVE: CVE-2024-6179
Published: 2024-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lgsecurity.lge.com/bulletins/idproducts#updateDetails; https://lgsecurity.lge.com/bulletins/idproducts#updateDetails
CVE: CVE-2024-5213
Published: 2024-06-20
Description: In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login (`POST /api/request-token`) and after account creations (`POST /api/admin/users/new`). This exposure occurs because the entire User object, including the bcrypt password hash, is included in the response sent to the frontend. This practice could potentially lead to sensitive information exposure despite the use of bcrypt, a strong hashing algorithm. It is recommended not to expose any clues about passwords to the frontend.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://github.com/mintplex-labs/anything-llm/commit/9df4521113ddb9a3adb5d0e3941e7d494992629c; https://huntr.com/bounties/8794fb65-50aa-40e3-b348-a29838dbf63d; https://github.com/mintplex-labs/anything-llm/commit/9df4521113ddb9a3adb5d0e3941e7d494992629c
CVE: CVE-2024-4390
Published: 2024-06-20
Description: The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with contributor access and above, to generate a valid nonce for any WordPress action/function. This could be used to invoke functionality that is protected only by nonce checks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-269
References: https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Controllers/Ajax/SecurityAjaxController.php#L14; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3103357%40depicter%2Ftrunk&old=3090538%40depicter%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7c3a5d-b8aa-45cb-983c-55ba7e3d72f3?source=cve
CVE: CVE-2024-5605
Published: 2024-06-20
Description: The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php#L2783; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3098232%40media-library-assistant&new=3098232%40media-library-assistant&sfp_email=&sfph_mail=; https://wordpress.org/plugins/media-library-assistant/#developers
CVE: CVE-2024-5686
Published: 2024-06-20
Description: The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Team Members widget in all versions up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.1.38/includes/widgets/team-members/team-members.php#L1452; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3104212%40wpzoom-elementor-addons&new=3104212%40wpzoom-elementor-addons&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f972ab72-8e68-4ab3-aa7f-e2816de33554?source=cve
CVE: CVE-2024-4565
Published: 2024-06-20
Description: The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/; https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/
CVE: CVE-2024-5475
Published: 2024-06-20
Description: The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cee66543-b5d6-4205-8f9b-0febd7fee445/; https://wpscan.com/vulnerability/cee66543-b5d6-4205-8f9b-0febd7fee445/
CVE: CVE-2024-5522
Published: 2024-06-20
Description: The HTML5 Video Player  WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/bc76ef95-a2a9-4185-8ed9-1059097a506a/; https://wpscan.com/vulnerability/bc76ef95-a2a9-4185-8ed9-1059097a506a/
CVE: CVE-2024-6113
Published: 2024-06-20
Description: A vulnerability was found in itsourcecode Monbela Tourist Inn Online Reservation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The identifier VDB-268865 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/wangyuan-ui/CVE/issues/3; https://vuldb.com/?ctiid.268865; https://vuldb.com/?id.268865
CVE: CVE-2023-25646
Published: 2024-06-20
Description: There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific operations.
CVSS Score: 7.1 (HIGH)
CWE: CWE-281, CWE-281
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035844; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035844
CVE: CVE-2024-38619
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

usb-storage: alauda: Check whether the media is initialized

The member "uzonesize" of struct alauda_info will remain 0
if alauda_init_media() fails, potentially causing divide errors
in alauda_read_data() and alauda_write_lba().
- Add a member "media_initialized" to struct alauda_info.
- Change a condition in alauda_check_media() to ensure the
  first initialization.
- Add an error check for the return value of alauda_init_media().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/16637fea001ab3c8df528a8995b[PII_REDACTED]a30; https://git.kernel.org/stable/c/24bff7f714bdff97c2a75a0ff6a368cdf8ad5af4; https://git.kernel.org/stable/c/2cc32639ec347e3365075b130f9953ef16cb13f1
CVE: CVE-2024-4098
Published: 2024-06-20
Description: The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-552
References: https://plugins.trac.wordpress.org/browser/shariff/trunk/shariff.php#L410; https://plugins.trac.wordpress.org/changeset/3103137; https://www.wordfence.com/threat-intel/vulnerabilities/id/f49fba00-c576-4a1a-8b0b-9ebed3e3d090?source=cve
CVE: CVE-2024-38620
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HCI: Remove HCI_AMP support

Since BT_HS has been remove HCI_AMP controllers no longer has any use so
remove it along with the capability of creating AMP controllers.

