huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-46858: kernel: mptcp: pm: Fix uaf in __timer_delete_sync
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-09-27T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s Multipath TCP (MPTCP) subsystem. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Statement: Actual only for latest version of Red Hat Enterprise Linux 9 and latest version of Red Hat Enterprise Linux 8.

Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.227, 5.15.168, 6.1.111, 6.10.11, 6.11, 6.6.52
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0e7814b028cd50b3ff79659d23dfa9da6a1e75e1
CVE-2024-46864: kernel: x86/hyperv: fix kexec crash due to VP assist page corruption
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-27T00:00:00+00:00

in cpuhp_setup_state() a requisite condition of "hyperv_init_cpuhp > 0" for the hyperv case will never be true, and then hv_cpu_die() won't be called on all CPUs and the VP assist page will not be reset. This leads to corruption of the previous VP assist page and ultimately panic if the kexec kernel is using that memory. The hyperv_init_cpuhp condition should be removed entirely.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.10.11, 6.11, 6.6.52
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2ae1beb3ab4f28868cc5d1541d05e1fbee3ad825
CVE-2024-46871: kernel: drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
Component: kernel
Severity: Moderate
CWE: CWE-129 (Improper Validation of Array Index)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-09T00:00:00+00:00

A flaw was found in the AMD Radeon graphics card driver in the Linux kernel. Out-of-bounds access can be triggered due to arrays being created based on the wrong number of maximum DMUB notification types available, resulting in a denial of service.

Statement: Under normal conditions, unprivileged local users cannot trigger this issue and the system must have an AMD GPU, limiting the impact of this vulnerability.

Additionally, this issue is known to impact only the availability of the system with no other relevant security impact.

Affected upstream versions: 4.15
Fixed upstream versions: 0, 5.15.174, 6.1.109, 6.10.9, 6.11, 6.6.50
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e1896f381d27466c26cb44b4450eae05cd59dfd0
CVE-2024-46951: ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space
Component: ghostscript
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-11-10T00:00:00+00:00

A flaw was found in Artifex Ghostscript's psi/zcolor.c component. This vulnerability allows arbitrary code execution via an unchecked implementation pointer in the Pattern color space.


Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-10.05.0
Upstream repository: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git
Upstream fix commit: f49812186baa7d1362880673408a6fbe8719b4f8
CVE-2024-46952: ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling
Component: ghostscript
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-11-10T00:00:00+00:00

A flaw was found in Artifex Ghostscript's PDF XRef stream handling. This vulnerability allows a buffer overflow via crafted values in the W array of a PDF XRef stream.


Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-10.05.0
Upstream repository: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git
Upstream fix commit: b1f0827c30f59a2dcbc8a39e42cace7a1de35f7f
CVE-2024-46953: ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript
Component: ghostscript
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-11-10T00:00:00+00:00

A flaw was found in Artifex Ghostscript base/gsdevice.c. This vulnerability allows path truncation, path traversal, and possible code execution via an integer overflow when parsing the filename format string for the output filename.


Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-10.05.0
Upstream repository: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git
Upstream fix commit: 1f21a45df0fa3abec4cff12951022b192dda3c00
CVE-2024-46954: ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding
Component: ghostscript
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-11-10T00:00:00+00:00

A flaw was found in Ghostscript/base/gp_utf8.c. This vulnerability allows directory traversal via overlong UTF-8 encoding, potentially leading to unauthorized access to filesystem directories.


Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-10.05.0
Upstream repository: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git
Upstream fix commit: 55f587dd039282316f512e1bea64218fd991f934
CVE-2024-46956: ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution
Component: ghostscript
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-11-10T00:00:00+00:00

A flaw was found in Artifex Ghostscript's psi/zfile.c component. This vulnerability allows arbitrary code execution via out-of-bounds data access.


Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-10.05.0
Upstream repository: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git
Upstream fix commit: f4151f12db32cd3ed26c24327de714bf2c3ed6ca
CVE-2024-47068: rollup: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
Component: rollup
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-09-23T16:15:06.947000+00:00

A flaw was found in the Rollup module bundler for JavaScript. Certain versions are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` such as `import.meta.url` in the `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements are present, for example, an `img` tag with an unsanitized `name` attribute.

