deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-33915
Published: 2024-05-03
Description: Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/debug-log-manager/wordpress-debug-log-manager-plugin-2-3-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/debug-log-manager/wordpress-debug-log-manager-plugin-2-3-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33919
Published: 2024-05-03
Description: Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor.This issue affects RomethemeKit For Elementor: from n/a through 1.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/rometheme-for-elementor/wordpress-romethemekit-for-elementor-plugin-1-4-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rometheme-for-elementor/wordpress-romethemekit-for-elementor-plugin-1-4-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33920
Published: 2024-05-03
Description: Missing Authorization vulnerability in Kama Democracy Poll.This issue affects Democracy Poll: from n/a through 6.0.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/democracy-poll/wordpress-democracy-poll-plugin-6-0-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/democracy-poll/wordpress-democracy-poll-plugin-6-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33921
Published: 2024-05-03
Description: Broken Access Control vulnerability in ReviewX.This issue affects ReviewX: from n/a through 1.6.21.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-281
References: https://patchstack.com/database/vulnerability/reviewx/wordpress-reviewx-plugin-1-6-21-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/reviewx/wordpress-reviewx-plugin-1-6-21-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33923
Published: 2024-05-03
Description: Missing Authorization vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager : from n/a through 4.69.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-69-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-69-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33925
Published: 2024-05-03
Description: Missing Authorization vulnerability in Adrian Mörchen Embed Google Fonts.This issue affects Embed Google Fonts: from n/a through 3.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/embed-google-fonts/wordpress-embed-google-fonts-plugin-3-1-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/embed-google-fonts/wordpress-embed-google-fonts-plugin-3-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33929
Published: 2024-05-03
Description: Missing Authorization vulnerability in wpWax Directorist.This issue affects Directorist: from n/a through 7.8.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/directorist/wordpress-directorist-plugin-7-8-6-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/directorist/wordpress-directorist-plugin-7-8-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33931
Published: 2024-05-03
Description: Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/jw-player-7-for-wp/wordpress-jw-player-for-wordpress-plugin-2-3-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jw-player-7-for-wp/wordpress-jw-player-for-wordpress-plugin-2-3-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33937
Published: 2024-05-03
Description: Missing Authorization vulnerability in Nico Martin Progressive WordPress (PWA).This issue affects Progressive WordPress (PWA): from n/a through 2.1.13.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/progressive-wp/wordpress-progressive-wordpress-pwa-plugin-2-1-13-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/progressive-wp/wordpress-progressive-wordpress-pwa-plugin-2-1-13-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32986
Published: 2024-05-03
Description: PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as name, description, shortcuts), web apps were able to inject additional lines into XDG Desktop Entries (on Linux) and `AppInfo.ini` (on PortableApps.com). This allowed malicious web apps to introduce keys like `Exec`, which could run arbitrary code when the affected web app was launched. This vulnerability affects all Linux and PortableApps.com users of all PWAsForFirefox versions up to (excluding) 2.12.0. Windows and macOS users are not affected. This vulnerability has been fixed in commit `9932d4b` which has been included in release in v2.12.0. The main fix is implemented in the native part, but the extension also contains additional fixes. All Linux and PortableApps.com users are advised to update to this version as soon as possible. It is also recommended for Windows and macOS users to update to this version, as it contains additional fixes related to properties sanitization. There are no known workarounds for this vulnerability.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-74, CWE-93, CWE-150
References: https://github.com/filips123/PWAsForFirefox/commit/9932d4b289631d447f88ace09a2fabafe4cd5bd5; https://github.com/filips123/PWAsForFirefox/releases/tag/v2.12.0; https://github.com/filips123/PWAsForFirefox/security/advisories/GHSA-jmhv-m7v5-g5jq
CVE: CVE-2024-34062
Published: 2024-05-03
Description: tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-74
References: https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316; https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6/
CVE: CVE-2024-34063
Published: 2024-05-03
Description: vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization capabilities behind a feature flag and defaulted this feature to off. The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure. This issue has been addressed in version 0.6.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.5 (LOW)
CWE: CWE-1188
References: https://github.com/matrix-org/vodozemac/commit/297548cad4016ce448c4b5007c54db7ee39489d9; https://github.com/matrix-org/vodozemac/security/advisories/GHSA-c3hm-hxwf-g5c6; https://github.com/matrix-org/vodozemac/commit/297548cad4016ce448c4b5007c54db7ee39489d9
CVE: CVE-2024-34072
Published: 2024-05-03
Description: sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. Users are advised to upgrade to version 2.218.0. Users unable to upgrade should not pass pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with. Only pass pickled numpy object arrays from trusted sources.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://github.com/aws/sagemaker-python-sdk/pull/4557; https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r; https://github.com/aws/sagemaker-python-sdk/pull/4557
CVE: CVE-2024-34073
Published: 2024-05-03
Description: sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module allows for potentially unsafe Operating System (OS) Command Injection if inappropriate command is passed as the “requirements_path” parameter. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. This issue has been addressed in version 2.214.3. Users are advised to upgrade. Users unable to upgrade should not override the “requirements_path” parameter of capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils`, and instead use the default value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/aws/sagemaker-python-sdk/commit/2d873d53f708ea570fc2e2a6974f8c3097fe9df5; https://github.com/aws/sagemaker-python-sdk/pull/4556; https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-7pc3-pr3q-58vg
CVE: CVE-2024-4461
Published: 2024-05-03
Description: Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to inject arbitrary code into the unquoted service path, resulting in privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://www.incibe.es/en/incibe-cert/notices/aviso/unquoted-path-or-search-item-vulnerability-sugarsync; https://www.incibe.es/en/incibe-cert/notices/aviso/unquoted-path-or-search-item-vulnerability-sugarsync
CVE: CVE-2024-4466
Published: 2024-05-03
Description: SQL injection vulnerability in Gescen on the centrosdigitales.net platform. This vulnerability allows an attacker to send a specially crafted SQL query to the pass parameter and retrieve all the data stored in the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-gescen; https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-gescen
CVE: CVE-2024-2410
Published: 2024-05-03
Description: The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the parser will attempt to read bytes from a chunk that has already been freed. 

