deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-46236
Published: 2024-10-21
Description: CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the address parameter in add_members.php and edit_member.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anoncoder01/PHP_CodeAstro_Stored_XSS/blob/master/vulnerabilities/XSS_1.md
CVE: CVE-2024-46238
Published: 2024-10-21
Description: Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /admin/add-doctor.php and /admin/edit-doctor.php
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://github.com/anoncoder01/PHP_Gurukul_Hospital_Management_System_XSS/blob/master/vulnerabilities/XSS2.md
CVE: CVE-2024-46239
Published: 2024-10-21
Description: Multiple cross-site scripting vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /doctor/edit-profile.php and adminremark parameter in /admin/query-details.php.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://github.com/anoncoder01/PHP_Gurukul_Hospital_Management_System_XSS/blob/master/vulnerabilities/XSS3.md
CVE: CVE-2024-47825
Published: 2024-10-21
Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-276
References: https://github.com/cilium/cilium/security/advisories/GHSA-3wwx-63fv-pfq6
CVE: CVE-2024-48709
Published: 2024-10-21
Description: CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the membershipType parameter in edit_type.php
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anoncoder01/PHP_CodeAstro_Stored_XSS/blob/master/vulnerabilities/XSS_2.md
CVE: CVE-2024-50003
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix system hang while resume with TBT monitor

[Why]
Connected with a Thunderbolt monitor and do the suspend and the system
may hang while resume.

The TBT monitor HPD will be triggered during the resume procedure
and call the drm_client_modeset_probe() while
struct drm_connector connector->dev->master is NULL.

It will mess up the pipe topology after resume.

[How]
Skip the TBT monitor HPD during the resume procedure because we
currently will probe the connectors after resume by default.

(cherry picked from commit 453f86a26945207a16b8f66aaed5962dc2b95b85)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/52d4e3fb3d340447dcdac0e14ff21a764f326907; https://git.kernel.org/stable/c/68d603f467a75618eeae5bfe8af32cda47097010; https://git.kernel.org/stable/c/722d2d8fc423108597b97efbf165187d16d9aa1e
CVE: CVE-2024-50004
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35

[WHY & HOW]
Mismatch in DCN35 DML2 cause bw validation failed to acquire unexpected DPP pipe to cause
grey screen and system hang. Remove EnhancedPrefetchScheduleAccelerationFinal value override
to match HW spec.

(cherry picked from commit 9dad21f910fcea2bdcff4af46159101d7f9cd8ba)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0d5e5e8a0aa49ea2163abf128da3b509a6c58286; https://git.kernel.org/stable/c/4010efc[PII_REDACTED]cc3b57be2d4a2d5d9e50228; https://git.kernel.org/stable/c/945dc25eda88b5d6e30c9686dc619ab981c22d0e
CVE: CVE-2024-50005
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

mac802154: Fix potential RCU dereference issue in mac802154_scan_worker

In the `mac802154_scan_worker` function, the `scan_req->type` field was
accessed after the RCU read-side critical section was unlocked. According
to RCU usage rules, this is illegal and can lead to unpredictable
behavior, such as accessing memory that has been updated or causing
use-after-free issues.

This possible bug was identified using a static analysis tool developed
by myself, specifically designed to detect RCU-related issues.

To address this, the `scan_req->type` value is now stored in a local
variable `scan_req_type` while still within the RCU read-side critical
section. The `scan_req_type` is then used after the RCU lock is released,
ensuring that the type value is safely accessed without violating RCU
rules.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/540138377b22f601f06f55ebfa3ca171dcab471a; https://git.kernel.org/stable/c/bff1709b3980bd7f80be6786f64cc9a9ee9e56da; https://git.kernel.org/stable/c/d18f669461811dfe2915d5554ab2a9834f810013
CVE: CVE-2024-50006
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix i_data_sem unlock order in ext4_ind_migrate()

Fuzzing reports a possible deadlock in jbd2_log_wait_commit.

This issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require
synchronous updates because the file descriptor is opened with O_SYNC.
This can lead to the jbd2_journal_stop() function calling
jbd2_might_wait_for_commit(), potentially causing a deadlock if the
EXT4_IOC_MIGRATE call races with a write(2) system call.

This problem only arises when CONFIG_PROVE_LOCKING is enabled. In this
case, the jbd2_might_wait_for_commit macro locks jbd2_handle in the
jbd2_journal_stop function while i_data_sem is locked. This triggers
lockdep because the jbd2_journal_start function might also lock the same
jbd2_handle simultaneously.

Found by Linux Verification Center (linuxtesting.org) with syzkaller.

