deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-20850
Published: 2024-04-02
Description: Use of Implicit Intent for Sensitive Communication in Samsung Pay prior to version 5.4.99 allows local attackers to access information of Samsung Pay.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04
CVE: CVE-2024-20851
Published: 2024-04-02
Description: Improper access control vulnerability in Samsung Data Store prior to version 5.3.00.4 allows local attackers to launch arbitrary activity with Samsung Data Store privilege.
CVSS Score: 4.4 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04
CVE: CVE-2024-20852
Published: 2024-04-02
Description: Improper verification of intent by broadcast receiver vulnerability in SmartThings prior to version 1.8.13.22 allows local attackers to access testing configuration.
CVSS Score: 5.9 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04
CVE: CVE-2024-20853
Published: 2024-04-02
Description: Improper verification of intent by broadcast receiver vulnerability in ThemeStore prior to 5.3.05.2 allows local attackers to write arbitrary files to sandbox of ThemeStore.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04
CVE: CVE-2024-20854
Published: 2024-04-02
Description: Improper handling of insufficient privileges vulnerability in Samsung Camera prior to versions 12.1.0.31 in Android 12, 13.1.02.07 in Android 13, and 14.0.01.06 in Android 14 allows local attackers to access image data.
CVSS Score: 5.9 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04
CVE: CVE-2024-3160
Published: 2024-04-02
Description: ** DISPUTED ** A vulnerability, which was classified as problematic, was found in Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008 and HDCVI 1016 up to 20240401. This affects an unknown part of the file /cap.js of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-258933 was assigned to this vulnerability. NOTE: The vendor explains that they do not classify the information shown as sensitive and therefore there is no vulnerability which is about to harm the user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/netsecfish/intelbras_cap_js; https://vuldb.com/?ctiid.258933; https://vuldb.com/?id.258933
CVE: CVE-2024-25187
Published: 2024-04-02
Description: Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sensitive information via getweather.html.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://gist.github.com/wisejayer/d365e93ce09b8a36641165e1d1a0a06c; https://github.com/xiaocheng-keji/71cms/issues/2; https://gist.github.com/wisejayer/d365e93ce09b8a36641165e1d1a0a06c
CVE: CVE-2024-2369
Published: 2024-04-02
Description: The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/252dfc35-4c8c-4304-aa09-73dfe986b10d/; https://wpscan.com/vulnerability/252dfc35-4c8c-4304-aa09-73dfe986b10d/
CVE: CVE-2024-1274
Published: 2024-04-02
Description: The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/91dba45b-9930-4bfb-a7bf-903c46864e9f/; https://wpscan.com/vulnerability/91dba45b-9930-4bfb-a7bf-903c46864e9f/
CVE: CVE-2024-1504
Published: 2024-04-02
Description: The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5.1. This is due to missing or incorrect nonce validation on the secupress_blackhole_ban_ip() function. This makes it possible for unauthenticated attackers to block a user's IP via a forged request granted they can trick the user into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/secupress/tags/2.2.5.1/free/modules/sensitive-data/plugins/blackhole.php#L74; https://plugins.trac.wordpress.org/browser/secupress/trunk/free/modules/sensitive-data/plugins/blackhole.php#L54; https://www.wordfence.com/threat-intel/vulnerabilities/id/4243bd6d-34f6-4d29-a333-4499a2e2d2e1?source=cve
CVE: CVE-2024-2791
Published: 2024-04-02
Description: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3061715/metform/trunk/widgets/file-upload/file-upload.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0dad759d-9b44-47ca-8410-e39f65dc919c?source=cve; https://plugins.trac.wordpress.org/changeset/3061715/metform/trunk/widgets/file-upload/file-upload.php
CVE: CVE-2024-2924
Published: 2024-04-02
Description: The Creative Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.5.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3061567%40creative-addons-for-elementor&new=3061567%40creative-addons-for-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/33581898-067b-445c-8ad0-12ff4778a13c?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3061567%40creative-addons-for-elementor&new=3061567%40creative-addons-for-elementor&sfp_email=&sfph_mail=
CVE: CVE-2023-52630
Published: 2024-04-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52631
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix an NULL dereference bug