CVSS Score: 7.6 (HIGH)
CWE: CWE-416
References: https://github.com/protocolbuffers/protobuf/releases/tag/v25.0; https://github.com/protocolbuffers/protobuf/releases/tag/v25.0
CVE: CVE-2024-33786
Published: 2024-05-03
Description: An arbitrary file upload vulnerability in Zhongcheng Kexin Ticketing Management Platform 20.04 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/jiankeguyue/VulnerabilityReport/blob/main/zhongcheng_kexin_ticketing_management_platform.md; https://github.com/jiankeguyue/VulnerabilityReport/blob/main/zhongcheng_kexin_ticketing_management_platform.md
CVE: CVE-2024-33787
Published: 2024-05-03
Description: Hengan Weighing Management Information Query Platform 2019-2021 53.25 was discovered to contain a SQL injection vulnerability via the tuser_Number parameter at search_user.aspx.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://github.com/jiankeguyue/VulnerabilityReport/blob/main/hengan_weighing_management_information_query_platform.md; https://github.com/jiankeguyue/VulnerabilityReport/blob/main/hengan_weighing_management_information_query_platform.md
CVE: CVE-2023-41816
Published: 2024-05-03
Description: 
An improper export vulnerability was reported in the Motorola Services Main application that could allow a local attacker to write to a local database. 


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-926
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178874; https://en-us.support.motorola.com/app/answers/detail/a_id/178874
CVE: CVE-2023-41817
Published: 2024-05-03
Description: An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorized information.
CVSS Score: 2.8 (LOW)
CWE: CWE-927
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178875; https://en-us.support.motorola.com/app/answers/detail/a_id/178875
CVE: CVE-2023-41818
Published: 2024-05-03
Description: 
An improper use of the SD card for sensitive data vulnerability was reported in the Motorola Device Help application that could allow a local attacker to read system logs. 


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-921
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178876; https://en-us.support.motorola.com/app/answers/detail/a_id/178876
CVE: CVE-2023-41819
Published: 2024-05-03
Description: 
A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local attacker to access unauthorized content providers. 


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-285
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178877; https://en-us.support.motorola.com/app/answers/detail/a_id/178877
CVE: CVE-2023-41820
Published: 2024-05-03
Description: 
An implicit intent vulnerability was reported in the Motorola Ready For application that could allow a local attacker to read information about connected Bluetooth audio devices. 


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-927
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178878; https://en-us.support.motorola.com/app/answers/detail/a_id/178878
CVE: CVE-2023-41821
Published: 2024-05-03
Description: 
A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information. 


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-926
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178879; https://en-us.support.motorola.com/app/answers/detail/a_id/178879
CVE: CVE-2023-41822
Published: 2024-05-03
Description: 
An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands. 


CVSS Score: 4.8 (MEDIUM)
CWE: CWE-926
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178704; https://en-us.support.motorola.com/app/answers/detail/a_id/178704
CVE: CVE-2023-41823
Published: 2024-05-03
Description: 
An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unauthorized Activities. 


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-926
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178705; https://en-us.support.motorola.com/app/answers/detail/a_id/178705
CVE: CVE-2023-41824
Published: 2024-05-03
Description: 
An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data.








