huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-36979: kernel: net: bridge: mst: fix vlan use-after-free
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-06-19T00:00:00+00:00

A use-after-free flaw was found in net/bridge/br_mst.c in the Linux kernel. This issue may lead to compromised Confidentiality and Integrity, and can crash.

Statement: Red Hat has determined this vulnerability to be moderate impact, as it is triggered within the bridge vlan processing context, a network-layer operation that mainly affects how vlan states are updated and does not directly/implicitly expose sensitive user-space memory, limiting the confidentiality impact. This processing context does not provide direct control over arbitrary memory writes, limiting the impact to integrity. The most likely result is a kernel panic or crash.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8ca9a750fc711911ef616ceb627d07357b04545e
CVE-2024-37298: gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization
Component: gorilla/schema
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-30T00:00:00+00:00

A flaw was found in the gorilla/schema package. Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could trigger memory exhaustion and lead to a denial of service.

Statement: This vulnerability in the gorilla/schema package is a high-severity issue due to its potential to cause a Denial of Service (DoS) attack through memory exhaustion. The schema.Decoder.Decode() function, when processing a struct with fields of type []struct{...}, is susceptible to malicious input that exploits sparse slice functionality. This can result in excessive memory allocations, overwhelming the system's resources and rendering the application unresponsive.

The majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a "Moderate" level of impact.

Affected upstream versions: < 1.4.1
Fixed upstream versions: v1.4.1
Upstream repository: https://github.com/gorilla/schema
Upstream fix commit: cd59f2f12cbdfa9c06aa63e425d1fe4a806967ff
CVE-2024-37356: kernel: tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-06-21T00:00:00+00:00

A security vulnerability has been identified in the TCP networking implementation of the Linux kernel. Specifically, the dctcp_update_alpha() function is susceptible to a shift-out-of-bounds condition. This flaw could potentially be exploited to cause unexpected behavior or a denial-of-service.


Affected upstream versions: 3.18
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 06d0fe049b51b0a92a70df8333fd85c4ba3eb2c6
CVE-2024-37370: krb5: GSS message token handling
Component: krb5
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-06-27T00:00:00+00:00

A vulnerability was found in the MIT Kerberos 5 GSS krb5 wrap token, where an attacker can modify the plaintext Extra Count field, causing the unwrapped token to appear truncated to the application, occurs when the attacker alters the token data during transmission which can lead to improper handling of authentication tokens.

Statement: This vulnerability has an ability to disrupt authentication process and attackers able to alter the token data durning the transmission which leads to disruption in service and an attacker can void the integrity by altering the token durning the transmission for authentication process. This has been rated as moderate by Redhat as the vulnerability cannot be exploited in a way that it leads to a loss of availability or integrity,when in transmission token count field can be changed making the token appear truncated.

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.21.3-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 55fbf435edbe2e92dd8101669b1ce7144bc96fef
CVE-2024-37371: krb5: GSS message token handling
Component: krb5
Severity: Moderate
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-27T00:00:00+00:00

A vulnerability was found in the MIT Kerberos 5 GSS krb5 wrap token, where an attacker can modify the plaintext Extra Count field, causing the unwrapped token to appear truncated to the application, occurs when the attacker alters the token data during transmission which can lead to improper handling of authentication tokens.

Statement: This issue is classified as a moderate severity vulnerability because, while it allows an attacker to modify the plaintext "Extra Count" field of a GSS krb5 wrap token, the impact is primarily limited to token truncation at the application layer. This truncation can disrupt services but does not directly lead to a full compromise of confidentiality or integrity. The attack requires that the attacker already has access to a valid token transmission to modify, meaning it cannot be exploited remotely without first obtaining or intercepting a valid token.

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.21.3-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 55fbf435edbe2e92dd8101669b1ce7144bc96fef
CVE-2024-37890: nodejs-ws: denial of service when handling a request with many HTTP headers
Component: nodejs-ws
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-16T00:00:00+00:00

A flaw was found in the Node.js WebSocket library (ws). A request with several headers exceeding the 'server.maxHeadersCount' threshold could be used to crash a ws server, leading to a denial of service.


