huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-56201: jinja2: Jinja has a sandbox breakout through malicious filenames
Component: jinja2
Severity: Important
CWE: CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-12-23T15:37:36.110000+00:00

A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs to be able to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates where the template author can also choose the template filename.

Statement: This vulnerability has rated as a IMPORTANT flaw because an attacker controlling both the template content and filename to execute arbitrary Python code, bypassing the sandbox.

Affected upstream versions: >= 3.0.0, < 3.1.5
Fixed upstream versions: 3.1.5
Upstream repository: https://github.com/pallets/jinja
Upstream fix commit: 767b23617628419ae3709ccfb02f9602ae9fe51f
CVE-2024-56326: jinja2: Jinja has a sandbox breakout through indirect reference to format method
Component: jinja2
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-12-23T15:43:49.400000+00:00

A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, storing a reference to a malicious string's format method is possible, then passing that to a filter that calls it. No such filters are built into Jinja but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.

Statement: This vulnerability is rated as Moderate due to an oversight in Jinja's sandbox environment, allowing attackers to execute arbitrary Python code through controlled template content. This requires control over template content, making exploitation possible only in specific applications, thus limiting its overall impact.

Affected upstream versions: < 3.1.5
Fixed upstream versions: 3.1.5
Upstream repository: https://github.com/pallets/jinja
Upstream fix commit: 48b0687e05a5466a91cd5812d604fa37ad0943b4
CVE-2024-56334: systeminformation: Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation
Component: systeminformation
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-12-20T20:10:12.578000+00:00

A flaw was found in the systeminformation library for Node.js. In Windows systems, the SSID parameter of the `getWindowsIEEE8021x` function is not sanitized before it is passed to cmd.exe. This may allow a remote attacker to execute arbitrary commands on the target system.

Statement: This vulnerability in the systeminformation library is marked as a high-severity issue because it allows for the execution of arbitrary commands via an unsanitized SSID input passed to `cmd.exe`. Since this flaw can lead to remote code execution (RCE) or local privilege escalation, it provides an attacker with the potential to execute malicious scripts on the affected system.

Affected upstream versions: < 5.23.7
Fixed upstream versions: v5.23.7
Upstream repository: https://github.com/sebhildebrandt/systeminformation
Upstream fix commit: f7af0a67b78e7894335a6cad510566a25e06ae41
CVE-2024-56406: perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
Component: perl
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-04-13T13:16:09.841000+00:00

A flaw was found in Perl. This vulnerability allows a heap buffer overflow, which can lead to denial of service and potential arbitrary code execution on platforms that lack sufficient defenses via specially crafted input to the tr/// transliteration operator containing non-ASCII bytes on the left-hand side.

Statement: This vulnerability is rated as an Important vulnerability because a heap buffer overflow vulnerability exists in the tr/// operator causing DoS and arbitrary code execution, which can disrupt system services, background system jobs.

Affected upstream versions: 5.41.0 <= 5.41.10, 5.39.0 < 5.40.2-RC1, 5.33.1 < 5.38.4-RC1
Fixed upstream versions: 5.38.4-RC1, 5.40.2-RC1
Upstream repository: https://github.com/Perl/perl5
Upstream fix commit: 87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd
CVE-2024-5642: python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used
Component: python
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-06-27T00:00:00+00:00

A vulnerability was found in Python/CPython that does not disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This issue results in a buffer over-read when NPN is used. See CVE -2024-5535 for OpenSSL for more information.

Statement: This vulnerability is rated with a Low severity due to NPN not being widely used and specifying an empty list is likely uncommon in practice. Typically, a protocol name would be configured.

Affected upstream versions: <= v3.10.0a7
Fixed upstream versions: v3.10.0
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 39258d3595300bc7b952854c915f63ae2d4b9c3e
CVE-2024-56535: kernel: wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()

kmalloc may fail, return value might be NULL and will cause
NULL pointer dereference. Add check NULL return of kmalloc in
btc_fw_set_monreg().


Affected upstream versions: 6.10
Fixed upstream versions: 0, 6.11.11, 6.12.2, 6.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 051577414271961f3f4c3bff87b427924b486219
CVE-2024-56544: kernel: udmabuf: change folios array from kmalloc to kvmalloc
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

udmabuf: change folios array from kmalloc to kvmalloc

When PAGE_SIZE 4096, MAX_PAGE_ORDER 10, 64bit machine,
page_alloc only support 4MB.
If above this, trigger this warn and return NULL.

udmabuf can change size limit, if change it to 3072(3GB), and then alloc
3GB udmabuf, will fail create.