CVSS Score: 2.8 (LOW)
CWE: CWE-927
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178865; https://en-us.support.motorola.com/app/answers/detail/a_id/178865
CVE: CVE-2023-41825
Published: 2024-05-03
Description: 
A path traversal vulnerability was reported in the Motorola Ready For application that could allow a local attacker to access local files. 


CVSS Score: 2.8 (LOW)
CWE: CWE-22
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178866; https://en-us.support.motorola.com/app/answers/detail/a_id/178866
CVE: CVE-2023-41826
Published: 2024-05-03
Description: A PendingIntent hijacking vulnerability in Motorola Device Help (Genie) application that could allow local attackers to access files or interact with non-exported software components without permission. 


CVSS Score: 5.1 (MEDIUM)
CWE: CWE-927
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178703; https://en-us.support.motorola.com/app/answers/detail/a_id/178703
CVE: CVE-2023-41828
Published: 2024-05-03
Description: 
An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exported content provider.  
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-927
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178701; https://en-us.support.motorola.com/app/answers/detail/a_id/178701
CVE: CVE-2023-41830
Published: 2024-05-03
Description: 
An improper absolute path traversal vulnerability was reported for the Ready For application allowing a local application access to files without authorization. 


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-36
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178702; https://en-us.support.motorola.com/app/answers/detail/a_id/178702
CVE: CVE-2023-6363
Published: 2024-05-03
Description: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.
This issue affects Valhall GPU Kernel Driver: from r41p0 through r47p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.


CVSS Score: 5.1 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-1067
Published: 2024-05-03
Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. On Armv8.0 cores, there are certain combinations of the Linux Kernel and Mali GPU kernel driver configurations that would allow the GPU operations to affect the userspace memory of other processes.
This issue affects Bifrost GPU Kernel Driver: from r41p0 through r47p0; Valhall GPU Kernel Driver: from r41p0 through r47p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.


CVSS Score: 7.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-1395
Published: 2024-05-03
Description: Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.
This issue affects Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-3108
Published: 2024-05-03
Description: 
An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of the device without authorization. 


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-927
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178863; https://en-us.support.motorola.com/app/answers/detail/a_id/178863
CVE: CVE-2024-3109
Published: 2024-05-03
Description: 
A hard-coded AES key vulnerability was reported in the Motorola GuideMe application, along with a lack of URI sanitation, could allow for a local attacker to read arbitrary files.








CVSS Score: 6.3 (MEDIUM)
CWE: CWE-321
References: https://en-us.support.motorola.com/app/answers/detail/a_id/178863; https://en-us.support.motorola.com/app/answers/detail/a_id/178863
CVE: CVE-2022-48670
Published: 2024-05-03
Description: In the Linux kernel, the following vulnerability has been resolved:

peci: cpu: Fix use-after-free in adev_release()

When auxiliary_device_add() returns an error, auxiliary_device_uninit()
is called, which causes refcount for device to be decremented and
.release callback will be triggered.

Because adev_release() re-calls auxiliary_device_uninit(), it will cause
use-after-free:
[ 1269.455172] WARNING: CPU: 0 PID: 14267 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15
[ 1269.464007] refcount_t: underflow; use-after-free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/1c11289b34ab67ed080bbe0f1855c4938362d9cf; https://git.kernel.org/stable/c/c87f1f99e26ea4ae08cabe753ae98e5626bdba89; https://git.kernel.org/stable/c/1c11289b34ab67ed080bbe0f1855c4938362d9cf
CVE: CVE-2022-48671
Published: 2024-05-03
Description: In the Linux kernel, the following vulnerability has been resolved:

cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()

syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at
cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix
threadgroup_rwsem <-> cpus_read_lock() deadlock") missed that
cpuset_attach() is also called from cgroup_attach_task_all().
Add cpus_read_lock() like what cgroup_procs_write_start() does.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/07191f984842d50020789ff14c75da436a7f46a9; https://git.kernel.org/stable/c/321488cfac7d0eb6d97de467015ff754f85813ff; https://git.kernel.org/stable/c/43626dade36fa74d3329046f4ae2d7fdefe401c6
CVE: CVE-2022-48672
Published: 2024-05-03
Description: In the Linux kernel, the following vulnerability has been resolved:

of: fdt: fix off-by-one error in unflatten_dt_nodes()

Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree")
forgot to fix up the depth check in the loop body in unflatten_dt_nodes()
which makes it possible to overflow the nps[] buffer...

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193
References: https://git.kernel.org/stable/c/2133f451311671c7c42b5640d2b999326b39aa0e; https://git.kernel.org/stable/c/2566706ac6393386a4e7c4ce23fe17f4c98d9aa0; https://git.kernel.org/stable/c/2f945a792f67815abca26fa8a5e863ccf3fa1181