Rule: add
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/3c46d6060d3e38de22196c1fe7706c5a3c696285; https://git.kernel.org/stable/c/4192adefc9c570698821c5eb9873320eac2fcbf1; https://git.kernel.org/stable/c/53b1999cfd2c7addf2e581a32865fe8835467b44
CVE: CVE-2024-50007
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: asihpi: Fix potential OOB array access

ASIHPI driver stores some values in the static array upon a response
from the driver, and its index depends on the firmware.  We shouldn't
trust it blindly.

This patch adds a sanity check of the array index to fit in the array
size.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/219587bca2678e31700ef09ecec178ba1f735674; https://git.kernel.org/stable/c/36ee4021bcc37b834996e79740d095d6f8dd948f; https://git.kernel.org/stable/c/7a[PII_REDACTED]1f7b2bc46dc988b60ef2e416a747
CVE: CVE-2024-50008
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()

Replace one-element array with a flexible-array member in
`struct host_cmd_ds_802_11_scan_ext`.

With this, fix the following warning:

elo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------
elo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1)
elo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/17199b69a84798efffc475040fbef44374ef1de1; https://git.kernel.org/stable/c/1756918f51e9ab247a0f4782cc28853c2bb457c1; https://git.kernel.org/stable/c/498365e52bebcbc36a93279fe7e9d6aec8479cee
CVE: CVE-2024-50009
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value

cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it
and return in case of error.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/5493f9714e4cdaf0ee7cec15899a231400cb1a9f; https://git.kernel.org/stable/c/5f250d44b8191d612355dd97b89b37bbc1b5d2cb; https://git.kernel.org/stable/c/cd9f7bf6cad8b2d3876105ce3c9fc63460a046f6
CVE: CVE-2024-50010
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

exec: don't WARN for racy path_noexec check

Both i_mode and noexec checks wrapped in WARN_ON stem from an artifact
of the previous implementation. They used to legitimately check for the
condition, but that got moved up in two commits:
633fb6ac3980 ("exec: move S_ISREG() check earlier")
0fd338b2d2cd ("exec: move path_noexec() check earlier")

Instead of being removed said checks are WARN_ON'ed instead, which
has some debug value.

However, the spurious path_noexec check is racy, resulting in
unwarranted warnings should someone race with setting the noexec flag.

One can note there is more to perm-checking whether execve is allowed
and none of the conditions are guaranteed to still hold after they were
tested for.

Additionally this does not validate whether the code path did any perm
checking to begin with -- it will pass if the inode happens to be
regular.

Keep the redundant path_noexec() check even though it's mindless
nonsense checking for guarantee that isn't given so drop the WARN.

Reword the commentary and do small tidy ups while here.

[brauner: keep redundant path_noexec() check]
CVSS Score: 4.7 (MEDIUM)
References: https://git.kernel.org/stable/c/0bdf77be2330062b3a64f2bec39f62ab874a6796; https://git.kernel.org/stable/c/0d16f53c91111cec914f0811fcc526a2ba77b20d; https://git.kernel.org/stable/c/0d196e7589cefe207d5d41f37a0a28a1fdeeb7c6
CVE: CVE-2024-50011
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: soc-acpi-intel-rpl-match: add missing empty item

There is no links_num in struct snd_soc_acpi_mach {}, and we test
!link->num_adr as a condition to end the loop in hda_sdw_machine_select().
So an empty item in struct snd_soc_acpi_link_adr array is required.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://git.kernel.org/stable/c/5afc29ba44fdd1bcbad4e07246c395d946301580; https://git.kernel.org/stable/c/aa3109ee91fe09e696274e6ac44813df8d13678f
CVE: CVE-2024-50012
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

cpufreq: Avoid a bad reference count on CPU node

In the parse_perf_domain function, if the call to
of_parse_phandle_with_args returns an error, then the reference to the
CPU device node that was acquired at the start of the function would not
be properly decremented.

Address this by declaring the variable with the __free(device_node)
cleanup attribute.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0f41f383b5a61a2bf6429a449ebba7fb08179d81; https://git.kernel.org/stable/c/47cb1d9278f179df8250304ec41009e3e836a926; https://git.kernel.org/stable/c/6c3d[PII_REDACTED]f1a0fc6367f314446e4a2ebd0b
CVE: CVE-2024-50013
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

exfat: fix memory leak in exfat_load_bitmap()

If the first directory entry in the root directory is not a bitmap
directory entry, 'bh' will not be released and reassigned, which
will cause a memory leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/4e1813e52f86eb8db0c6c9570251f2fcbc571f5d; https://git.kernel.org/stable/c/89081e8407e637463db5880d168e3652fb9f4330; https://git.kernel.org/stable/c/bf0b3b35259475d1fe377bcaa565488e26684f7a
CVE: CVE-2024-50014
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix access to uninitialised lock in fc replay path

The following kernel trace can be triggered with fstest generic/629 when
executed against a filesystem with fast-commit feature enabled:

INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 PID: 866 Comm: mount Not tainted 6.10.0+ #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x66/0x90
 register_lock_class+0x759/0x7d0
 __lock_acquire+0x85/0x2630
 ? __find_get_block+0xb4/0x380
 lock_acquire+0xd1/0x2d0
 ? __ext4_journal_get_write_access+0xd5/0x160
 _raw_spin_lock+0x33/0x40
 ? __ext4_journal_get_write_access+0xd5/0x160
 __ext4_journal_get_write_access+0xd5/0x160
 ext4_reserve_inode_write+0x61/0xb0
 __ext4_mark_inode_dirty+0x79/0x270
 ? ext4_ext_replay_set_iblocks+0x2f8/0x450
 ext4_ext_replay_set_iblocks+0x330/0x450
 ext4_fc_replay+0x14c8/0x1540
 ? jread+0x88/0x2e0
 ? rcu_is_watching+0x11/0x40
 do_one_pass+0x447/0xd00
 jbd2_journal_recover+0x139/0x1b0
 jbd2_journal_load+0x96/0x390
 ext4_load_and_init_journal+0x253/0xd40
 ext4_fill_super+0x2cc6/0x3180
...

In the replay path there's an attempt to lock sbi->s_bdev_wb_lock in
function ext4_check_bdev_write_error().  Unfortunately, at this point this
spinlock has not been initialized yet.  Moving it's initialization to an
earlier point in __ext4_fill_super() fixes this splat.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/23dfdb56581ad92a9967bcd720c8c23356af74c1; https://git.kernel.org/stable/c/6e35f560daebe40264c95e9a1ab03110d4997df6; https://git.kernel.org/stable/c/b002031d585a14eed511117dda8c6452a804d508
CVE: CVE-2024-50015
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: dax: fix overflowing extents beyond inode size when partially writing

The dax_iomap_rw() does two things in each iteration: map written blocks
and copy user data to blocks. If the process is killed by user(See signal
handling in dax_iomap_iter()), the copied data will be returned and added
on inode size, which means that the length of written extents may exceed
the inode size, then fsck will fail. An example is given as:

dd if=/dev/urandom of=file bs=4M count=1
 dax_iomap_rw
  iomap_iter // round 1
   ext4_iomap_begin
    ext4_iomap_alloc // allocate 0~2M extents(written flag)
  dax_iomap_iter // copy 2M data
  iomap_iter // round 2
   iomap_iter_advance
    iter->pos += iter->processed // iter->pos = 2M
   ext4_iomap_begin
    ext4_iomap_alloc // allocate 2~4M extents(written flag)
  dax_iomap_iter
   fatal_signal_pending
  done = iter->pos - iocb->ki_pos // done = 2M
 ext4_handle_inode_extension
  ext4_update_inode_size // inode size = 2M

fsck reports: Inode 13, i_size is 2097152, should be 4194304.  Fix?

Fix the problem by truncating extents if the written length is smaller
than expected.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5efccdee4a7d507a483f20f880b809cc4eaef14d; https://git.kernel.org/stable/c/8c30a9a8610c314554997f[PII_REDACTED]6aa35661; https://git.kernel.org/stable/c/a9f331f51515bdb3ebc8d0963131af367ef468f6
CVE: CVE-2024-50016
Published: 2024-10-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-50017
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/mm/ident_map: Use gbpages only where full GB page should be mapped.

When ident_pud_init() uses only GB pages to create identity maps, large
ranges of addresses not actually requested can be included in the resulting
table; a 4K request will map a full GB.  This can include a lot of extra
address space past that requested, including areas marked reserved by the
BIOS.  That allows processor speculation into reserved regions, that on UV
systems can cause system halts.

Only use GB pages when map creation requests include the full GB page of
space.  Fall back to using smaller 2M pages when only portions of a GB page
are included in the request.

No attempt is made to coalesce mapping requests. If a request requires a
map entry at the 2M (pmd) level, subsequent mapping requests within the
same 1G region will also be at the pmd level, even if adjacent or
overlapping such requests could have been combined to map a full GB page.
Existing usage starts with larger regions and then adds smaller regions, so
this should not have any great consequence.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/a23823098ab2c277c14fc110b97d8d5c83597195; https://git.kernel.org/stable/c/cc31744a294584a36bf764a0ffa3255a8e69f036; https://git.kernel.org/stable/c/d113f9723f2bfd9c6feeb899b8ddbee6b8a6e01f
CVE: CVE-2024-50018
Published: 2024-10-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-48946
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

udf: Fix preallocation discarding at indirect extent boundary

When preallocation extent is the first one in the extent block, the
code would corrupt extent tree header instead. Fix the problem and use
udf_delete_aext() for deleting extent to avoid some code duplication.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/12a88f572d6d94b5c0b72e2d1782cc2e96ac06cf; https://git.kernel.org/stable/c/1a075f4a549481ce6e8518d8379f193ccec6b746; https://git.kernel.org/stable/c/4d835efd561dfb9bf5409f11f4ecd428d5d29226
CVE: CVE-2022-48947
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix u8 overflow