[ 4080.876581] ------------[ cut here ]------------
[ 4080.876843] WARNING: CPU: 3 PID: 2015 at mm/page_alloc.c:4556 __alloc_pages+0x2c8/0x350
[ 4080.878839] RIP: 0010:__alloc_pages+0x2c8/0x350
[ 4080.879470] Call Trace:
[ 4080.879473]  <TASK>
[ 4080.879473]  ? __alloc_pages+0x2c8/0x350
[ 4080.879475]  ? __warn.cold+0x8e/0xe8
[ 4080.880647]  ? __alloc_pages+0x2c8/0x350
[ 4080.880909]  ? report_bug+0xff/0x140
[ 4080.881175]  ? handle_bug+0x3c/0x80
[ 4080.881556]  ? exc_invalid_op+0x17/0x70
[ 4080.881559]  ? asm_exc_invalid_op+0x1a/0x20
[ 4080.882077]  ? udmabuf_create+0x131/0x400

Because MAX_PAGE_ORDER, kmalloc can max alloc 4096 * (1 << 10), 4MB
memory, each array entry is pointer(8byte), so can save 524288 pages(2GB).

Further more, costly order(order 3) may not be guaranteed that it can be
applied for, due to fragmentation.

This patch change udmabuf array use kvmalloc_array, this can fallback
alloc into vmalloc, which can guarantee allocation for any size and does
not affect the performance of kmalloc allocations.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 6.11.11, 6.12.2, 6.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2acc6192aa8570661ed37868c02c03002b1dc290
CVE-2024-56558: kernel: nfsd: make sure exp active before svc_export_show
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nfsd: make sure exp active before svc_export_show

The function `e_show` was called with protection from RCU. This only
ensures that `exp` will not be freed. Therefore, the reference count for
`exp` can drop to zero, which will trigger a refcount use-after-free
warning when `exp_get` is called. To resolve this issue, use
`cache_get_rcu` to ensure that `exp` remains active.

------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 3 PID: 819 at lib/refcount.c:25
refcount_warn_saturate+0xb1/0x120
CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
RIP: 0010:refcount_warn_saturate+0xb1/0x120
...
Call Trace:
 <TASK>
 e_show+0x20b/0x230 [nfsd]
 seq_read_iter+0x589/0x770
 seq_read+0x1e5/0x270
 vfs_read+0x125/0x530
 ksys_read+0xc1/0x160
 do_syscall_64+0x5f/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7e


Affected upstream versions: 3.17
Fixed upstream versions: 0, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.12.4, 6.13, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e2fa0d0e327279a8defb87b263cd0bf288fd9261
CVE-2024-56562: kernel: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
Component: kernel
Severity: Moderate
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Public date: 2024-12-27T00:00:00+00:00

A vulnerability was found in the i3c_master_put_i3c_addrs() function in the Linux kernel's i3c driver. A memory management issue can occur due to a copy-paste error between "dyn_addr" and "init_dyn_addr", which leads to incorrect handling of memory, potentially causing resource mismanagement and instability within the system.

Statement: This vulnerability is rated as moderate because it involves a minor memory management issue due to a copy-paste error. The impact is limited to specific conditions, and it does not lead to severe consequences, making the risk relatively low.

Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.12.4, 6.13, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c2f0ce241154b04f2fc150ff16ad82d9b8fdfa4a
CVE-2024-56566: kernel: mm/slub: Avoid list corruption when removing a slab from the full list
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

A use-after-free list corruption vulnerability was found in the Linux kernel. If an allocated object fails in alloc_consistency_checks, all objects of the slab will be marked as used and the slab will be removed from the partial list. When an object belonging to the slab gets freed later, the remove_full() function is called. Since the slab is neither on the partial list nor on the full list, it eventually leads to a list corruption.


Affected upstream versions: 2.6.22
Fixed upstream versions: 0, 6.12.4, 6.13, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 33a213c04faff6c3a7fe77e947db81bc7270fe32
CVE-2024-56570: kernel: ovl: Filter invalid inodes with missing lookup function
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ovl: Filter invalid inodes with missing lookup function

Add a check to the ovl_dentry_weird() function to prevent the
processing of directory inodes that lack the lookup function.
This is important because such inodes can cause errors in overlayfs
when passed to the lowerstack.


Affected upstream versions: 3.18
Fixed upstream versions: 0, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.12.4, 6.13, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f9248e2f73fb4afe08324485e98c815ac084d166
CVE-2024-56590: kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
Component: kernel
Severity: Moderate
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Public date: 2024-12-27T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel. The Bluetooth firmware isn't checked if skb contains an ACL header, otherwise the code may attempt to access some uninitialized or invalid memory past the valid skb->data.