Since we no longer need to differentiate between AMP and Primary
controllers, as only HCI_PRIMARY is left, this also remove
hdev->dev_type altogether.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c[PII_REDACTED]0e156; https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7; https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03
CVE: CVE-2024-29012
Published: 2024-06-20
Description: Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS) via sscanf function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0008; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0008
CVE: CVE-2024-29013
Published: 2024-06-20
Description: Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via memcpy function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0009; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0009
CVE: CVE-2024-34693
Published: 2024-06-20
Description: Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table.This issue affects Apache Superset: before 3.1.3 and version 4.0.0

Users are recommended to upgrade to version 4.0.1 or 3.1.3, which fixes the issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2024/06/20/1; https://lists.apache.org/thread/1803x1s34m7r71h1k0q1njol8k6fmyon; http://www.openwall.com/lists/oss-security/2024/06/20/1
CVE: CVE-2021-47617
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: pciehp: Fix infinite loop in IRQ handler upon power fault

The Power Fault Detected bit in the Slot Status register differs from
all other hotplug events in that it is sticky:  It can only be cleared
after turning off slot power.  Per PCIe r5.0, sec. 6.7.1.8:

  If a power controller detects a main power fault on the hot-plug slot,
  it must automatically set its internal main power fault latch [...].
  The main power fault latch is cleared when software turns off power to
  the hot-plug slot.

The stickiness used to cause interrupt storms and infinite loops which
were fixed in 2009 by commits 5651c48cfafe ("PCI pciehp: fix power fault
interrupt storm problem") and 99f0169c17f3 ("PCI: pciehp: enable
software notification on empty slots").

Unfortunately in 2020 the infinite loop issue was inadvertently
reintroduced by commit 8edf5332c393 ("PCI: pciehp: Fix MSI interrupt
race"):  The hardirq handler pciehp_isr() clears the PFD bit until
pciehp's power_fault_detected flag is set.  That happens in the IRQ
thread pciehp_ist(), which never learns of the event because the hardirq
handler is stuck in an infinite loop.  Fix by setting the
power_fault_detected flag already in the hardirq handler.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://git.kernel.org/stable/c/1db58c6584a72102e98af2e600ea184ddaf2b8af; https://git.kernel.org/stable/c/23584c1ed3e15a6f4bfab8dc5a88d94ab929ee12; https://git.kernel.org/stable/c/3b4c966fb156ff3e70b2526d964952ff7c1574d9
CVE: CVE-2021-47619
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix queues reservation for XDP

When XDP was configured on a system with large number of CPUs
and X722 NIC there was a call trace with NULL pointer dereference.

i40e 0000:87:00.0: failed to get tracking for 256 queues for VSI 0 err -12
i40e 0000:87:00.0: setup of MAIN VSI failed

BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
RIP: 0010:i40e_xdp+0xea/0x1b0 [i40e]
Call Trace:
? i40e_reconfig_rss_queues+0x130/0x130 [i40e]
dev_xdp_install+0x61/0xe0
dev_xdp_attach+0x18a/0x4c0
dev_change_xdp_fd+0x1e6/0x220
do_setlink+0x616/0x1030
? ahci_port_stop+0x80/0x80
? ata_qc_issue+0x107/0x1e0
? lock_timer_base+0x61/0x80
? __mod_timer+0x202/0x380
rtnl_setlink+0xe5/0x170
? bpf_lsm_binder_transaction+0x10/0x10
? security_capable+0x36/0x50
rtnetlink_rcv_msg+0x121/0x350
? rtnl_calcit.isra.0+0x100/0x100
netlink_rcv_skb+0x50/0xf0
netlink_unicast+0x1d3/0x2a0
netlink_sendmsg+0x22a/0x440
sock_sendmsg+0x5e/0x60
__sys_sendto+0xf0/0x160
? __sys_getsockname+0x7e/0xc0
? _copy_from_user+0x3c/0x80
? __sys_setsockopt+0xc8/0x1a0
__x64_sys_sendto+0x20/0x30
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f83fa7a39e0

This was caused by PF queue pile fragmentation due to
flow director VSI queue being placed right after main VSI.
Because of this main VSI was not able to resize its
queue allocation for XDP resulting in no queues allocated
for main VSI when XDP was turned on.