Statement: This vulnerability is classified as moderate severity rather than important because it requires a specific and relatively uncommon attack vector to exploit—namely, attacker-controlled scriptless HTML elements, such as an unsanitized name attribute in an img tag, which are typically less prevalent in well-maintained web applications. Additionally, the impact is limited to scenarios where import.meta is improperly handled in specific module formats (`cjs`, `umd`, `iife`), and the vulnerability can only lead to cross-site scripting (XSS) under specific conditions.

Affected upstream versions: >= 3.0.0, < 3.29.5, >= 4.0.0, < 4.22.4, < 2.79.2
Fixed upstream versions: v3.29.5
Upstream repository: https://github.com/rollup/rollup
Upstream fix commit: 2ef77c00ec2635d42697cff2c0567ccc8db34fb4
CVE-2024-47072: com.thoughtworks.xstream: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream
Component: com.thoughtworks.xstream
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-11-07T23:38:52.978000+00:00

A flaw was found in the XStream library. A remote attacker may trigger a denial of service by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. This issue may lead to the termination of the application.

Statement: This vulnerability in XStream is considered an Important severity rather than Moderate because it exposes applications to a denial of service (DoS) attack with relative ease. By exploiting the flaw in the `BinaryStreamDriver`, an attacker can manipulate the binary input stream to trigger a stack overflow, which terminates the application unexpectedly. Unlike moderate vulnerabilities, which may require specific conditions or limited privileges, this flaw enables remote attackers to forcefully terminate services by crafting malicious input, impacting system availability. Additionally, the vulnerability’s reliance on a common serialization mechanism elevates the risk, as it may affect applications across various environments and industries where XStream is deployed.

Affected upstream versions: < 1.4.21
Fixed upstream versions: XSTREAM_1_4_21
Upstream repository: https://github.com/x-stream/xstream
Upstream fix commit: bb838ce2269cac47433e31c77b2b236466e9f266
CVE-2024-47076: cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes
Component: cups-filters
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)
Public date: 2024-09-26T20:00:00+00:00

A flaw was found in OpenPrinting CUPS. In certain conditions, a remote attacker can add a malicious printer or directly hijack an existing printer by replacing the valid IPP URL with a malicious one. Also, it is possible that due to a lack of validation of IPP attributes returned by the server, this issue allows attacker-controlled data to be used on the rest of the CUPS system.


Affected upstream versions: <= 2.1b1
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/OpenPrinting/libcupsfilters
Upstream fix commit: 95576ec3d20c109332d14672a807353cdc551018
CVE-2024-47081: requests: Requests vulnerable to .netrc credentials leak via malicious URLs
Component: requests
Severity: Moderate
CWE: CWE-522 (Insufficiently Protected Credentials)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2025-06-09T17:57:47.731000+00:00

A flaw was found in the Requests HTTP library. This vulnerability allows leakage of .netrc credentials to third parties via maliciously crafted URLs that exploit a URL parsing issue.


Affected upstream versions: < 2.32.4
Fixed upstream versions: v2.32.4
Upstream repository: https://github.com/psf/requests
Upstream fix commit: 96ba401c1296ab1dda74a2365ef36d88f7d144ef
CVE-2024-47141: kernel: pinmux: Use sequential access to access desc->pinmux data
Component: kernel
Severity: Moderate
CWE: CWE-667 (Improper Locking)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-01-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pinmux: Use sequential access to access desc->pinmux data

When two client of the same gpio call pinctrl_select_state() for the
same functionality, we are seeing NULL pointer issue while accessing
desc->mux_owner.

Let's say two processes A, B executing in pin_request() for the same pin
and process A updates the desc->mux_usecount but not yet updated the
desc->mux_owner while process B see the desc->mux_usecount which got
updated by A path and further executes strcmp and while accessing
desc->mux_owner it crashes with NULL pointer.

Serialize the access to mux related setting with a mutex lock.

	cpu0 (process A)			cpu1(process B)

pinctrl_select_state() {		  pinctrl_select_state() {
  pin_request() {				pin_request() {
  ...
						 ....
    } else {
         desc->mux_usecount++;
    						desc->mux_usecount && strcmp(desc->mux_owner, owner)) {

         if (desc->mux_usecount > 1)
               return 0;
         desc->mux_owner = owner;

  }						}


Affected upstream versions: 3.10
Fixed upstream versions: 0, 6.12.5, 6.13, 6.6.66
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b
CVE-2024-47175: cups: libppd: remote command injection via attacker controlled data in PPD file
Component: cups
Severity: Important
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 7.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)
Public date: 2024-09-26T20:00:00+00:00

A security vulnerability was found in OpenPrinting CUPS.

