deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-45303
Published: 2024-09-12
Description: Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue is patched in version 0.5 of the Discourse Calendar plugin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/discourse/discourse-calendar/commit/81e1c8e3c4c02276fb890da7e3f684259aeb685c; https://github.com/discourse/discourse-calendar/security/advisories/GHSA-rq37-8pf3-4xc8
CVE: CVE-2024-45383
Published: 2024-09-12
Description: A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild[PII_REDACTED]). A specially crafted application can issue multiple IRP Complete requests which leads to a local denial-of-service. An attacker can execute malicious script/application to trigger this vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-664
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2008; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2008
CVE: CVE-2024-4472
Published: 2024-09-12
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, where dependency proxy credentials are retained in graphql Logs.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://gitlab.com/gitlab-org/gitlab/-/issues/460289; https://hackerone.com/reports/2477062; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-6678
Published: 2024-09-12
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-290, CWE-290
References: https://gitlab.com/gitlab-org/gitlab/-/issues/471923; https://hackerone.com/reports/2595495; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-8311
Published: 2024-09-12
Description: An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-424
References: https://gitlab.com/gitlab-org/gitlab/-/issues/479315; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-8641
Published: 2024-09-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim's CI_JOB_TOKEN to obtain a GitLab session token belonging to the victim.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-270
References: https://gitlab.com/gitlab-org/gitlab/-/issues/471954; https://hackerone.com/reports/2595495; https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
CVE: CVE-2024-20430
Published: 2024-09-12
Description: A vulnerability in Cisco Meraki Systems Manager (SM) Agent for Windows could allow an authenticated, local attacker to execute arbitrary code with elevated privileges.&nbsp;

This vulnerability is due to incorrect handling of directory search paths at runtime. A low-privileged attacker could exploit this vulnerability by placing both malicious configuration files and malicious DLL files on an affected system, which would read and execute the files when Cisco Meraki SM launches on startup. A successful exploit could allow the attacker to execute arbitrary code on the affected system with SYSTEM privileges.&nbsp;
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-agent-dll-hj-Ptn7PtKe
CVE: CVE-2024-44459
Published: 2024-09-12
Description: A memory allocation issue in vernemq v2.0.1 allows attackers to cause a Denial of Service (DoS) via excessive memory consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/zzh-newlearner/MQTT_Crash/blob/main/Vernemq_crash.md
CVE: CVE-2024-44460
Published: 2024-09-12
Description: An invalid read size in Nanomq v0.21.9 allows attackers to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/zzh-newlearner/MQTT_Crash/blob/main/Nanomq_invalid_read.md
CVE: CVE-2024-45607
Published: 2024-09-12
Description: whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-347
References: https://github.com/Secreto31126/whatsapp-api-js/commit/56620c[PII_REDACTED]6a94d176082fbd8393a95b6d; https://github.com/Secreto31126/whatsapp-api-js/pull/371; https://github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23
CVE: CVE-2024-6077
Published: 2024-09-12
Description: A denial-of-service vulnerability exists in the Rockwell Automation affected products when specially crafted packets are sent to the CIP Security Object. If exploited the device will become unavailable and require a factory reset to recover.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1963.html
CVE: CVE-2024-8533
Published: 2024-09-12
Description: A privilege escalation vulnerability exists in the Rockwell Automation affected products. The vulnerability occurs due to improper default file permissions allowing users to exfiltrate credentials and escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-276
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1964.html
CVE: CVE-2024-7960
Published: 2024-09-12
Description: The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive information and change settings. The vulnerability exists due to having an incorrect privilege matrix that allows users to have access to functions they should not.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1695.html
CVE: CVE-2024-7961
Published: 2024-09-12
Description: A path traversal vulnerability exists in the Rockwell Automation affected product.  If exploited, the threat actor could upload arbitrary files to the server that could result in a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1695.html
CVE: CVE-2024-8751
Published: 2024-09-12
Description: A vulnerability in the MSC800 allows an unauthenticated attacker to modify the product’s IP
address over Sopas ET. 
This can lead to Denial of Service. 
Users are recommended to upgrade both
MSC800 and MSC800 LFT to version V4.26 and S2.93.20 respectively which fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF; https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
CVE: CVE-2024-8762
Published: 2024-09-13
Description: A vulnerability was found in code-projects Crud Operation System 1.0. It has been classified as critical. This affects an unknown part of the file /updatedata.php. The manipulation of the argument sid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/Kangsiyuan/1/issues/1; https://vuldb.com/?ctiid.277341
CVE: CVE-2024-43180
Published: 2024-09-13
Description: IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-614, CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/351213; https://www.ibm.com/support/pages/node/7168234
CVE: CVE-2024-8656
Published: 2024-09-13
Description: The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpcodefactory-helper/tags/1.7.0/includes/class-alg-wpcodefactory-helper-site-key-manager.php#L350; https://plugins.trac.wordpress.org/changeset/3150715/wpcodefactory-helper/tags/1.7.1/includes/class-alg-wpcodefactory-helper-site-key-manager.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/cb62eefe-9993-43f7-b3ae-de47c0951bee?source=cve
CVE: CVE-2024-38816
Published: 2024-09-13
Description: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Specifically, an application is vulnerable when both of the following are true:

