deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-35821
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ubifs: Set page uptodate in the correct place

Page cache reads are lockless, so setting the freshly allocated page
uptodate before we've overwritten it with the data it's supposed to have
in it will allow a simultaneous reader to see old data.  Move the call
to SetPageUptodate into ubifs_write_end(), which is after we copied the
new data into the page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: https://git.kernel.org/stable/c/142d87c958d9454c3cffa625fab56f3016e8f9f3; https://git.kernel.org/stable/c/17772bbe9cfa972ea1ff827319f6e1340de76566; https://git.kernel.org/stable/c/4aa554832b9dc9e66249df75b8f447d87853e12e
CVE: CVE-2024-35822
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: udc: remove warning when queue disabled ep

It is possible trigger below warning message from mass storage function,

WARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104
pc : usb_ep_queue+0x7c/0x104
lr : fsg_main_thread+0x494/0x1b3c

Root cause is mass storage function try to queue request from main thread,
but other thread may already disable ep when function disable.

As there is no function failure in the driver, in order to avoid effort
to fix warning, change WARN_ON_ONCE() in usb_ep_queue() to pr_debug().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2a587a035214fa1b5ef598aea0b81848c5b72e5e; https://git.kernel.org/stable/c/2b002c308e184feeaeb72987bca3f1b11e5f70b8; https://git.kernel.org/stable/c/30511676eb54d480d014352bf784f02577a10252
CVE: CVE-2024-35823
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

vt: fix unicode buffer corruption when deleting characters

This is the same issue that was fixed for the VGA text buffer in commit
39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the
buffer"). The cure is also the same i.e. replace memcpy() with memmove()
due to the overlaping buffers.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://git.kernel.org/stable/c/0190d19d7651c08abc187dac3819c61b726e7e3f; https://git.kernel.org/stable/c/1581dafaf0d34bc9c428a794a22110d7046d186d; https://git.kernel.org/stable/c/1ce408f75ccf1e25b3fddef75cca878b55f2ac90
CVE: CVE-2024-35824
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume

When not configured for wakeup lis3lv02d_i2c_suspend() will call
lis3lv02d_poweroff() even if the device has already been turned off
by the runtime-suspend handler and if configured for wakeup and
the device is runtime-suspended at this point then it is not turned
back on to serve as a wakeup source.

Before commit b1b9f7a49440 ("misc: lis3lv02d_i2c: Add missing setting
of the reg_ctrl callback"), lis3lv02d_poweroff() failed to disable
the regulators which as a side effect made calling poweroff() twice ok.

Now that poweroff() correctly disables the regulators, doing this twice
triggers a WARN() in the regulator core:

unbalanced disables for regulator-dummy
WARNING: CPU: 1 PID: 92 at drivers/regulator/core.c:2999 _regulator_disable
...

Fix lis3lv02d_i2c_suspend() to not call poweroff() a second time if
already runtime-suspended and add a poweron() call when necessary to
make wakeup work.

lis3lv02d_i2c_resume() has similar issues, with an added weirness that
it always powers on the device if it is runtime suspended, after which
the first runtime-resume will call poweron() again, causing the enabled
count for the regulator to increase by 1 every suspend/resume. These
unbalanced regulator_enable() calls cause the regulator to never
be turned off and trigger the following WARN() on driver unbind:

WARNING: CPU: 1 PID: 1724 at drivers/regulator/core.c:2396 _regulator_put

Fix this by making lis3lv02d_i2c_resume() mirror the new suspend().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4154e767354140db[PII_REDACTED]e7238fb337b0e7; https://git.kernel.org/stable/c/997ca415384612c8df76d99d9a768e0b3f42b325; https://git.kernel.org/stable/c/ac3e0384073b2408d6cb0d972fee9fcc3776053d
CVE: CVE-2024-35825
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: ncm: Fix handling of zero block length packets

While connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX
set to 65536, it has been observed that we receive short packets,
which come at interval of 5-10 seconds sometimes and have block
length zero but still contain 1-2 valid datagrams present.