The function ppdCreatePPDFromIPP2 in the libppd library is responsible for generating a PostScript Printer Description (PPD) file based on attributes retrieved from an Internet Printing Protocol (IPP) response. Essentially, it takes printer information, usually obtained via IPP, and creates a corresponding PPD file that describes the printer's capabilities (such as supported media sizes, resolutions, color modes, etc.).

PPD files are used by printing systems like CUPS (Common Unix Printing System) to communicate with and configure printers. They provide a standardized format that allows different printers to work with the printing system in a consistent way.

The ppdCreatePPDFromIPP2 function in libppd doesn't properly check or clean IPP attributes before writing them to a temporary PPD file. This means that a remote attacker, who has control of or has hijacked an exposed printer (through UPD or mDNS), could send a harmful IPP attribute and potentially insert malicious commands into the PPD file.

Statement: RHCOS and RHEL include libs-cups as a build-time dependency. However, the vulnerability is not exploitable with just the client libraries unless a print server based on OpenPrinting is actively running.

RHEL and RHCOS does not have cups-browsed enabled by default so the impact for those are set to 'Low'

Affected upstream versions: <= 2.1b1
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/OpenPrinting/libppd
Upstream fix commit: d681747ebf12602cb426725eb8ce2753211e2477
CVE-2024-47176: cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source
Component: cups-browsed
Severity: Important
CWE: CWE-940 (Improper Verification of Source of a Communication Channel)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-09-26T20:00:00+00:00

A security issue has been identified in OpenPrinting CUPS.

The function ppdCreatePPDFromIPP2 in the libppd library is responsible for generating a PostScript Printer Description (PPD) file based on attributes retrieved from an Internet Printing Protocol (IPP) response. Essentially, it takes printer information, usually obtained via IPP, and creates a corresponding PPD file that describes the printer's capabilities (such as supported media sizes, resolutions, color modes, etc.).

PPD files are used by printing systems like CUPS (Common Unix Printing System) to communicate with and configure printers. They provide a standardized format that allows different printers to work with the printing system in a consistent way.

A security issue was discovered in OpenPrinting CUPS. The `cups-browsed` component is responsible for discovering printers on a network and adding them to the system. In order to do so, the service uses two distinct protocols. For the first one, the service binds on all interfaces on UDP port 631 and accepts a custom packet from any untrusted source. This is exploitable from outside the LAN if the computer is exposed on the public internet. The service also listens for DNS-SD / mDNS advertisements trough AVAHI. In both cases, when a printer is discovered by either the UDP packet or mDNS, its IPP or IPPS url is automatically contacted by cups-browsed and a `Get-Printer-Attributes` request is sent to it which can leak potentially sensitive system information to an attacker via the User-Agent header.

Statement: The cups-browsed service is disabled by default on all versions of RHEL.

Affected upstream versions: <= 2.0.1
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/OpenPrinting/cups-browsed
Upstream fix commit: 1debe6b140c37e0aa928559add4abcc95ce54aa2
CVE-2024-47191: oath-toolkit: Local root exploit in a PAM module
Component: oath-toolkit
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2024-10-04T00:00:00+00:00

A vulnerability was found in a PAM module, the oath-toolkit. The module gained a feature that allowed placing the OTP state file, called the usersfile, in the home directory of the to-be-authenticated user. The PAM module performed unsafe file operations in the users' home directories. Since PAM stacks typically run as root, this flaw allows a malicious user to jeopardize an environment.

Statement: This vulnerability is rated Important rather than Moderate due to its potential for full privilege escalation without requiring complex attack vectors. The flaw in the `pam_oath.so` module allows unprivileged users to manipulate file operations within their home directories to exploit symlink attacks, enabling them to overwrite critical system files, such as `/etc/shadow`, with root-level privileges. Since PAM stacks typically run as root, this exploitation does not involve race conditions or reliance on environmental factors, making the attack straightforward and highly impactful.

Ceph uses an affected oath-toolkit version. However, it does not use the affected methods and it is not vulnerable to this issue.