  *  the web application uses RouterFunctions to serve static resources
  *  resource handling is explicitly configured with a FileSystemResource location


However, malicious requests are blocked and rejected when any of the following is true:

  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use
  *  the application runs on Tomcat or Jetty
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://spring.io/security/cve-2024-38816; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-46673
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: aacraid: Fix double-free on probe failure

aac_probe_one() calls hardware-specific init functions through the
aac_driver_ident::init pointer, all of which eventually call down to
aac_init_adapter().

If aac_init_adapter() fails after allocating memory for aac_dev::queues,
it frees the memory but does not clear that member.

After the hardware-specific init function returns an error,
aac_probe_one() goes down an error path that frees the memory pointed to
by aac_dev::queues, resulting.in a double-free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/4b540ec7c0045c2d01c4e479f34bbc8f147afa4c; https://git.kernel.org/stable/c/564e1986b00c5f05d75342f8407f75f0a17b94df; https://git.kernel.org/stable/c/60962c3d8e18e5d8dfa16df788974dd7f35bd87a
CVE: CVE-2024-46674
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: st: fix probed platform device ref count on probe error path

The probe function never performs any paltform device allocation, thus
error path "undo_platform_dev_alloc" is entirely bogus.  It drops the
reference count from the platform device being probed.  If error path is
triggered, this will lead to unbalanced device reference counts and
premature release of device resources, thus possible use-after-free when
releasing remaining devm-managed resources.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/060f41243ad7f6f5249fa7290dda0c01f723d12d; https://git.kernel.org/stable/c/1de989668708ce5875efc9d669d227212aeb9a90; https://git.kernel.org/stable/c/4c[PII_REDACTED]f3c82a5033d35be76a5c42e0fb18
CVE: CVE-2024-46675
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: core: Prevent USB core invalid event buffer address access

This commit addresses an issue where the USB core could access an
invalid event buffer address during runtime suspend, potentially causing
SMMU faults and other memory issues in Exynos platforms. The problem
arises from the following sequence.
        1. In dwc3_gadget_suspend, there is a chance of a timeout when
        moving the USB core to the halt state after clearing the
        run/stop bit by software.
        2. In dwc3_core_exit, the event buffer is cleared regardless of
        the USB core's status, which may lead to an SMMU faults and
        other memory issues. if the USB core tries to access the event
        buffer address.

To prevent this hardware quirk on Exynos platforms, this commit ensures
that the event buffer address is not cleared by software  when the USB
core is active during runtime suspend by checking its status before
clearing the buffer address.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/111277b881def3153335acfe0d1f43e6cd83ac93; https://git.kernel.org/stable/c/14e497183df28c006603cc67fd3797a537eef7b9; https://git.kernel.org/stable/c/2189fd13c577d7881f94affc09c950a795064c4b
CVE: CVE-2024-46676
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: Add poll mod list filling check

In case of im_protocols value is 1 and tm_protocols value is 0 this
combination successfully passes the check
'if (!im_protocols && !tm_protocols)' in the nfc_start_poll().
But then after pn533_poll_create_mod_list() call in pn533_start_poll()
poll mod list will remain empty and dev->poll_mod_count will remain 0
which lead to division by zero.