Statement: This vulnerability, rated as moderate severity, involves a flaw in the Linux kernel's Bluetooth subsystem. A failure to validate the socket buffer's length before accessing ACL headers can lead to out-of-bounds memory access. This creates a risk of kernel memory corruption, potentially allowing attackers to corrupt kernel memory related to bluetooth networking, which might impact the functionality of connected devices. However, even in situations where an attacker had significant access to and information about a target system, our assessment indicates that the security features of the kernel would prevent a compromise of confidentiality or the ability to escalate their privileges.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.15.174, 6.1.120, 6.12.5, 6.13, 6.6.66
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 219960a48771b35a3857a491b955c31d6c33d581
CVE-2024-56591: kernel: Bluetooth: hci_conn: Use disable_delayed_work_sync
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

A flaw was found in the Bluetooth subsystem of the Linux kernel, in the handling of delayed work within the hci_conn (Host Controller Interface connection) structure. The kernel used cancel_delayed_work_sync() when shutting down a connection, which cancels ongoing work but allows rescheduling. This could result in use-after-free conditions if the work is resubmitted after the associated object has been freed. Replacing it with disable_delayed_work_sync() prevents further scheduling, ensuring proper cleanup. A local attacker could potentially exploit this to trigger a use-after-free, leading to a denial of service or possible code execution.


Affected upstream versions: 3.3
Fixed upstream versions: 0, 6.12.5, 6.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c55a4c5a04bae40dcdc1e1c19d8eb79a06fb3397
CVE-2024-56600: kernel: net: inet6: do not leave a dangling sk pointer in inet6_create()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: inet6: do not leave a dangling sk pointer in inet6_create()

sock_init_data() attaches the allocated sk pointer to the provided sock
object. If inet6_create() fails later, the sk object is released, but the
sock object retains the dangling sk pointer, which may cause use-after-free
later.

Clear the sock sk pointer on error.

Statement: This issue is considered to be a moderate impact flaw, it seems this the data leak is from TCP protocol stack on not of all kernel space.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.12.5, 6.13, 6.6.66
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f2709d1271cfdf55c670ab5c5982139ab627ddc7
CVE-2024-56601: kernel: net: inet: do not leave a dangling sk pointer in inet_create()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: inet: do not leave a dangling sk pointer in inet_create()

sock_init_data() attaches the allocated sk object to the provided sock
object. If inet_create() fails later, the sk object is freed, but the
sock object retains the dangling pointer, which may create use-after-free
later.

Clear the sk pointer in the sock object on error.

Statement: This issue is considered to be a moderate impact flaw, as it seems data leaked in this problem could be related to TCP protocol and not of a complete kernel space.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.12.5, 6.13, 6.6.66
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f8a3f255f7509a209292871715cda03779640c8d
CVE-2024-56602: kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

A user-after-free vulnerability was found in the linux kernel. sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, leading to a crash and loss of availability of the system.


Affected upstream versions: 2.6.31
Fixed upstream versions: 0, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.12.5, 6.13, 6.6.66
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9
CVE-2024-56603: kernel: net: af_can: do not leave a dangling sk pointer in can_create()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: af_can: do not leave a dangling sk pointer in can_create()

On error can_create() frees the allocated sk object, but sock_init_data()
has already attached it to the provided sock object. This will leave a
dangling sk pointer in the sock object and may cause use-after-free later.

Statement: This issue is considered to be a moderate impact flaw. It seems the data exposed in this case is specific to network protocol stack and not of all kernel space.

Affected upstream versions: 2.6.25
Fixed upstream versions: 0, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.12.5, 6.13, 6.6.66
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 884ae8bcee749be43a071d6ed2d89058dbd2425c
CVE-2024-56604: kernel: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.8 (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()

bt_sock_alloc() attaches allocated sk object to the provided sock object.
If rfcomm_dlc_alloc() fails, we release the sk object, but leave the
dangling pointer in the sock object, which may cause use-after-free.

Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().

Statement: This issue is considered to be a moderate impact flaw, as the reproduction (and exploit) for this is complex and not available.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 6.1.120, 6.12.5, 6.13, 6.6.66
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ac3eaac4cf142a15fe67be747a682b1416efeb6e
CVE-2024-56605: kernel: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()

bt_sock_alloc() allocates the sk object and attaches it to the provided
sock object. On error l2cap_sock_alloc() frees the sk object, but the
dangling pointer is still attached to the sock object, which may create
use-after-free in other code.

Statement: The bug could happen only for some complex conditions (on error path and during closing connection). It would not be simple to use it for attack, so attack complexity it high. Unlikely that would be possible to trigger it remotely. No known reproducer. The security impact is limited.

Affected upstream versions: 3.6
Fixed upstream versions: 0, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.12.5, 6.13, 6.6.66
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f6ad641646b67f29c7578dcd6c25813c7dcbf51e