The issue here is when this is called from ntfs_load_attr_list().  The
"size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow
on a 64bit systems but on 32bit systems the "+ 1023" can overflow and
the result is zero.  This means that the kmalloc will succeed by
returning the ZERO_SIZE_PTR and then the memcpy() will crash with an
Oops on the next line.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/686820fe141ea0220fc6fdfc7e5694f915cf64b2; https://git.kernel.org/stable/c/ae4acad41b0f93f1c26cc0fc9135bb79d8282d0b; https://git.kernel.org/stable/c/b2dd7b953c25ffd5912dda17e980e7168bebcf6c
CVE: CVE-2023-52632
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix lock dependency warning with srcu

======================================================
WARNING: possible circular locking dependency detected
6.5.0-kfd-yangp #2289 Not tainted
------------------------------------------------------
kworker/0:2/996 is trying to acquire lock:
        (srcu){.+.+}-{0:0}, at: __synchronize_srcu+0x5/0x1a0

but task is already holding lock:
        ((work_completion)(&svms->deferred_list_work)){+.+.}-{0:0}, at:
	process_one_work+0x211/0x560

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #3 ((work_completion)(&svms->deferred_list_work)){+.+.}-{0:0}:
        __flush_work+0x88/0x4f0
        svm_range_list_lock_and_flush_work+0x3d/0x110 [amdgpu]
        svm_range_set_attr+0xd6/0x14c0 [amdgpu]
        kfd_ioctl+0x1d1/0x630 [amdgpu]
        __x64_sys_ioctl+0x88/0xc0

-> #2 (&info->lock#2){+.+.}-{3:3}:
        __mutex_lock+0x99/0xc70
        amdgpu_amdkfd_gpuvm_restore_process_bos+0x54/0x740 [amdgpu]
        restore_process_helper+0x22/0x80 [amdgpu]
        restore_process_worker+0x2d/0xa0 [amdgpu]
        process_one_work+0x29b/0x560
        worker_thread+0x3d/0x3d0

-> #1 ((work_completion)(&(&process->restore_work)->work)){+.+.}-{0:0}:
        __flush_work+0x88/0x4f0
        __cancel_work_timer+0x12c/0x1c0
        kfd_process_notifier_release_internal+0x37/0x1f0 [amdgpu]
        __mmu_notifier_release+0xad/0x240
        exit_mmap+0x6a/0x3a0
        mmput+0x6a/0x120
        do_exit+0x322/0xb90
        do_group_exit+0x37/0xa0
        __x64_sys_exit_group+0x18/0x20
        do_syscall_64+0x38/0x80

-> #0 (srcu){.+.+}-{0:0}:
        __lock_acquire+0x1521/0x2510
        lock_sync+0x5f/0x90
        __synchronize_srcu+0x4f/0x1a0
        __mmu_notifier_release+0x128/0x240
        exit_mmap+0x6a/0x3a0
        mmput+0x6a/0x120
        svm_range_deferred_list_work+0x19f/0x350 [amdgpu]
        process_one_work+0x29b/0x560
        worker_thread+0x3d/0x3d0

other info that might help us debug this:
Chain exists of:
  srcu --> &info->lock#2 --> (work_completion)(&svms->deferred_list_work)

Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
        lock((work_completion)(&svms->deferred_list_work));
                        lock(&info->lock#2);
			lock((work_completion)(&svms->deferred_list_work));
        sync(srcu);
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/1556c242e64cdffe58736aa650b0b395854fe4d4; https://git.kernel.org/stable/c/2a9de42e8d3c82c6990d226198602be44f43f340; https://git.kernel.org/stable/c/752312f6a79440086ac0f9b08d[PII_REDACTED]323c
CVE: CVE-2023-52633
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

um: time-travel: fix time corruption

In 'basic' time-travel mode (without =inf-cpu or =ext), we
still get timer interrupts. These can happen at arbitrary
points in time, i.e. while in timer_read(), which pushes
time forward just a little bit. Then, if we happen to get
the interrupt after calculating the new time to push to,
but before actually finishing that, the interrupt will set
the time to a value that's incompatible with the forward,
and we'll crash because time goes backwards when we do the
forwarding.

