deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43009
Published: 2024-08-16
Description: A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTP_REFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted URL, which includes a malicious Referer header. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially resulting in session hijacking, defacement, or other malicious activities.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: http://www.zzcms.net/about/download.html; https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43009%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS.md
CVE: CVE-2024-43011
Published: 2024-08-16
Description: An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization of user input for file paths, an attacker can exploit this vulnerability by using directory traversal techniques to delete arbitrary files on the server. This can lead to the deletion of critical files, potentially disrupting the normal operation of the system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://www.zzcms.net/about/download.html; https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43011%20ZZCMS2023%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E6%BC%8F%E6%B4%9E.md
CVE: CVE-2024-43042
Published: 2024-08-16
Description: Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://drive.google.com/file/d/1FnLCFP8xDrE1e_4Ft_TZ7VhC-JBkpsL0/view?usp=sharing; https://github.com/pluck-cms/pluck
CVE: CVE-2024-43472
Published: 2024-08-16
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43472
CVE: CVE-2024-43395
Published: 2024-08-16
Description: CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as SDL for drawing. Prior to version 2.8.3, users of CraftOS-PC 2 on Windows can escape the computer folder and access files anywhere without permission or notice by obfuscating `..`s to bypass the internal check preventing parent directory traversal. Version 2.8.3 contains a patch for this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22
References: https://github.com/MCJack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3; https://github.com/MCJack123/craftos2/security/advisories/GHSA-hr3w-wc83-6923
CVE: CVE-2024-7886
Published: 2024-08-16
Description: A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerability is an unknown functionality in the library 7zxa.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The real existence of this vulnerability is still doubted at the moment. The vendor explains that a system must be breached before exploiting this issue. They are not planning on making any changes to address it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-427
References: https://vuldb.com/?ctiid.274873; https://vuldb.com/?id.274873; https://vuldb.com/?submit.383468
CVE: CVE-2024-6500
Published: 2024-08-17
Description: The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'parse_request' function in all versions up to, and including, 1.4.0 (for InPost for WooCommerce) as well as 1.4.4 (for InPost PL). This makes it possible for unauthenticated attackers to read and delete arbitrary files on Windows servers. On Linux servers, only files within the WordPress install will be deleted, but all files can be read.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/inpost-for-woocommerce/trunk/src/InspireLabs/WoocommerceInpost/EasyPack_Helper.php#L267; https://plugins.trac.wordpress.org/browser/inpost-for-woocommerce/trunk/src/InspireLabs/WoocommerceInpost/EasyPack_Helper.php#L75; https://plugins.trac.wordpress.org/browser/woo-inpost/trunk/classes/class-helper.php#L140
CVE: CVE-2024-6459
Published: 2024-08-17
Description: The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/330359fa-d085-4923-b5a8-c0e2e5267247/
CVE: CVE-2022-1751
Published: 2024-08-17
Description: The Skitter Slideshow plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the /image.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/wp-skitter-slideshow/trunk/image.php; https://securityforeveryone.com/blog/wordpress-skitter-slideshow-ssrf-0-day-vulnerability-cve-2022-1751; https://www.wordfence.com/threat-intel/vulnerabilities/id/175eba7e-454b-4ba3-bbb5-22bd56734f5c?source=cve
CVE: CVE-2022-4532
Published: 2024-08-17
Description: The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-348
References: https://plugins.trac.wordpress.org/browser/login-attempts-limit-wp/trunk/includes/Ip.php#L41; https://www.wordfence.com/threat-intel/vulnerabilities/id/50421e90-ccd6-4896-8041-b[PII_REDACTED]1?source=cve