According to the NCM spec:

"If wBlockLength = 0x0000, the block is terminated by a
short packet. In this case, the USB transfer must still
be shorter than dwNtbInMaxSize or dwNtbOutMaxSize. If
exactly dwNtbInMaxSize or dwNtbOutMaxSize bytes are sent,
and the size is a multiple of wMaxPacketSize for the
given pipe, then no ZLP shall be sent.

wBlockLength= 0x0000 must be used with extreme care, because
of the possibility that the host and device may get out of
sync, and because of test issues.

wBlockLength = 0x0000 allows the sender to reduce latency by
starting to send a very large NTB, and then shortening it when
the sender discovers that there’s not sufficient data to justify
sending a large NTB"

However, there is a potential issue with the current implementation,
as it checks for the occurrence of multiple NTBs in a single
giveback by verifying if the leftover bytes to be processed is zero
or not. If the block length reads zero, we would process the same
NTB infintely because the leftover bytes is never zero and it leads
to a crash. Fix this by bailing out if block length reads zero.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6b2c73111a252263807b[PII_REDACTED]dc33aa4b4c; https://git.kernel.org/stable/c/7664ee8bd80309b90d53488b619764f0a057f2b7; https://git.kernel.org/stable/c/92b051b87658df7649ffcdef522593f21a2b296b
CVE: CVE-2024-35826
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

block: Fix page refcounts for unaligned buffers in __bio_release_pages()

Fix an incorrect number of pages being released for buffers that do not
start at the beginning of a page.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/242006996d15f5ca62e22f8c7de077d9c4a8f367; https://git.kernel.org/stable/c/38b43539d64b2fa020b3b9a752a986769f87f7a6; https://git.kernel.org/stable/c/7d[PII_REDACTED]f71248c55e6206ea1d6fd4537e65
CVE: CVE-2024-35827
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: fix overflow check in io_recvmsg_mshot_prep()

The "controllen" variable is type size_t (unsigned long).  Casting it
to int could lead to an integer underflow.

The check_add_overflow() function considers the type of the destination
which is type int.  If we add two positive values and the result cannot
fit in an integer then that's counted as an overflow.

However, if we cast "controllen" to an int and it turns negative, then
negative values *can* fit into an int type so there is no overflow.

Good: 100 + (unsigned long)-4 = 96  <-- overflow
 Bad: 100 + (int)-4 = 96 <-- no overflow

I deleted the cast of the sizeof() as well.  That's not a bug but the
cast is unnecessary.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://git.kernel.org/stable/c/0c8c74bb59e7d77554016efc34c2d10376985e5e; https://git.kernel.org/stable/c/59a534690ecc3af72c6ab121aeac1237a4adae66; https://git.kernel.org/stable/c/868ec868616438df487b9e2baa5a99f8662cc47c
CVE: CVE-2024-35828
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()

In the for statement of lbs_allocate_cmd_buffer(), if the allocation of
cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to
be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/4d99d267da3415db2124029cb5a6d2d955ca43f9; https://git.kernel.org/stable/c/5f0e4aede01cb01fa633171f0533affd25328c3a; https://git.kernel.org/stable/c/8e243ac649c10922a6b4855170eaefe4c5b3faab
CVE: CVE-2024-35829
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/lima: fix a memleak in lima_heap_alloc

When lima_vm_map_bo fails, the resources need to be deallocated, or
there will be memleaks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/04ae3eb470e52a3c41babe85ff8cee195e4dcbea; https://git.kernel.org/stable/c/4ab14eccf5578af1dd5668a5f2d771df27683cab; https://git.kernel.org/stable/c/746606d37d662c70ae1379fc658ee9c65f06880f
CVE: CVE-2024-35830
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

media: tc358743: register v4l2 async device only after successful setup

Ensure the device has been setup correctly before registering the v4l2
async device, thus allowing userspace to access.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/17c2650de14842c25c569cbb2126c421489a3a24; https://git.kernel.org/stable/c/4f1490a5d7a0472ee5d9f36547bc4ba46be755c7; https://git.kernel.org/stable/c/610f20e5cf35ca9c0992693cae0dd8643ce932e7
CVE: CVE-2024-35831
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring: Fix release of pinned pages when __io_uaddr_map fails

Looking at the error path of __io_uaddr_map, if we fail after pinning
the pages for any reasons, ret will be set to -EINVAL and the error
handler won't properly release the pinned pages.