Affected upstream versions: >= 2.1.0, < 5.2.4, >= 6.0.0, < 6.2.3, >= 7.0.0, < 7.5.10, >= 8.0.0, < 8.17.1
Fixed upstream versions: 7.5.10
Upstream repository: https://github.com/websockets/ws
Upstream fix commit: 22c28763234aa75a7e1b76f5c01c181260d7917f
CVE-2024-37891: urllib3: proxy-authorization request header is not stripped during cross-origin redirects
Component: urllib3
Severity: Moderate
CWE: CWE-669 (Incorrect Resource Transfer Between Spheres)
CVSS v3: 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-06-17T00:00:00+00:00

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the `Proxy-Authorization` HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects.

Statement: .egg-info packages, like urllib3-1.24.2-py3.6.egg-info, store only metadata such as package version and dependencies and do not contain any affected codebase.

Affected upstream versions: < 1.26.19, >= 2.0.0, < 2.2.2
Fixed upstream versions: 2.2.2
Upstream repository: https://github.com/urllib3/urllib3
Upstream fix commit: accff72ecc2f6cf5a76d9570198a93ac7c90270e
CVE-2024-37894: squid: Out-of-bounds write error may lead to Denial of Service
Component: squid
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H)
Public date: 2024-06-25T00:00:00+00:00

A flaw was found in Squid. An out-of-bounds write can be triggered when an Edge Side Includes (ESI) variable is assigned to a value not in the standard ASCII range, for example, multi-byte characters. This flaw allows a trusted server to crash Squid while processing an ESI response content, resulting in a denial of service.

Statement: Squid as shipped in Red Hat Enterprise Linux 8 and 9 is vulnerable to this vulnerability as the ESI support is enabled by default.

This flaw requires Squid to be in a reverse proxy configuration and using an ESI variable with non ASCII characters, allowing a trusted server to cause a denial of service. For these reasons, this flaw was rated with a Moderate severity.

Affected upstream versions: >= 3.0, <= 3.5.28, >= 4.0, <= 4.16, >= 5.0, <= 5.9, >= 6.0, <= 6.9
Upstream repository: https://github.com/squid-cache/squid
Upstream fix commit: f411fe7d75197852f0e5ee85027a06d58dd8df4c
CVE-2024-38384: kernel: blk-cgroup: fix list corruption from reorder of WRITE -&gt;lqueued
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix list corruption from reorder of WRITE ->lqueued

__blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start
is being executed.

If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in
the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one
stat instance being added in blk_cgroup_bio_start(), then the local
list in __blkcg_rstat_flush() could be corrupted.

Fix the issue by adding one barrier.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 714e59b5456e4d6e4295a9968c564abe193f461c
CVE-2024-38388: kernel: ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup

Use the control private_free callback to free the associated data
block. This ensures that the memory won't leak, whatever way the
control gets destroyed.

The original implementation didn't actually remove the ALSA
controls in hda_cs_dsp_control_remove(). It only freed the internal
tracking structure. This meant it was possible to remove/unload the
amp driver while leaving its ALSA controls still present in the
soundcard. Obviously attempting to access them could cause segfaults
or at least dereferencing stale pointers.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.93, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 191dc1b2ff0fb35e7aff15a53224837637df8bff
CVE-2024-38428: wget: Misinterpretation of input may lead to improper behavior
Component: wget
Severity: Moderate
CWE: CWE-115 (Misinterpretation of Input)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2024-06-01T00:00:00+00:00

A flaw was found in wget. Incorrect handling of semicolons in the userinfo subcomponent of a URI allows it to be misinterpreted as part of the host subcomponent, potentially exposing user credentials.