CVE: CVE-2023-1604
Published: 2024-08-17
Description: The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect nonce validation on the configuration_page function. This makes it possible for unauthenticated attackers to add and import redirects, including comments containing cross-site scripting as detailed in CVE-2023-1602, granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/shorten-url/trunk/shorten-url.php#L322; https://www.wordfence.com/threat-intel/vulnerabilities/id/b926243c-ed12-4afe-ac72-932d4d871019?source=cve
CVE: CVE-2023-4024
Published: 2024-08-17
Description: The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to delete player instances.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.svn.wordpress.org/radio-player/tags/2.0.7/readme.txt; https://plugins.trac.wordpress.org/changeset/2942906/radio-player/trunk/includes/class-ajax.php; https://plugins.trac.wordpress.org/changeset/3048105
CVE: CVE-2023-4025
Published: 2024-08-17
Description: The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.svn.wordpress.org/radio-player/tags/2.0.7/readme.txt; https://plugins.trac.wordpress.org/changeset/2942906/radio-player/trunk/includes/class-ajax.php; https://plugins.trac.wordpress.org/changeset/3048105
CVE: CVE-2023-4027
Published: 2024-08-17
Description: The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_settings function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update plugin settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.svn.wordpress.org/radio-player/tags/2.0.7/readme.txt; https://plugins.trac.wordpress.org/changeset/2942906/radio-player/trunk/includes/class-ajax.php; https://plugins.trac.wordpress.org/changeset/3050056/radio-player/tags/2.0.74/includes/class-ajax.php?old=2986565&old_path=radio-player%2Ftags%2F2.0.73%2Fincludes%2Fclass-ajax.php
CVE: CVE-2023-4507
Published: 2024-08-17
Description: The Admission AppManager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/admission-appmanager/trunk/admin/class-admission-app-manager-admin.php#L843; https://www.wordfence.com/threat-intel/vulnerabilities/id/55367b9b-8ae1-4282-bf9f-8fb3848eb579?source=cve
CVE: CVE-2023-4604
Published: 2024-08-17
Description: The Slideshow, Image Slider by 2J plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘post’ parameter in versions up to, and including, 1.3.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/2j-slideshow/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/d3a9a1f1-566f-478e-a0b7-857c12f21ff7?source=cve
CVE: CVE-2023-4730
Published: 2024-08-17
Description: The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to modify a variety of settings. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L153; https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L175; https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L187
CVE: CVE-2023-3408
Published: 2024-08-17
Description: The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'save_settings' function. This makes it possible for unauthenticated attackers to modify the theme's settings, including enabling a setting which allows lower-privileged users such as contributors to perform code execution, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://bricksbuilder.io/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d58fd503-84d0-4d62-9290-870b1dd32be7?source=cve
CVE: CVE-2023-3409
Published: 2024-08-17
Description: The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'reset_settings' function. This makes it possible for unauthenticated attackers to reset the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://bricksbuilder.io/; https://www.wordfence.com/threat-intel/vulnerabilities/id/16800ece-da9c-431b-a015-42bd30b646e2?source=cve
CVE: CVE-2023-5505
Published: 2024-08-17
Description: The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://plugins.trac.wordpress.org/browser/backwpup/trunk/inc/class-page-editjob.php?rev=2818974#L29; https://plugins.trac.wordpress.org/changeset/3000176/backwpup/trunk/inc/class-destination-folder.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2980789%40backwpup%2Ftrunk&old=2954541%40backwpup%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-42260
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Validate passed in drm syncobj handles in the performance extension