Normally no im protocol has value 1 in the mask, so this combination is
not expected by driver. But these protocol values actually come from
userspace via Netlink interface (NFC_CMD_START_POLL operation). So a
broken or malicious program may pass a message containing a "bad"
combination of protocol parameter values so that dev->poll_mod_count
is not incremented inside pn533_poll_create_mod_list(), thus leading
to division by zero.
Call trace looks like:
nfc_genl_start_poll()
  nfc_start_poll()
    ->start_poll()
    pn533_start_poll()

Add poll mod list filling check.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/stable/c/56ad559cf6d87f250a8d203b555dfc3716afa946; https://git.kernel.org/stable/c/64513d0e546a1f19e390f7e5eba3872bfcbdacf5; https://git.kernel.org/stable/c/7535db0624a2dede374c42040808ad9a9101d723
CVE: CVE-2024-46677
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

gtp: fix a potential NULL pointer dereference

When sockfd_lookup() fails, gtp_encap_enable_socket() returns a
NULL pointer, but its callers only check for error pointers thus miss
the NULL pointer case.

Fix it by returning an error pointer with the error code carried from
sockfd_lookup().

(I found this bug during code inspection.)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/28c67f0f84f889fe9f4cbda8354132b20dc9212d; https://git.kernel.org/stable/c/4643b91691e969b1b9ad54bf552d7a990cfa3b87; https://git.kernel.org/stable/c/612edd35f2a3910ab1f61c1f2338889d4ba99fa2
CVE: CVE-2024-46678
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

bonding: change ipsec_lock from spin lock to mutex

In the cited commit, bond->ipsec_lock is added to protect ipsec_list,
hence xdo_dev_state_add and xdo_dev_state_delete are called inside
this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep,
"scheduling while atomic" will be triggered when changing bond's
active slave.

[  101.055189] BUG: scheduling while atomic: bash/902/0x00000200
[  101.055726] Modules linked in:
[  101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1
[  101.058760] Hardware name:
[  101.059434] Call Trace:
[  101.059436]  <TASK>
[  101.060873]  dump_stack_lvl+0x51/0x60
[  101.061275]  __schedule_bug+0x4e/0x60
[  101.061682]  __schedule+0x612/0x7c0
[  101.062078]  ? __mod_timer+0x25c/0x370
[  101.062486]  schedule+0x25/0xd0
[  101.062845]  schedule_timeout+0x77/0xf0
[  101.063265]  ? asm_common_interrupt+0x22/0x40
[  101.063724]  ? __bpf_trace_itimer_state+0x10/0x10
[  101.064215]  __wait_for_common+0x87/0x190
[  101.064648]  ? usleep_range_state+0x90/0x90
[  101.065091]  cmd_exec+0x437/0xb20 [mlx5_core]
[  101.065569]  mlx5_cmd_do+0x1e/0x40 [mlx5_core]
[  101.066051]  mlx5_cmd_exec+0x18/0x30 [mlx5_core]
[  101.066552]  mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core]
[  101.067163]  ? bonding_sysfs_store_option+0x4d/0x80 [bonding]
[  101.067738]  ? kmalloc_trace+0x4d/0x350
[  101.068156]  mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core]
[  101.068747]  mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core]
[  101.069312]  bond_change_active_slave+0x392/0x900 [bonding]
[  101.069868]  bond_option_active_slave_set+0x1c2/0x240 [bonding]
[  101.070454]  __bond_opt_set+0xa6/0x430 [bonding]
[  101.070935]  __bond_opt_set_notify+0x2f/0x90 [bonding]
[  101.071453]  bond_opt_tryset_rtnl+0x72/0xb0 [bonding]
[  101.071965]  bonding_sysfs_store_option+0x4d/0x80 [bonding]
[  101.072567]  kernfs_fop_write_iter+0x10c/0x1a0
[  101.073033]  vfs_write+0x2d8/0x400
[  101.073416]  ? alloc_fd+0x48/0x180
[  101.073798]  ksys_write+0x5f/0xe0
[  101.074175]  do_syscall_64+0x52/0x110
[  101.074576]  entry_SYSCALL_64_after_hwframe+0x4b/0x53

As bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called
from bond_change_active_slave, which requires holding the RTNL lock.
And bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state
xdo_dev_state_add and xdo_dev_state_delete APIs, which are in user
context. So ipsec_lock doesn't have to be spin lock, change it to
mutex, and thus the above issue can be resolved.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f; https://git.kernel.org/stable/c/56354b0a2c24a7828eeed7de4b4dc9652d9affa3; https://git.kernel.org/stable/c/6b598069164ac1bb60996d6ff94e7f9169dbd2d3
CVE: CVE-2024-46679
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

ethtool: check device is present when getting link settings

A sysfs reader can race with a device reset or removal, attempting to
read device state when the device is not actually present. eg:

     [exception RIP: qed_get_current_link+17]
  #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede]
  #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3
 #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4
 #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300
 #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c
 #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b
 #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3
 #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1
 #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f
 #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb

 crash> struct net_device.state ffff9a9d21336000
    state = 5,

state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100).
The device is not present, note lack of __LINK_STATE_PRESENT (0b10).

This is the same sort of panic as observed in commit 4224cfd7fb65
("net-sysfs: add check for netdevice being present to speed_show").

There are many other callers of __ethtool_get_link_ksettings() which
don't have a device presence check.

Move this check into ethtool to protect all callers.
CVSS Score: 4.7 (MEDIUM)
References: https://git.kernel.org/stable/c/1d6d9b5b1b95bfeccb84386a51b7e6c510ec13b2; https://git.kernel.org/stable/c/7a8d98b6d6484d3ad[PII_REDACTED]22da080c37cbc; https://git.kernel.org/stable/c/842a40c7273ba1c1cb30dda50405b328de1d860e
CVE: CVE-2024-46681
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

pktgen: use cpus_read_lock() in pg_net_init()

I have seen the WARN_ON(smp_processor_id() != cpu) firing
in pktgen_thread_worker() during tests.

We must use cpus_read_lock()/cpus_read_unlock()
around the for_each_online_cpu(cpu) loop.

While we are at it use WARN_ON_ONCE() to avoid a possible syslog flood.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5f5f7366dda8ae870e8305d6e7b3c0c2686cd2cf; https://git.kernel.org/stable/c/979b581e4c69257acab1af415ddad6b2d78a2fa5
CVE: CVE-2024-46682
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open

Prior to commit 3f29cc82a84c ("nfsd: split sc_status out of
sc_type") states_show() relied on sc_type field to be of valid
type before calling into a subfunction to show content of a
particular stateid. From that commit, we split the validity of
the stateid into sc_status and no longer changed sc_type to 0
while unhashing the stateid. This resulted in kernel oopsing
for nfsv4.0 opens that stay around and in nfs4_show_open()
would derefence sc_file which was NULL.

Instead, for closed open stateids forgo displaying information
that relies of having a valid sc_file.

To reproduce: mount the server with 4.0, read and close
a file and then on the server cat /proc/fs/nfsd/clients/2/states

[  513.590804] Call trace:
[  513.590925]  _raw_spin_lock+0xcc/0x160
[  513.591119]  nfs4_show_open+0x78/0x2c0 [nfsd]
[  513.591412]  states_show+0x44c/0x488 [nfsd]
[  513.591681]  seq_read_iter+0x5d8/0x760
[  513.591896]  seq_read+0x188/0x208
[  513.592075]  vfs_read+0x148/0x470
[  513.592241]  ksys_read+0xcc/0x178
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/a204501e1743d695ca2930ed25a2be9f8ced96d3; https://git.kernel.org/stable/c/ba0b697de298285301c71c258598226e06494236
CVE: CVE-2024-46683
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe: prevent UAF around preempt fence

The fence lock is part of the queue, therefore in the current design
anything locking the fence should then also hold a ref to the queue to
prevent the queue from being freed.

However, currently it looks like we signal the fence and then drop the
queue ref, but if something is waiting on the fence, the waiter is
kicked to wake up at some later point, where upon waking up it first
grabs the lock before checking the fence state. But if we have already
dropped the queue ref, then the lock might already be freed as part of
the queue, leading to uaf.

To prevent this, move the fence lock into the fence itself so we don't
run into lifetime issues. Alternative might be to have device level
lock, or only release the queue in the fence release callback, however
that might require pushing to another worker to avoid locking issues.

References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454
References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342
References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020
(cherry picked from commit 7116c35aacedc38be6d15bd21b2fc936eed0008b)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/10081b0b0ed201f53e24bd92deb2e0f3c3e713d4; https://git.kernel.org/stable/c/730b72480e29f63fd644f5fa57c9d[PII_REDACTED]3