huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-48337: emacs: command execution via shell metacharacters
Component: emacs
Severity: Moderate
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2023-02-21T00:00:00+00:00

A flaw was found in the Emacs package. This flaw allows attackers to execute commands via shell metacharacters in the name of a source-code file.

Statement: This vulnerability is only triggered when a local user introduces untrusted input, via a file with a crafted name. For this reason, this flaw has been rated with a Moderate security impact.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/emacs.git
Upstream fix commit: 01a4035c869b91c153af9a9132c87adb7669ea1c
CVE-2022-48338: emacs: local command injection in ruby-mode.el
Component: emacs
Severity: Moderate
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2023-02-21T00:00:00+00:00

A flaw was found in the Emacs package. A malicious ruby source file may cause a local command injection.

Statement: This vulnerability is only triggered when a local user runs Emacs with untrusted input. For this reason, this flaw has been rated with a Moderate security impact.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/emacs.git
Upstream fix commit: 9a3b08061feea14d6f37685ca1ab8801758bfd1c
CVE-2022-48339: emacs: command injection vulnerability in htmlfontify.el
Component: emacs
Severity: Moderate
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2023-02-21T00:00:00+00:00

A flaw was found in the Emacs package. If a file name or directory name contains shell metacharacters, arbitrary code may be executed.

Statement: This vulnerability is only triggered when a local user introduces untrusted input, via a file or directory with a crafted name. For this reason, this flaw has been rated with a Moderate security impact.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/emacs.git
Upstream fix commit: 1b4dc4691c1f87fc970fbe568b43869a15ad0d4c
CVE-2022-48468: protobuf-c: unsigned integer overflow in parse_required_member
Component: protobuf-c
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-04-13T00:00:00+00:00

A vulnerability was found in protobuf-c. This security flaw leads to an unsigned integer overflow in parse_required_member.


Affected upstream versions: n/a
Fixed upstream versions: v1.4.1
Upstream repository: https://github.com/protobuf-c/protobuf-c
Upstream fix commit: ec3d900001a13ccdaa8aef996b34c61159c76217
CVE-2022-48522: perl: stack-based crash in S_find_uninit_var()
Component: perl
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-08-22T00:00:00+00:00

A stack-based buffer overflow vulnerability was found in the S_find_uninit_var() function in sv.c in Perl. This issue may allow an authenticated local attacker to send a specially crafted request to the application, leading to an infinite recursion, exhausting the process' stack space, resulting in a denial of service.

Statement: The vulnerable code was introduced in Perl v5.33.1. Red Hat Enterprise Linux ships Perl v5.32.1 and lower. Our code-base does not contain the vulnerable code, therefore, RHEL is not affected.

When attempting to access a hash entry with an undefined variable as the key, an infinite recursion occurs, depleting the stack space and leading to a stack overflow. This behavior is specific to cases where '-w' ("use warnings;") are enabled.

Affected upstream versions: n/a
Fixed upstream versions: v5.35.5
Upstream repository: https://github.com/Perl/perl5
Upstream fix commit: 23cca2d1f4544cb47f1124d98c308ce1f31f09a6
CVE-2022-48619: kernel: event code falling outside of a bitmap in input_set_capability() leads to panic
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-03-21T00:00:00+00:00

A vulnerability was found in drivers/input/input.c in the Linux Kernel, where the input_set_capability() function mishandles scenarios where an event code is outside the bitmap. This issue can lead to a kernel panic when the event code exceeds the bitmap for the specified event type, which could allow an attacker to cause a kernel crash and potential disruption of services.


Affected upstream versions: n/a
Fixed upstream versions: v5.18
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 409353cbe9fe48f6bc196114c442b1cff05a39bc
CVE-2022-48624: less: missing quoting of shell metacharacters in LESSCLOSE handling
Component: less
Severity: Moderate
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-02-19T00:00:00+00:00

A flaw was found in less. The close_altfile() function in filename.c omits shell_quote calls for LESSCLOSE, a command line to invoke the optional input postprocessor. This issue could lead to an OS command injection vulnerability and arbitrary command execution on the host operating system.

Statement: To exploit this issue, an attacker needs the ability to influence the LESSCLOSE environment variable. This requirement makes this CVE a Moderate impact CVE.