Statement: Only calls to Wget using semicolons in the userinfo subcomponent of a URI are vulnerable to this issue. However, this is allowed by the standard and is supported by other similar tools.
To exploit this issue, an attacker must convince a local user into running Wget with a specially crafted userinfo subcomponent, limiting the exposure of this vulnerability.
For these reasons, this vulnerability has been rated with a moderate severity.

Additionally, this vulnerability only affects wget 1.x, wget2 is not affected.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/wget.git
Upstream fix commit: ed0c7c7e0e8f7298352646b2fd6e06a11e242ace
CVE-2024-38475: httpd: Improper escaping of output in mod_rewrite
Component: httpd
Severity: Important
CWE: CWE-116 (Improper Encoding or Escaping of Output)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2024-07-01T00:00:00+00:00

A flaw was found in the mod_rewrite module of httpd. Improper escaping of output allows an attacker to map URLs to filesystem locations permitted to be served by the server but are not intentionally or directly reachable by any URL. This issue results in code execution or source code disclosure.

Statement: This issue affects configurations with substitution rules used in the RewriteRule directive using backreferences or variables as the first segment of the substitution.

Additionally, this flaw requires mod_rewrite to be loaded and used. This module can be disabled if its functionality is not needed.

Red Hat Enterprise Linux 6 is not affected by this vulnerability because the vulnerable code was introduced in a newer version of httpd.

Affected upstream versions: 2.4.0 <= 2.4.59
Upstream repository: https://github.com/apache/httpd
Upstream fix commit: 9a6157d1e2f7ab15963020381054b48782bc18cf
CVE-2024-38538: kernel: net: bridge: xmit: make sure we have at least eth header len bytes
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

A vulnerability was found in the Linux kernel in the net: bridge component, where the xmit function in the bridge device could trigger an uninitialized value error if a short skb (less than the required ETH_HLEN bytes) is sent. This condition could cause unexpected behavior due to insufficient checks before pulling data from the packet, potentially leading to data inconsistency.

Statement: This vulnerability in is classified as moderate severity because it requires local access and specific packet manipulation to exploit. While it may impact system stability, it does not broadly compromise system security, as its effects remain limited to certain packet-handling scenarios.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.19.324, 5.10.230, 5.15.172, 5.4.286, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3e01fc3c66e65d9afe98f1489047a1b2dd8741ca
CVE-2024-38540: kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

in linux kernel, shift undefined behavior occurs in bnxt_qplib_alloc_init_hwq with hwq_attr->aux_depth of nonzero and hwq_attr->aux_stride of zero.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.15.181, 6.1.117, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 66a9937187ac9b5c5ffff07b8b284483e56804d1
CVE-2024-38541: kernel: of: module: add buffer overflow check in of_modalias()
Component: kernel
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

A buffer overflow flaw was found in of_modalias() in the Linux kernel, occurring after the first snprintf() call. This issue could result in loss of availability of the system.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.238, 5.15.182, 5.4.294, 6.1.136, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 46795440ef2b4ac919d09310a69a404c5bc90a88
CVE-2024-38543: kernel: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure

The kcalloc() in dmirror_device_evict_chunk() will return null if the
physical memory has run out.  As a result, if src_pfns or dst_pfns is
dereferenced, the null pointer dereference bug will happen.

Moreover, the device is going away.  If the kcalloc() fails, the pages
mapping a chunk could not be evicted.  So add a __GFP_NOFAIL flag in
kcalloc().

Finally, as there is no need to have physically contiguous memory, Switch
kcalloc() to kvcalloc() in order to avoid failing allocations.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1a21fdeea502658e315bd939409b755974f4fb64
CVE-2024-38544: kernel: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt

In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the
resp_pkts queue and then a decision is made whether to run the completer
task inline or schedule it. Finally the skb is dereferenced to bump a 'hw'
performance counter. This is wrong because if the completer task is
already running in a separate thread it may have already processed the skb
and freed it which can cause a seg fault.  This has been observed
infrequently in testing at high scale.

This patch fixes this by changing the order of enqueuing the packet until
after the counter is accessed.