I didn't manage to trigger it without forcing a failure, but it can
happen in real life when memory is heavily fragmented.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0b6f39c175ba5f0ef72bdb3b9d2a06ad78621d62; https://git.kernel.org/stable/c/4d376d7ad62b6a8e8dfff56b559d9d275e5b9b3a; https://git.kernel.org/stable/c/67d1189d1095d471ed7fa426c7e384a7140a5dd7
CVE: CVE-2024-35832
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

bcachefs: kvfree bch_fs::snapshots in bch2_fs_snapshots_exit

bch_fs::snapshots is allocated by kvzalloc in __snapshot_t_mut.
It should be freed by kvfree not kfree.
Or umount will triger:

[  406.829178 ] BUG: unable to handle page fault for address: ffffe7b487148008
[  406.830676 ] #PF: supervisor read access in kernel mode
[  406.831643 ] #PF: error_code(0x0000) - not-present page
[  406.832487 ] PGD 0 P4D 0
[  406.832898 ] Oops: 0000 [#1] PREEMPT SMP PTI
[  406.833512 ] CPU: 2 PID: 1754 Comm: umount Kdump: loaded Tainted: G           OE      6.7.0-rc7-custom+ #90
[  406.834746 ] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014
[  406.835796 ] RIP: 0010:kfree+0x62/0x140
[  406.836197 ] Code: 80 48 01 d8 0f 82 e9 00 00 00 48 c7 c2 00 00 00 80 48 2b 15 78 9f 1f 01 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 56 9f 1f 01 <48> 8b 50 08 48 89 c7 f6 c2 01 0f 85 b0 00 00 00 66 90 48 8b 07 f6
[  406.837810 ] RSP: 0018:ffffb9d641607e48 EFLAGS: 00010286
[  406.838213 ] RAX: ffffe7b487148000 RBX: ffffb9d645200000 RCX: ffffb9d641607dc4
[  406.838738 ] RDX: 000065bb00000000 RSI: ffffffffc0d88b84 RDI: ffffb9d645200000
[  406.839217 ] RBP: ffff9a4625d00068 R08: [PII_REDACTED] R09: [PII_REDACTED]
[  406.839650 ] R10: [PII_REDACTED] R11:[PII_REDACTED]00001f R12: ffff9a4625d4da80
[  406.840055 ] R13: ffff9a4625d00000 R14: ffffffffc0e2eb20 R15: [PII_REDACTED]
[  406.840451 ] FS:  00007f0a264ffb80(0000) GS:ffff9a4e2d500000(0000) knlGS:[PII_REDACTED]
[  406.840851 ] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[  406.841125 ] CR2: ffffe7b487148008 CR3: 000000018c4d2000 CR4:[PII_REDACTED]0006f0
[  406.841464 ] Call Trace:
[  406.841583 ]  <TASK>
[  406.841682 ]  ? __die+0x1f/0x70
[  406.841828 ]  ? page_fault_oops+0x159/0x470
[  406.842014 ]  ? fixup_exception+0x22/0x310
[  406.842198 ]  ? exc_page_fault+0x1ed/0x200
[  406.842382 ]  ? asm_exc_page_fault+0x22/0x30
[  406.842574 ]  ? bch2_fs_release+0x54/0x280 [bcachefs]
[  406.842842 ]  ? kfree+0x62/0x140
[  406.842988 ]  ? kfree+0x104/0x140
[  406.843138 ]  bch2_fs_release+0x54/0x280 [bcachefs]
[  406.843390 ]  kobject_put+0xb7/0x170
[  406.843552 ]  deactivate_locked_super+0x2f/0xa0
[  406.843756 ]  cleanup_mnt+0xba/0x150
[  406.843917 ]  task_work_run+0x59/0xa0
[  406.844083 ]  exit_to_user_mode_prepare+0x197/0x1a0
[  406.844302 ]  syscall_exit_to_user_mode+0x16/0x40
[  406.844510 ]  do_syscall_64+0x4e/0xf0
[  406.844675 ]  entry_SYSCALL_64_after_hwframe+0x6e/0x76
[  406.844907 ] RIP: 0033:0x7f0a2664e4fb
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-763
References: https://git.kernel.org/stable/c/369acf97d6fd5da620d053d0f1878ffe32eff555; https://git.kernel.org/stable/c/[PII_REDACTED]1119b9a655202e49898edfb9307271; https://git.kernel.org/stable/c/369acf97d6fd5da620d053d0f1878ffe32eff555
CVE: CVE-2024-35833
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA

This dma_alloc_coherent() is undone neither in the remove function, nor in
the error handling path of fsl_qdma_probe().

Switch to the managed version to fix both issues.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/15eb996d7d13cb72a[PII_REDACTED]ada8f0fef2c3; https://git.kernel.org/stable/c/198270de9d8eb3b5d5f030825ea303ef95285d24; https://git.kernel.org/stable/c/1c75fe450b5200c78f4a102a0eb8e15d8f1ccda8
CVE: CVE-2024-35834
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

xsk: recycle buffer in case Rx queue was full

Add missing xsk_buff_free() call when __xsk_rcv_zc() failed to produce
descriptor to XSK Rx queue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/[PII_REDACTED]46c495f41e9572dd9319e787c2eba9; https://git.kernel.org/stable/c/7b4d93d31aade99210d41cd9d4cbd2957c98bc8c; https://git.kernel.org/stable/c/cce[PII_REDACTED]84daf977739e7ff1cd59e84189c
CVE: CVE-2024-35835
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: fix a double-free in arfs_create_groups

When `in` allocated by kvzalloc fails, arfs_create_groups will free
ft->g and return an error. However, arfs_create_table, the only caller of
arfs_create_groups, will hold this error and call to
mlx5e_destroy_flow_table, in which the ft->g will be freed again.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-415
References: https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7; https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b; https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb
CVE: CVE-2024-35836
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

dpll: fix pin dump crash for rebound module

When a kernel module is unbound but the pin resources were not entirely
freed (other kernel module instance of the same PCI device have had kept
the reference to that pin), and kernel module is again bound, the pin
properties would not be updated (the properties are only assigned when
memory for the pin is allocated), prop pointer still points to the
kernel module memory of the kernel module which was deallocated on the
unbind.

If the pin dump is invoked in this state, the result is a kernel crash.
Prevent the crash by storing persistent pin properties in dpll subsystem,
copy the content from the kernel module when pin is allocated, instead of
using memory of the kernel module.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/5050a5b9d8b4d3c6f7e376e07670e437db7ccf9c; https://git.kernel.org/stable/c/830ead5fb0c5855ce4d70ba2ed4a673b5f1e7d9b; https://git.kernel.org/stable/c/5050a5b9d8b4d3c6f7e376e07670e437db7ccf9c
CVE: CVE-2024-35837
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: clear BM pool before initialization

Register value persist after booting the kernel using
kexec which results in kernel panic. Thus clear the
BM pool registers before initialisation to fix the issue.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/83f99138bf3b396f761600ab488054396fb5768f; https://git.kernel.org/stable/c/938729484cfa535e9987ed0f86f29a2ae3a8188b; https://git.kernel.org/stable/c/9f538b415db862e74b8c5d3abbccfc1b2b6caa38
CVE: CVE-2024-35838
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix potential sta-link leak