If userspace provides an unknown or invalid handle anywhere in the handle
array the rest of the driver will not handle that well.

Fix it by checking handle was looked up successfully or otherwise fail the
extension by jumping into the existing unwind.

(cherry picked from commit a546b7e4d73c23838d7e4d2c92882b3ca902d213)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4ecc24a84d7e0254efd150ec23e0b[PII_REDACTED]6; https://git.kernel.org/stable/c/5d4aa25f47cd05e9eeac[PII_REDACTED]28588605dd
CVE: CVE-2024-42261
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Validate passed in drm syncobj handles in the timestamp extension

If userspace provides an unknown or invalid handle anywhere in the handle
array the rest of the driver will not handle that well.

Fix it by checking handle was looked up successfully or otherwise fail the
extension by jumping into the existing unwind.

(cherry picked from commit 8d1276d1b8f738c3afe1457d4dff5cc66fc848a3)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/023d22e8bb0cdd6900382ad1ed06df3b6c2ea791; https://git.kernel.org/stable/c/5c56f104edd02a537e9327dc543574e55713e1d7
CVE: CVE-2024-42262
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Fix potential memory leak in the performance extension

If fetching of userspace memory fails during the main loop, all drm sync
objs looked up until that point will be leaked because of the missing
drm_syncobj_put.

Fix it by exporting and using a common cleanup helper.

(cherry picked from commit 484de39fa5f5b7bd0c5f2e2c[PII_REDACTED]ef7501)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/32df4abc44f24dbec239d43e2b26d5768c5d1a78; https://git.kernel.org/stable/c/ad5fdc48f7a63b8a98493c667505fe4d3864ae21
CVE: CVE-2024-42263
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Fix potential memory leak in the timestamp extension

If fetching of userspace memory fails during the main loop, all drm sync
objs looked up until that point will be leaked because of the missing
drm_syncobj_put.

Fix it by exporting and using a common cleanup helper.

(cherry picked from commit 753ce4fea62182c77e1691ab4f9022008f25b62e)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0e50fcc20bd[PII_REDACTED]6e8004f9064a8985b4f; https://git.kernel.org/stable/c/9b5033ee2c5af6d1135a403df32d219ab57e55f9
CVE: CVE-2024-42264
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Prevent out of bounds access in performance query extensions

Check that the number of perfmons userspace is passing in the copy and
reset extensions is not greater than the internal kernel storage where
the ids will be copied into.

(cherry picked from commit f32b5128d2c440368b5bf3a7a356823e235caabb)
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/6ce9efd12ae81cf46bf44eb[PII_REDACTED]dfbb9d2; https://git.kernel.org/stable/c/73ad583bd4938bf37d2709fc36901eb6f22f2722
CVE: CVE-2024-42265
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

protect the fetch of ->fd[fd] in do_dup2() from mispredictions

both callers have verified that fd is not greater than ->max_fds;
however, misprediction might end up with
        tofree = fdt->fd[fd];
being speculatively executed.  That's wrong for the same reasons
why it's wrong in close_fd()/file_close_fd_locked(); the same
solution applies - array_index_nospec(fd, fdt->max_fds) could differ
from fd only in case of speculative execution on mispredicted path.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/08775b3d6ed117cf4518754ec7300ee42b6a5368; https://git.kernel.org/stable/c/1171ceccabfd596ca370c5d2cbb47d110c3f2fe1; https://git.kernel.org/stable/c/3f480493550b6a23d3a65d095d6569d4a7f56a0f
CVE: CVE-2024-42267
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()

Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly
kill the process and we don't BUG() the kernel.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0c710050c47d45eb77b28c271cddefc5c785cb40; https://git.kernel.org/stable/c/20dbdebc5580cd472a310d56a6e252275ee4c864; https://git.kernel.org/stable/c/59be4a167782d68e21068a761b90b01fadc09146
CVE: CVE-2024-42268
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix missing lock on sync reset reload

On sync reset reload work, when remote host updates devlink on reload
actions performed on that host, it misses taking devlink lock before
calling devlink_remote_reload_actions_performed() which results in
triggering lock assert like the following:

WARNING: CPU: 4 PID: 1164 at net/devlink/core.c:261 devl_assert_locked+0x3e/0x50
…
 CPU: 4 PID: 1164 Comm: kworker/u96:6 Tainted: G S      W          6.10.0-rc2+ #116
 Hardware name: Supermicro SYS-2028TP-DECTR/X10DRT-PT, BIOS 2.0 12/18/2015
 Workqueue: mlx5_fw_reset_events mlx5_sync_reset_reload_work [mlx5_core]
 RIP: 0010:devl_assert_locked+0x3e/0x50
…
 Call Trace:
  <TASK>
  ? __warn+0xa4/0x210
  ? devl_assert_locked+0x3e/0x50
  ? report_bug+0x160/0x280
  ? handle_bug+0x3f/0x80
  ? exc_invalid_op+0x17/0x40
  ? asm_exc_invalid_op+0x1a/0x20
  ? devl_assert_locked+0x3e/0x50
  devlink_notify+0x88/0x2b0
  ? mlx5_attach_device+0x20c/0x230 [mlx5_core]
  ? __pfx_devlink_notify+0x10/0x10
  ? process_one_work+0x4b6/0xbb0
  process_one_work+0x4b6/0xbb0
[…]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/091268f3c27a5b6d7858a3bb2a0dbcc9cd26ddb5; https://git.kernel.org/stable/c/572f9caa9e7295f8c8822e4122c7ae8f1c412ff9; https://git.kernel.org/stable/c/5d07d1d40aabfd61bab21115639bd4f641db6002
CVE: CVE-2024-42269
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().

ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id],
but the function is exposed to user space before the entry is allocated
via register_pernet_subsys().

Let's call register_pernet_subsys() before xt_register_template().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/419ee6274c5153b89c4393c1946faa4c3cad4f9e; https://git.kernel.org/stable/c/87dba44e9471b79b255d0736858a897332db9226; https://git.kernel.org/stable/c/91b6df6611b7edb28676c4f63f90c56c30d3e601
CVE: CVE-2024-42271
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

net/iucv: fix use after free in iucv_sock_close()

iucv_sever_path() is called from process context and from bh context.
iucv->path is used as indicator whether somebody else is taking care of
severing the path (or it is already removed / never existed).
This needs to be done with atomic compare and swap, otherwise there is a
small window where iucv_sock_close() will try to work with a path that has
already been severed and freed by iucv_callback_connrej() called by
iucv_tasklet_fn().

Example:
[[PII_REDACTED]44] Call Trace:
[[PII_REDACTED]45] ([<0000001e87f03880>] 0x1e87f03880)
[[PII_REDACTED]66]  [<00000000d593001e>] iucv_path_sever+0x96/0x138
[[PII_REDACTED]30]  [<000003ff801ddbca>] iucv_sever_path+0xc2/0xd0 [af_iucv]
[[PII_REDACTED]36]  [<000003ff801e01b6>] iucv_sock_close+0xa6/0x310 [af_iucv]
[[PII_REDACTED]41]  [<000003ff801e08cc>] iucv_sock_release+0x3c/0xd0 [af_iucv]
[[PII_REDACTED]45]  [<00000000d574794e>] __sock_release+0x5e/0xe8
[[PII_REDACTED]15]  [<00000000d5747a0c>] sock_close+0x34/0x48
[[PII_REDACTED]20]  [<00000000d5421642>] __fput+0xba/0x268
[[PII_REDACTED]26]  [<00000000d51b382c>] task_work_run+0xbc/0xf0
[[PII_REDACTED]32]  [<00000000d5145710>] do_notify_resume+0x88/0x90
[[PII_REDACTED]41]  [<00000000d5978096>] system_call+0xe2/0x2c8
[[PII_REDACTED]19] Last Breaking-Event-Address:
[[PII_REDACTED]21]  [<00000000d5930018>] iucv_path_sever+0x90/0x138
[[PII_REDACTED]24]
[[PII_REDACTED]25] Kernel panic - not syncing: Fatal exception in interrupt

Note that bh_lock_sock() is not serializing the tasklet context against
process context, because the check for sock_owned_by_user() and
corresponding handling is missing.

Ideas for a future clean-up patch:
A) Correct usage of bh_lock_sock() in tasklet context, as described in
Re-enqueue, if needed. This may require adding return values to the
tasklet functions and thus changes to all users of iucv.

B) Change iucv tasklet into worker and use only lock_sock() in af_iucv.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/01437282fd[PII_REDACTED]f3dc98d2cac6b8b6fc84; https://git.kernel.org/stable/c/37652fbef9809411cea55ea5fa1a170e299efcd0; https://git.kernel.org/stable/c/69620522c48ce8215e5eb55ffbab8cafee8f407d