By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases
multiple times and eventually it will wrap around the maximum number
(i.e., 255).
This patch prevents this by adding a boundary check with
L2CAP_MAX_CONF_RSP

Btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594
= Note: Bluetooth subsystem version 2.22                               0.264636
@ MGMT Open: btmon (privileged) version 1.22                  {0x0001} 0.272191
= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0)          [hci0] 13.877604
@ RAW Open: 9496 (privileged) version 2.22                   {0x0002} 13.890741
= Open Index: 00:00:00:00:00:00                                [hci0] 13.900426
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033             #32 [hci0] 14.273106
        invalid packet size (12 != 1033)
        08 00 01 00 02 01 04 00 01 10 ff ff              ............
> ACL Data RX: Handle 200 flags 0x00 dlen 1547             #33 [hci0] 14.273561
        invalid packet size (14 != 1547)
        0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....
> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #34 [hci0] 14.274390
        invalid packet size (16 != 2061)
        0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04  ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #35 [hci0] 14.274932
        invalid packet size (16 != 2061)
        0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00  ........@.......
= bluetoothd: Bluetooth daemon 5.43                                   14.401828
> ACL Data RX: Handle 200 flags 0x00 dlen 1033             #36 [hci0] 14.275753
        invalid packet size (12 != 1033)
        08 00 01 00 04 01 04 00 40 00 00 00              ........@...
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://git.kernel.org/stable/c/19a78143961a197de8502f4f29c453b913dc3c29; https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0e; https://git.kernel.org/stable/c/5550bbf709c[PII_REDACTED]37fd290c4bada9e6ead
CVE: CVE-2022-48948
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uvc: Prevent buffer overflow in setup handler

Setup function uvc_function_setup permits control transfer
requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE),
data stage handler for OUT transfer uses memcpy to copy req->actual
bytes to uvc_event->data.data array of size 60. This may result
in an overflow of 4 bytes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/stable/c/06fd17ee92c8f1704c7e54ec0fd50ae0542a49a5; https://git.kernel.org/stable/c/4972e3528b968665b596b5434764ff8fd9446d35; https://git.kernel.org/stable/c/4c92670b[PII_REDACTED]fe4b19ed32013bab2c107
CVE: CVE-2022-48949
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

igb: Initialize mailbox message for VF reset

When a MAC address is not assigned to the VF, that portion of the message
sent to the VF is not set. The memory, however, is allocated from the
stack meaning that information may be leaked to the VM. Initialize the
message buffer to 0 so that no information is passed to the VM in this
case.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/367e1e3399dbc56fc669740c4ab60e35da632b0e; https://git.kernel.org/stable/c/51fd5ede7ed42f272682a0c33d6f0767b3484a3d; https://git.kernel.org/stable/c/a6629659af3f5c6a91e3914ea62554c975ab77f4
CVE: CVE-2022-48950
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

perf: Fix perf_pending_task() UaF

Per syzbot it is possible for perf_pending_task() to run after the
event is free()'d. There are two related but distinct cases:

 - the task_work was already queued before destroying the event;
 - destroying the event itself queues the task_work.

The first cannot be solved using task_work_cancel() since
perf_release() itself might be called from a task_work (____fput),
which means the current->task_works list is already empty and
task_work_cancel() won't be able to find the perf_pending_task()
entry.

The simplest alternative is extending the perf_event lifetime to cover
the task_work.

The second is just silly, queueing a task_work while you know the
event is going away makes no sense and is easily avoided by
re-arranging how the event is marked STATE_DEAD and ensuring it goes
through STATE_OFF on the way down.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/517e6a301f34613bff24a8e35b5455884f2d83d8; https://git.kernel.org/stable/c/78e1317a174edbfd1182599bf76c092a2877672c; https://git.kernel.org/stable/c/8bffa95ac19ff27c8261904f89d36c7fcf215d59
CVE: CVE-2022-48951
Published: 2024-10-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()

The bounds checks in snd_soc_put_volsw_sx() are only being applied to the
first channel, meaning it is possible to write out of bounds values to the
second channel in stereo controls. Add appropriate checks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/1798b62d642e7b3d4ea3403914c3caf4e438465d; https://git.kernel.org/stable/c/18a168d85eadcfd45f015b5ecd2a97801b959e43; https://git.kernel.org/stable/c/50b5f6d4d9d2d69a7498c44fd8b26e13d73d3d98