Affected upstream versions: n/a
Fixed upstream versions: oath-toolkit-2-6-7
Upstream repository: https://gitlab.com/oath-toolkit/oath-toolkit
Upstream fix commit: 60d9902b5c20f27e70f8e9c816bfdc0467567e1a
CVE-2024-47220: WEBrick: HTTP request smuggling
Component: WEBrick
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2024-09-22T01:15:11.950000+00:00

A flaw was found in the webrick toolkit. This issue occurs because the server incorrectly handles requests with both Content-Length and Transfer-Encoding headers. This can allow an attacker to sneak in an extra request such as GET /admin after the normal request POST /user. As a result, unauthorized users can access restricted areas like /admin by POST /user.

Statement: This CVE is rated as having Moderate impact because Webrick should not be used in production. It is only still maintained because there are other gems relying on it, most of which do so only for testing, and only because it is a pure ruby implementation and it was shipped with Ruby in the past.

Affected upstream versions: <= v1.8.1
Upstream repository: https://github.com/ruby/webrick
Upstream fix commit: d88321da45dcd230ac2b4585cad4833d6d5e8841
CVE-2024-4741: openssl: Use After Free with SSL_free_buffers
Component: openssl
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2024-05-28T00:00:00+00:00

A use-after-free vulnerability was found in OpenSSL. Calling the OpenSSL API SSL_free_buffers function may cause memory to be accessed that was previously freed in some situations.

Statement: This vulnerability is classified as low severity rather than moderate because it only affects applications that explicitly call SSL_free_buffers, a rarely used OpenSSL function. 

The issue arises in specific conditions where the function is called while a buffer is still in use, leading to a potential use-after-free scenario. However, exploitation is significantly constrained because

(1) an application must intentionally invoke this function, which is not typical in common OpenSSL usage, 

(2) triggering the vulnerability requires precise timing and conditions where partially processed records remain unread or incomplete, and 

(3) there are no known active exploits leveraging this issue. 

Given these factors, while the bug could theoretically lead to crashes or corruption, the practical risk of widespread exploitation remains minimal.

Affected upstream versions: 3.3.0 < 3.3.1, 3.2.0 < 3.2.2, 3.1.0 < 3.1.6, 3.0.0 < 3.0.14, 1.1.1 < 1.1.1y
Fixed upstream versions: 1.1.1y, 3.0.14, 3.1.6, 3.2.2, 3.3.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: e5093133c35ca82874ad83697af76f4b0f7e3bd8
CVE-2024-47535: netty: Denial of Service attack on windows app using Netty
Component: netty
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-11-12T15:50:08.334000+00:00

A flaw was found in Netty. An unsafe reading of the environment file could potentially cause a denial of service. When loaded on a Windows application, Netty attempts to load a file that does not exist. If an attacker creates a large file, the Netty application crashes.


Affected upstream versions: < 4.1.115
Fixed upstream versions: netty-4.1.115.Final
Upstream repository: https://github.com/netty/netty
Upstream fix commit: fbf7a704a82e7449b48bd0bbb679f5661c6d61a3
CVE-2024-47660: kernel: fsnotify: clear PARENT_WATCHED flags lazily
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: clear PARENT_WATCHED flags lazily

In some setups directories can have many (usually negative) dentries.
Hence __fsnotify_update_child_dentry_flags() function can take a
significant amount of time. Since the bulk of this function happens
under inode->i_lock this causes a significant contention on the lock
when we remove the watch from the directory as the
__fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask()
races with __fsnotify_update_child_dentry_flags() calls from
__fsnotify_parent() happening on children. This can lead upto softlockup
reports reported by users.

Fix the problem by calling fsnotify_update_children_dentry_flags() to
set PARENT_WATCHED flags only when parent starts watching children.

When parent stops watching children, clear false positive PARENT_WATCHED
flags lazily in __fsnotify_parent() for each accessed child.


Affected upstream versions: 2.6.38
Fixed upstream versions: 0, 5.10.226, 5.15.167, 6.1.109, 6.10.9, 6.11, 6.6.50
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3f3ef1d9f66b93913ce2171120d9226b55acd41d
CVE-2024-47668: kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()

If we need to increase the tree depth, allocate a new node, and then
race with another thread that increased the tree depth before us, we'll
still have a preallocated node that might be used later.

If we then use that node for a new non-root node, it'll still have a
pointer to the old root instead of being zeroed - fix this by zeroing it
in the cmpxchg failure path.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.226, 5.15.167, 5.4.284, 6.1.110, 6.10.10, 6.11, 6.6.51
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0f27f4f445390cb7f73d4209cb2bf32834dc53da