Affected upstream versions: n/a
Fixed upstream versions: v606
Upstream repository: https://github.com/gwsw/less
Upstream fix commit: c6ac6de49698be84d264a0c4c0c40bb870b10144
CVE-2022-48627: kernel: vt: fix memory overlapping when deleting chars in the buffer
Component: kernel
Severity: Moderate
CWE: CWE-1260 (Improper Handling of Overlap Between Protected Memory Ranges)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-03-02T00:00:00+00:00

A flaw was found in the Linux kernel's virtual terminal driver which causes a memory overlapping copy to occur, this overlapping copy can lead to data corruption and could potentially allow an attacker interacting with a virtual terminal to corrupt or expose system memory.


Affected upstream versions: 3.7
Fixed upstream versions: 0, 4.19.312, 5.10.132, 5.15.56, 5.18.13, 5.19, 5.4.274
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c8686c014b5e872ba7e334f33ca553f14446fc29
CVE-2022-48632: kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-28T00:00:00+00:00

A flaw was found in the Linux kernel. The following vulnerability has been resolved: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction().

Statement: Actual only for ARM platforms. For the Red Hat Enterprise Linux and Fedora the related code disabled, so not affected (apart from the latest version of the Red Hat Enterprise Linux 9 and latest version of the Red Hat Enterprise Linux 10). The bug could happen only if Mellanox BlueField I2C controller being used.

Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.146, 5.15.71, 5.19.12, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 48ee0a864d1af02eea98fc825cc230d61517a71e
CVE-2022-48637: kernel: bnxt: prevent skb UAF after handing over to PTP worker
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-04-28T00:00:00+00:00

A possible use-after-free after handing over to PTP worker was found in the Linux kernel. This may lead to a crash.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.71, 5.19.12, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 08483e4c0c83b221b8891434a04cec405dee94a6
CVE-2022-48638: kernel: cgroup: cgroup_get_from_id() must check the looked-up kn is a directory
Component: kernel
Severity: Moderate
CWE: CWE-588 (Attempt to Access Child of a Non-structure Pointer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-28T00:00:00+00:00

A flaw was found in the Linux kernel in which certain cgroup configurations could cause a kernel panic, resulting in a Denial of Service.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.72, 5.19.12, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8484a356cee8ce3d6a8e6266ff99be326e9273ad
CVE-2022-48659: kernel: mm/slub: fix to return errno if kmalloc() fails
Component: kernel
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: fix to return errno if kmalloc() fails

In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to
out-of-memory, if it fails, return errno correctly rather than
triggering panic via BUG_ON();

kernel BUG at mm/slub.c:5893!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP

Call trace:
 sysfs_slab_add+0x258/0x260 mm/slub.c:5973
 __kmem_cache_create+0x60/0x118 mm/slub.c:4899
 create_cache mm/slab_common.c:229 [inline]
 kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335
 kmem_cache_create+0x1c/0x28 mm/slab_common.c:390
 f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline]
 f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808
 f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149
 mount_bdev+0x1b8/0x210 fs/super.c:1400
 f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512
 legacy_get_tree+0x30/0x74 fs/fs_context.c:610
 vfs_get_tree+0x40/0x140 fs/super.c:1530
 do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040
 path_mount+0x358/0x914 fs/namespace.c:3370
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount fs/namespace.c:3568 [inline]
 __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568


Affected upstream versions: 2.6.22
Fixed upstream versions: 0, 4.14.295, 4.19.260, 4.9.330, 5.10.146, 5.15.71, 5.19.12, 5.4.215, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e9219fa63c5c25804af82c7aa54d1ec770ebe457
CVE-2022-48669: kernel: powerpc/pseries: Fix potential memleak in papr_get_attr()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A flaw was found in the Linux kernel. A potential memleak in papr_get_attr() may lead to compromised availability.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a3f22feb2220a945d1c3282e34199e8bcdc5afc4
CVE-2022-48672: kernel: of: fdt: fix off-by-one error in unflatten_dt_nodes()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

of: fdt: fix off-by-one error in unflatten_dt_nodes()

The Linux kernel CVE team has assigned CVE-2022-48672 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050318-CVE-2022-48672-b6d9@gregkh/T


Affected upstream versions: 4.7
Fixed upstream versions: 0, 4.14.295, 4.19.260, 5.10.145, 5.15.70, 5.19.11, 5.4.215, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cbdda20ce363356698835185801a58a28f644853
CVE-2022-48686: kernel: nvme-tcp: fix UAF when detecting digest errors
Component: kernel
Severity: Moderate
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-03T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel in drivers/nvme/host/tcp.c in nvme_tcp_io_work. This issue can occur when a local user continues to read data after the connection finishes. This flaw allows a malicious user to cause a use-after-free problem.