Fix this by always allocating last queue in PF queue pile
for a flow director VSI.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/00eddb0e4ea115154581d1049507a996acfc2d3e; https://git.kernel.org/stable/c/4b3aa858268b7b9aeef02e5f9c4cd8f8fac101c8; https://git.kernel.org/stable/c/768eb705e6381f0c70ca29d4e66f19790d5d19a1
CVE: CVE-2021-47620
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: refactor malicious adv data check

Check for out-of-bound read was being performed at the end of while
num_reports loop, and would fill journal with false positives. Added
check to beginning of loop processing so that it doesn't get checked
after ptr has been advanced.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://git.kernel.org/stable/c/305e92f525450f3e1b5f5c9dc7eadb152d66a082; https://git.kernel.org/stable/c/5a539c08d743d[PII_REDACTED]da78af5e961664c0e; https://git.kernel.org/stable/c/5c968affa804ba98c3c603f37ffea6fba618025e
CVE: CVE-2022-48711
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

tipc: improve size validations for received domain records

The function tipc_mon_rcv() allows a node to receive and process
domain_record structs from peer nodes to track their views of the
network topology.

This patch verifies that the number of members in a received domain
record does not exceed the limit defined by MAX_MON_DOMAIN, something
that may otherwise lead to a stack overflow.

tipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where
we are reading a 32 bit message data length field into a uint16.  To
avert any risk of bit overflow, we add an extra sanity check for this in
that function.  We cannot see that happen with the current code, but
future designers being unaware of this risk, may introduce it by
allowing delivery of very large (> 64k) sk buffers from the bearer
layer.  This potential problem was identified by Eric Dumazet.

This fixes CVE-2022-0435
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/175db196e45d6f0e6047eccd09c8ba55465eb131; https://git.kernel.org/stable/c/1f[PII_REDACTED]b0222b0c2153828b475d95e374a7; https://git.kernel.org/stable/c/3c7e[PII_REDACTED]f68bbc070683db6bb6f6e9e78e
CVE: CVE-2022-48712
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix error handling in ext4_fc_record_modified_inode()

Current code does not fully takes care of krealloc() error case, which
could lead to silent memory corruption or a kernel bug.  This patch
fixes that.

Also it cleans up some duplicated error handling logic from various
functions in fast_commit.c file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/14aa3f49c7fc6424763f4323bfbc3a807b0727dc; https://git.kernel.org/stable/c/1b6762ecdf3cf[PII_REDACTED]c904aa3c420a1802; https://git.kernel.org/stable/c/62e46e0ffc02daa8fcfc02f7a932cc8a19601b19
CVE: CVE-2022-48713
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel/pt: Fix crash with stop filters in single-range mode

Add a check for !buf->single before calling pt_buffer_region_size in a
place where a missing check can cause a kernel crash.

Fixes a bug introduced by commit 670638477aed ("perf/x86/intel/pt:
Opportunistically use single range output mode"), which added a
support for PT single-range output mode. Since that commit if a PT
stop filter range is hit while tracing, the kernel will crash because
of a null pointer dereference in pt_handle_status due to calling
pt_buffer_region_size without a ToPA configured.

The commit which introduced single-range mode guarded almost all uses of
the ToPA buffer variables with checks of the buf->single variable, but
missed the case where tracing was stopped by the PT hardware, which
happens when execution hits a configured stop filter.