Fix this by reading the time_travel_time, calculating the
adjustment, and doing the adjustment all with interrupts
disabled.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/0c7478a2da3f5fe106b[PII_REDACTED]d50c86ac7ab; https://git.kernel.org/stable/c/4f7dad73df4cdb2b7042103d3922745d040ad025; https://git.kernel.org/stable/c/abe4eaa8618bb36c2b33e9cdde0499296a23448c
CVE: CVE-2023-52634
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix disable_otg_wa logic

[Why]
When switching to another HDMI mode, we are unnecesarilly
disabling/enabling FIFO causing both HPO and DIG registers to be set at
the same time when only HPO is supposed to be set.

This can lead to a system hang the next time we change refresh rates as
there are cases when we don't disable OTG/FIFO but FIFO is enabled when
it isn't supposed to be.

[How]
Removing the enable/disable FIFO entirely.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2ce156482a6fef349d2eba98e5070c412d3af662; https://git.kernel.org/stable/c/ce29728ef6485a367934cc100249c66dd3cde5b6; https://git.kernel.org/stable/c/2ce156482a6fef349d2eba98e5070c412d3af662
CVE: CVE-2023-52636
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

libceph: just wait for more data to be available on the socket

A short read may occur while reading the message footer from the
socket.  Later, when the socket is ready for another read, the
messenger invokes all read_partial_*() handlers, including
read_partial_sparse_msg_data().  The expectation is that
read_partial_sparse_msg_data() would bail, allowing the messenger to
invoke read_partial() for the footer and pick up where it left off.

However read_partial_sparse_msg_data() violates that and ends up
calling into the state machine in the OSD client.  The sparse-read
state machine assumes that it's a new op and interprets some piece of
the footer as the sparse-read header and returns bogus extents/data
length, etc.

To determine whether read_partial_sparse_msg_data() should bail, let's
reuse cursor->total_resid.  Because once it reaches to zero that means
all the extents and data have been successfully received in last read,
else it could break out when partially reading any of the extents and
data.  And then osd_sparse_read() could continue where it left off.

[ idryomov: changelog ]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab; https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8; https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae
CVE: CVE-2024-21834
Published: 2024-04-02
Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through type confusion.
CVSS Score: 3.3 (LOW)
CWE: CWE-843, CWE-843
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md
CVE: CVE-2024-22092
Published: 2024-04-02
Description: in OpenHarmony v3.2.4 and prior versions allow a remote attacker bypass permission verification to install apps, although these require user action.
CVSS Score: 7.7 (HIGH)
CWE: CWE-290, CWE-290
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md
CVE: CVE-2024-22098
Published: 2024-04-02
Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md
CVE: CVE-2024-22177
Published: 2024-04-02
Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through get permission.
CVSS Score: 3.3 (LOW)
CWE: CWE-281, CWE-281
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md
CVE: CVE-2024-22180
Published: 2024-04-02
Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through use after free.
CVSS Score: 3.3 (LOW)
CWE: CWE-416, CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md
CVE: CVE-2024-24581
Published: 2024-04-02
Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution through out-of-bounds write.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md; https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md
CVE: CVE-2024-26659
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

xhci: handle isoc Babble and Buffer Overrun events properly

xHCI 4.9 explicitly forbids assuming that the xHC has released its
ownership of a multi-TRB TD when it reports an error on one of the
early TRBs. Yet the driver makes such assumption and releases the TD,
allowing the remaining TRBs to be freed or overwritten by new TDs.

The xHC should also report completion of the final TRB due to its IOC
flag being set by us, regardless of prior errors. This event cannot
be recognized if the TD has already been freed earlier, resulting in
"Transfer event TRB DMA ptr not part of current TD" error message.

Fix this by reusing the logic for processing isoc Transaction Errors.
This also handles hosts which fail to report the final completion.