Statement: This vulnerability is only for systems where NVME over TCP being used.

Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.143, 5.15.68, 5.19.9, 5.4.213, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 19816a0214684f70b49b25075ff8c402fdd611d3
CVE-2022-48687: kernel: ipv6: sr: fix out-of-bounds read when setting HMAC data.
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-05-03T00:00:00+00:00

An out-of-bounds read flaw was found when setting HMAC data in net/ipv6/seg6.c in the Linux kernel. This issue may lead to a crash.

Statement: Fixed starting from Red Hat Enterprise Linux 9.

Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.14.293, 4.19.258, 5.10.143, 5.15.68, 5.19.9, 5.4.213, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dc9dbd65c803af1607484fed5da50d41dc8dd864
CVE-2022-48695: kernel: scsi: mpt3sas: Fix use-after-free warning
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-03T00:00:00+00:00

A user after-free vulnerability was found in the Linux kernel in the refcount_t variable when performing the controller reset. This issue could lead to denial of service of the system.


Affected upstream versions: 4.4
Fixed upstream versions: 0, 4.14.293, 4.19.258, 4.9.328, 5.10.143, 5.15.68, 5.19.9, 5.4.213, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b8fc9e91b931215110ba824d1a2983c5f60b6f82
CVE-2022-48696: kernel: regmap: spi: Reserve space for register address/padding
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

regmap: spi: Reserve space for register address/padding

Currently the max_raw_read and max_raw_write limits in regmap_spi struct
do not take into account the additional size of the transmitted register
address and padding.  This may result in exceeding the maximum permitted
SPI message size, which could cause undefined behaviour, e.g. data
corruption.

Fix regmap_get_spi_bus() to properly adjust the above mentioned limits
by reserving space for the register address/padding as set in the regmap
configuration.

Statement: This issue is fixed in RHEL-9.2 and above (including RHEL-8.10):
~~~
in (rhel-9.2, rhel-9.3, rhel-9.4, rhel-9.5) regmap: spi: Reserve space for register address/padding
in (rhel-8.8, rhel-8.9, rhel-8.10) regmap: spi: Reserve space for register address/padding
~~~
Please note that while RHEL-9 kernel-rt still appears as affected, it has been fixed in the same RHSA as RHEL-9 kernel. This is because from RHEL-9.3 onwards, the kernel and kernel-rt fixes are bundled together in a single errata.

Affected upstream versions: 5.16
Fixed upstream versions: 0, 5.19.9, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 15ff1f17847c19174b260bd7dd0de33edcebd45e
CVE-2022-48701: kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug
Component: kernel
Severity: Low
CVSS v3: 4.9 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-05-03T00:00:00+00:00

A flaw was found in the Linux kernel ALSA USB audio driver. This vulnerability allows a denial of service via a crafted USB audio device.


Affected upstream versions: 2.6.26
Fixed upstream versions: 0, 4.14.293, 4.19.258, 4.9.328, 5.10.143, 5.15.68, 5.19.9, 5.4.213, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b970518014f2f0f6c493fb86c1e092b936899061
CVE-2022-48703: kernel: thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-03T00:00:00+00:00

A flaw was found in the Linux kernel in the `thermal/int340x_thermal` driver. This issue occurs when the Global Device Data Vault (GDDV) returns a zero-length buffer, causing the `kmemdup()` function to return a `ZERO_SIZE_PTR` (0x10), leading to a NULL pointer dereference in `data_vault_read()`, potentially causing a kernel crash. The issue has been fixed by adding checks for `ZERO_SIZE_PTR` or `NULL` using the `ZERO_OR_NULL_PTR()` macro.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.258, 5.15.189, 5.19.9, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 722588f17fd3d3a127e50718ec2caf22bd7e9daa
CVE-2022-48735: kernel: ALSA: hda: Fix UAF of leds class devs at unbinding
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H)
Public date: 2024-06-20T00:00:00+00:00

A use-after-free vulnerability has been identified in the Linux kernel, specifically related to a stale set_brightness_delay callback function. This flaw can lead to compromised system availability. Due to the nature of use-after-free vulnerabilities, successful exploitation could result in unpredictable system behavior, crashes, or a denial-of-service condition.