When a station is allocated, links are added but not
set to valid yet (e.g. during connection to an AP MLD),
we might remove the station without ever marking links
valid, and leak them. Fix that.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/49aaeb8c539b1633b3bd7c2df131ec578aa1eae1; https://git.kernel.org/stable/c/587c[PII_REDACTED]674bbe61a8ff659de279318034; https://git.kernel.org/stable/c/b01a74b3ca6fd51b62c67733ba7c3280fa6c5d26
CVE: CVE-2024-5042
Published: 2024-05-17
Description: A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-250
References: https://access.redhat.com/errata/RHSA-2024:4591; https://access.redhat.com/errata/RHSA-2026:6503; https://access.redhat.com/security/cve/CVE-2024-5042
CVE: CVE-2024-5047
Published: 2024-05-17
Description: A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Affected is an unknown function of the file /student/controller.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264744.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://github.com/I-Schnee-I/cev/blob/main/SourceCodester%20Student%20Management%20System%201.0%20controller.php%20Unrestricted%20Upload.md; https://vuldb.com/?ctiid.264744; https://vuldb.com/?id.264744
CVE: CVE-2024-5048
Published: 2024-05-17
Description: A vulnerability classified as critical was found in code-projects Budget Management 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument edit leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264745 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Budget%20Management%20App/Budget%20Management%20App%20-%20SQL%20Injection%20-%201.md; https://vuldb.com/?ctiid.264745; https://vuldb.com/?id.264745
CVE: CVE-2024-5049
Published: 2024-05-17
Description: A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the file admin/editproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264746 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/polaris0x1/CVE/issues/2; https://vuldb.com/?ctiid.264746; https://vuldb.com/?id.264746
CVE: CVE-2024-5050
Published: 2024-05-17
Description: A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 up to 20240516. This affects an unknown part of the file /?g=log_import_save. The manipulation of the argument reqfile leads to unrestricted upload. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-264747.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/s%40%23NGfP%7B4%5Et(%7C%5Dd9/Wangshen%20SecGata%203600%20Firewall%20log_import_save%20arbitrary%20file%20upload%20vulnerability.pdf; https://vuldb.com/?ctiid.264747; https://vuldb.com/?id.264747
CVE: CVE-2023-52674
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()

Ensure the value passed to scarlett2_mixer_ctl_put() is between 0 and
SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside
scarlett2_mixer_values[].
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/03035872e17897ba89866940bbc9cefca601e572; https://git.kernel.org/stable/c/04f8f053252b86c7583895c962d66747ecdc61b7; https://git.kernel.org/stable/c/ad945ea8d47dd4454c271510bea[PII_REDACTED]7c2
CVE: CVE-2023-52675
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/imc-pmu: Add a null pointer check in update_events_in_group()

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/024352f7928b28f[PII_REDACTED]3329d8c0f4ad032; https://git.kernel.org/stable/c/0a233867a39078ebb0f575e2948593bbff5826b3; https://git.kernel.org/stable/c/1e80aa25d186a7aa212df5acd8c75f55ac8dae34
CVE: CVE-2023-52676
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Guard stack limits against 32bit overflow

This patch promotes the arithmetic around checking stack bounds to be
done in the 64-bit domain, instead of the current 32bit. The arithmetic
implies adding together a 64-bit register with a int offset. The
register was checked to be below 1<<29 when it was variable, but not
when it was fixed. The offset either comes from an instruction (in which
case it is 16 bit), from another register (in which case the caller
checked it to be below 1<<29 [1]), or from the size of an argument to a
kfunc (in which case it can be a u32 [2]). Between the register being
inconsistently checked to be below 1<<29, and the offset being up to an
u32, it appears that we were open to overflowing the `int`s which were
currently used for arithmetic.

[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498
[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760; https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2; https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6
CVE: CVE-2023-52677
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv: Check if the code to patch lies in the exit section

Otherwise we fall through to vmalloc_to_page() which panics since the
address does not lie in the vmalloc region.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1d7a03052846f34d624d0ab41a879adf5e85c85f; https://git.kernel.org/stable/c/420370f3ae3d3b883813fd3051a38805160b2b9f; https://git.kernel.org/stable/c/890cfe5337e0aaf03ece1429db04d23c88da72e7