Tested that hitting a stop filter while PT recording successfully
records a trace with this patch but crashes without this patch.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1d9093457b243061a9bba23543c38726e864a643; https://git.kernel.org/stable/c/456f041e035913fcedb275aff6f8a71dfebcd394; https://git.kernel.org/stable/c/e83d941fd3445f660d2f43647c580a320cc384f6
CVE: CVE-2022-48714
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Use VM_MAP instead of VM_ALLOC for ringbuf

After commit 2fd3fb0be1d1 ("kasan, vmalloc: unpoison VM_ALLOC pages
after mapping"), non-VM_ALLOC mappings will be marked as accessible
in __get_vm_area_node() when KASAN is enabled. But now the flag for
ringbuf area is VM_ALLOC, so KASAN will complain out-of-bound access
after vmap() returns. Because the ringbuf area is created by mapping
allocated pages, so use VM_MAP instead.

After the change, info in /proc/vmallocinfo also changes from
  [start]-[end]   24576 ringbuf_map_alloc+0x171/0x290 vmalloc user
to
  [start]-[end]   24576 ringbuf_map_alloc+0x171/0x290 vmap user
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/5e457aeab52a5947619e1f18047f4d2f3212b3eb; https://git.kernel.org/stable/c/6304a613a97d6dcd49b93fbad31e9f39d1e138d6; https://git.kernel.org/stable/c/b293dcc473d22a62dc6d78de2b15e4f49515db56
CVE: CVE-2022-48715
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe

Running tests with a debug kernel shows that bnx2fc_recv_frame() is
modifying the per_cpu lport stats counters in a non-mpsafe way.  Just boot
a debug kernel and run the bnx2fc driver with the hardware enabled.

[ 1391.699147] BUG: using smp_processor_id() in preemptible [00000000] code: bnx2fc_
[ 1391.699160] caller is bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc]
[ 1391.699174] CPU: 2 PID: 4355 Comm: bnx2fc_l2_threa Kdump: loaded Tainted: G    B
[ 1391.699180] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013
[ 1391.699183] Call Trace:
[ 1391.699188]  dump_stack_lvl+0x57/0x7d
[ 1391.699198]  check_preemption_disabled+0xc8/0xd0
[ 1391.699205]  bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc]
[ 1391.699215]  ? do_raw_spin_trylock+0xb5/0x180
[ 1391.699221]  ? bnx2fc_npiv_create_vports.isra.0+0x4e0/0x4e0 [bnx2fc]
[ 1391.699229]  ? bnx2fc_l2_rcv_thread+0xb7/0x3a0 [bnx2fc]
[ 1391.699240]  bnx2fc_l2_rcv_thread+0x1af/0x3a0 [bnx2fc]
[ 1391.699250]  ? bnx2fc_ulp_init+0xc0/0xc0 [bnx2fc]
[ 1391.699258]  kthread+0x364/0x420
[ 1391.699263]  ? _raw_spin_unlock_irq+0x24/0x50
[ 1391.699268]  ? set_kthread_struct+0x100/0x100
[ 1391.699273]  ret_from_fork+0x22/0x30

Restore the old get_cpu/put_cpu code with some modifications to reduce the
size of the critical section.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/003bcee66a8f0e76157eb3af369c173151901d97; https://git.kernel.org/stable/c/2d24336c7214b281b51860e54783dfc65f1248df; https://git.kernel.org/stable/c/2f5a1ac68bdf2899ce822ab845081922ea8c588e
CVE: CVE-2022-48716
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: wcd938x: fix incorrect used of portid

Mixer controls have the channel id in mixer->reg, which is not same
as port id. port id should be derived from chan_info array.
So fix this. Without this, its possible that we could corrupt
struct wcd938x_sdw_priv by accessing port_map array out of range
with channel id instead of port id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-400
References: https://git.kernel.org/stable/c/9167f2712dc8c24964840a4d1e2ebf130e846b95; https://git.kernel.org/stable/c/aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f; https://git.kernel.org/stable/c/c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7
CVE: CVE-2022-48717
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: max9759: fix underflow in speaker_gain_control_put()

Check for negative values of "priv->gain" to prevent an out of bounds
access.  The concern is that these might come from the user via:
  -> snd_ctl_elem_write_user()
    -> snd_ctl_elem_write()
      -> kctl->put()
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/4c907bcd9dcd233da6707059d777ab389dcbd964; https://git.kernel.org/stable/c/5a45448ac95b715173edb1cd090ff24b6586d921; https://git.kernel.org/stable/c/71e60c170105d153e34d01766c1e4db26a4b24cc