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.99, 5.15.22, 5.16.8, 5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a7de1002135cf94367748ffc695a29812d7633b5
CVE-2022-48738: kernel: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-20T00:00:00+00:00

A vulnerability was found in the Linux kernel's ASoC operations within the soc-ops.c file, where the function snd_soc_put_volsw() fails to validate the range of values being set, results in out-of-bounds values to be accepted,


Affected upstream versions: 3.15
Fixed upstream versions: 0, 4.14.265, 4.19.228, 4.9.300, 5.10.99, 5.15.22, 5.16.8, 5.17, 5.4.178
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 40f598698129b5ceaf31012f9501b775c7b6e57d
CVE-2022-48743: kernel: net: amd-xgbe: Fix skb data length underflow
Component: kernel
Severity: Low
CWE: CWE-124 (Buffer Underwrite ('Buffer Underflow'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: amd-xgbe: Fix skb data length underflow

There will be BUG_ON() triggered in include/linux/skbuff.h leading to
intermittent kernel panic, when the skb length underflow is detected.

Fix this by dropping the packet if such length underflows are seen
because of inconsistencies in the hardware descriptors.


Affected upstream versions: 4.9.19 < 4.9.300, 4.4.58 < 4.5, 4.10.7 < 4.11, 4.11
Fixed upstream versions: 0, 4.11, 4.14.265, 4.19.228, 4.5, 4.9.300, 5.10.97, 5.15.20, 5.16.6, 5.17, 5.4.177
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9924c80bd484340191e586110ca22bff23a49f2e
CVE-2022-48747: kernel: block: Fix wrong offset in bio_truncate()
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

block: Fix wrong offset in bio_truncate()

bio_truncate() clears the buffer outside of last block of bdev, however
current bio_truncate() is using the wrong offset of page. So it can
return the uninitialized data.

This happened when both of truncated/corrupted FS and userspace (via
bdev) are trying to read the last of bdev.


Affected upstream versions: 5.4.9 < 5.4.176, 5.5
Fixed upstream versions: 0, 5.10.96, 5.15.19, 5.16.5, 5.17, 5.4.176
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6cbf4c731d7812518cd857c2cfc3da9fd120f6ae
CVE-2022-48754: kernel: phylib: fix potential use-after-free
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 5.6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-06-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

phylib: fix potential use-after-free

Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call
to phy_device_reset(phydev) after the put_device() call in phy_detach().

The comment before the put_device() call says that the phydev might go
away with put_device().

Fix potential use-after-free by calling phy_device_reset() before
put_device().


Affected upstream versions: 4.16
Fixed upstream versions: 0, 4.19.228, 5.10.96, 5.15.19, 5.16.5, 5.17, 5.4.176
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 67d271760b037ce0806d687ee6057edc8afd4205
CVE-2022-48757: kernel: net: fix information leakage in /proc/net/ptype
Component: kernel
Severity: Low
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2024-06-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: fix information leakage in /proc/net/ptype

In one net namespace, after creating a packet socket without binding
it to a device, users in other net namespaces can observe the new
`packet_type` added by this packet socket by reading `/proc/net/ptype`
file. This is minor information leakage as packet socket is
namespace aware.

Add a net pointer in `packet_type` to keep the net namespace of
of corresponding packet socket. In `ptype_seq_show`, this net pointer
must be checked when it is not NULL.


Affected upstream versions: 2.6.26
Fixed upstream versions: 0, 4.14.265, 4.19.228, 4.4.302, 4.9.300, 5.10.96, 5.15.19, 5.16.5, 5.17, 5.4.176
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8f88c78d24f6f346919007cd459fd7e51a8c7779