Affected upstream versions: 4.12
Fixed upstream versions: 0, 5.10.227, 5.15.168, 5.4.285, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c91fb72a2ca6480d8d77262eef52dc5b178463a3
CVE-2024-38555: kernel: net/mlx5: Discard command completions in internal error
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

A use-after-free vulnerability has been discovered in the Linux kernel within the drivers/net/ethernet/mellanox/mlx5/core/cmd.c component, specifically related to the Mellanox network driver. This flaw can lead to compromised system availability. Successful exploitation could result in unpredictable behavior and denial-of-service conditions.


Affected upstream versions: 5.10.20 < 5.10.219, 5.11.3 < 5.12, 5.12
Fixed upstream versions: 0, 5.10.219, 5.12, 5.15.161, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f6fbb8535e990f844371086ab2c1221f71f993d3
CVE-2024-38556: kernel: net/mlx5: Add a timeout to acquire the command queue semaphore
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Add a timeout to acquire the command queue semaphore

Prevent forced completion handling on an entry that has not yet been
assigned an index, causing an out of bounds access on idx = -22.
Instead of waiting indefinitely for the sem, blocking flow now waits for
index to be allocated or a sem acquisition timeout before beginning the
timer for FW completion.

Kernel log example:
mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion


Affected upstream versions: 5.4.174 < 5.5, 5.10.94 < 5.11, 5.15.17 < 5.16, 5.16.3 < 5.17, 5.17
Fixed upstream versions: 0, 5.11, 5.16, 5.17, 5.5, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4baae687a20ef2b82fde12de3c04461e6f2521d6
CVE-2024-38558: kernel: net: openvswitch: fix overwriting ct original tuple for ICMPv6
Component: kernel
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix overwriting ct original tuple for ICMPv6

OVS_PACKET_CMD_EXECUTE has 3 main attributes:
 - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format.
 - OVS_PACKET_ATTR_PACKET - Binary packet content.
 - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet.

OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure
with the metadata like conntrack state, input port, recirculation id,
etc.  Then the packet itself gets parsed to populate the rest of the
keys from the packet headers.

Whenever the packet parsing code starts parsing the ICMPv6 header, it
first zeroes out fields in the key corresponding to Neighbor Discovery
information even if it is not an ND packet.

It is an 'ipv6.nd' field.  However, the 'ipv6' is a union that shares
the space between 'nd' and 'ct_orig' that holds the original tuple
conntrack metadata parsed from the OVS_PACKET_ATTR_KEY.

ND packets should not normally have conntrack state, so it's fine to
share the space, but normal ICMPv6 Echo packets or maybe other types of
ICMPv6 can have the state attached and it should not be overwritten.

The issue results in all but the last 4 bytes of the destination
address being wiped from the original conntrack tuple leading to
incorrect packet matching and potentially executing wrong actions
in case this packet recirculates within the datapath or goes back
to userspace.

ND fields should not be accessed in non-ND packets, so not clearing
them should be fine.  Executing memset() only for actual ND packets to
avoid the issue.

Initializing the whole thing before parsing is needed because ND packet
may not contain all the options.

The issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't
affect packets entering OVS datapath from network interfaces, because
in this case CT metadata is populated from skb after the packet is
already parsed.


Affected upstream versions: 4.11
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6a51ac92bf35d34b4996d6eb67e2fe469f573b11
CVE-2024-38559: kernel: scsi: qedf: Ensure the copied buf is NUL terminated
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: qedf: Ensure the copied buf is NUL terminated

Currently, we allocate a count-sized kernel buffer and copy count from
userspace to that buffer. Later, we use kstrtouint on this buffer but we
don't ensure that the string is terminated inside the buffer, this can
lead to OOB read when using kstrtouint. Fix this issue by using
memdup_user_nul instead of memdup_user.


Affected upstream versions: 4.11
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1f84a2744ad813be23fc4be99fb74bfb24aadb95