Fix transfer length reporting on Babble errors. They may be caused by
device malfunction, no guarantee that the buffer has been filled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/2aa7bcfdbb46241c701811bbc0d64d7884e3346c; https://git.kernel.org/stable/c/2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3; https://git.kernel.org/stable/c/418456c0ce[PII_REDACTED]3f21734c5612ee634134
CVE: CVE-2024-26660
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Implement bounds check for stream encoder creation in DCN301

'stream_enc_regs' array is an array of dcn10_stream_enc_registers
structures. The array is initialized with four elements, corresponding
to the four calls to stream_enc_regs() in the array initializer. This
means that valid indices for this array are 0, 1, 2, and 3.

The error message 'stream_enc_regs' 4 <= 5 below, is indicating that
there is an attempt to access this array with an index of 5, which is
out of bounds. This could lead to undefined behavior

Here, eng_id is used as an index to access the stream_enc_regs array. If
eng_id is 5, this would result in an out-of-bounds access on the
stream_enc_regs array.

Thus fixing Buffer overflow error in dcn301_stream_encoder_create
reported by Smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn301/dcn301_resource.c:1011 dcn301_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://git.kernel.org/stable/c/42442f74314d41ddc[PII_REDACTED]6fa3e78940054; https://git.kernel.org/stable/c/58fca355ad37dcb5f785d9095db5f748b79c5dc2; https://git.kernel.org/stable/c/a938eab9586eea31cfd129a507f552efae14d738
CVE: CVE-2024-26661
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'

In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;"
pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to
ensure the tg is not NULL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/39f24c08363af1cd945abad84e3c87fd3e3c845a; https://git.kernel.org/stable/c/3f3c237a706580326d3b7a1b97697e5031ca4667; https://git.kernel.org/stable/c/66951d98d9bf45ba25acf37fe0747253fafdf298
CVE: CVE-2024-26662
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'

'panel_cntl' structure used to control the display panel could be null,
dereferencing it could lead to a null pointer access.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn21/dcn21_hwseq.c:269 dcn21_set_backlight_level() error: we previously assumed 'panel_cntl' could be null (see line 250)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0c863cab0e9173f8b6c7bc328bee3b8625f131b5; https://git.kernel.org/stable/c/2e150ccea13129eb[PII_REDACTED]08eb9770443e4d; https://git.kernel.org/stable/c/e96fddb32931d007db12b1fce9b5e8e4c080401b
CVE: CVE-2024-26663
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()

syzbot reported the following general protection fault [1]:

general protection fault, probably for non-canonical address 0xdffffc[PII_REDACTED]: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x[PII_REDACTED]000080-0x[PII_REDACTED]000087]
...
RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291
...
Call Trace:
 <TASK>
 tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646
 tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089
 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972
 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]
 genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067
 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
 netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367
 netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0xd5/0x180 net/socket.c:745
 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584
 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

The cause of this issue is that when tipc_nl_bearer_add() is called with
the TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called
even if the bearer is not UDP.

tipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that
the media_ptr field of the tipc_bearer has an udp_bearer type object, so
the function goes crazy for non-UDP bearers.

This patch fixes the issue by checking the bearer type before calling
tipc_udp_nl_bearer_add() in tipc_nl_bearer_add().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0cd331dfd6023640c9669d0592bc0fd491205f87; https://git.kernel.org/stable/c/19d7314f2fb9515bdaac9829d4d8eb34edd1fe95; https://git.kernel.org/stable/c/24ec8f0da93b8a9fba11600be8a90f0d73fb46f1
CVE: CVE-2024-26664
Published: 2024-04-02
Description: In the Linux kernel, the following vulnerability has been resolved:

hwmon: (coretemp) Fix out-of-bounds memory access

Fix a bug that pdata->cpu_map[] is set before out-of-bounds check.
The problem might be triggered on systems with more than 128 cores per
package.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/1eb74c00c9c3b13cb65e508c5d5a2f11afb96b8b; https://git.kernel.org/stable/c/3a7753bda55985dc26fae17795cb10d825453ad1; https://git.kernel.org/stable/c/4e440abc894585a34c2904a32cd54af1742311b3