huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-42305: kernel: ext4: check dot and dotdot of dx_root before making dir indexed
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: check dot and dotdot of dx_root before making dir indexed

Syzbot reports a issue as follows:
============================================
BUG: unable to handle page fault for address: ffffed11022e24fe
PGD 23ffee067 P4D 23ffee067 PUD 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0
Call Trace:
 <TASK>
 make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341
 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451
 ext4_rename fs/ext4/namei.c:3936 [inline]
 ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214
[...]
============================================

The immediate cause of this problem is that there is only one valid dentry
for the block to be split during do_split, so split==0 results in out of
bounds accesses to the map triggering the issue.

    do_split
      unsigned split
      dx_make_map
       count = 1
      split = count/2 = 0;
      continued = hash2 == map[split - 1].hash;
       ---> map[4294967295]

The maximum length of a filename is 255 and the minimum block size is 1024,
so it is always guaranteed that the number of entries is greater than or
equal to 2 when do_split() is called.

But syzbot's crafted image has no dot and dotdot in dir, and the dentry
distribution in dirblock is as follows:

  bus     dentry1          hole           dentry2           free
|xx--|xx-------------|...............|xx-------------|...............|
0   12 (8+248)=256  268     256     524 (8+256)=264 788     236     1024

So when renaming dentry1 increases its name_len length by 1, neither hole
nor free is sufficient to hold the new dentry, and make_indexed_dir() is
called.

In make_indexed_dir() it is assumed that the first two entries of the
dirblock must be dot and dotdot, so bus and dentry1 are left in dx_root
because they are treated as dot and dotdot, and only dentry2 is moved
to the new leaf block. That's why count is equal to 1.

Therefore add the ext4_check_dx_root() helper function to add more sanity
checks to dot and dotdot before starting the conversion to avoid the above
issue.


Affected upstream versions: 2.6.19
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b80575ffa98b5bb3a5d4d392bfe4c2e03e9557db
CVE-2024-42312: kernel: sysctl: always initialize i_uid/i_gid
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sysctl: always initialize i_uid/i_gid

Always initialize i_uid/i_gid inside the sysfs core so set_ownership()
can safely skip setting them.

Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of
i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when
set_ownership() was not implemented. It also missed adjusting
net_ctl_set_ownership() to use the same default values in case the
computation of a better value failed.


Affected upstream versions: 4.9.187 < 4.10, 4.14.135 < 4.15, 4.19.61 < 4.20, 5.1.20 < 5.2, 5.2.3 < 5.3, 5.3
Fixed upstream versions: 0, 4.10, 4.15, 4.20, 5.10.224, 5.15.165, 5.2, 5.3, 6.1.104, 6.10.3, 6.11, 6.6.45
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b2591c89a6e2858796111138c38fcb6851aa1955
CVE-2024-42315: kernel: exfat: fix potential deadlock on __exfat_get_dentry_set
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

A potential deadlock on __exfat_get_dentry_set was found in the Linux kernel. This may lead to decreased Availability.

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability.

Affected upstream versions: 5.10.190 < 5.10.232, 5.15.150 < 5.15.175, 6.2
Fixed upstream versions: 0, 5.10.232, 5.15.175, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 632fb232b6bbf8277edcbe9ecd4b4d98ecb122eb
CVE-2024-42316: kernel: mm/mglru: fix div-by-zero in vmpressure_calc_level()
Component: kernel
Severity: Moderate
CWE: CWE-369 (Divide By Zero)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/mglru: fix div-by-zero in vmpressure_calc_level()

evict_folios() uses a second pass to reclaim folios that have gone through
page writeback and become clean before it finishes the first pass, since
folio_rotate_reclaimable() cannot handle those folios due to the
isolation.

The second pass tries to avoid potential double counting by deducting
scan_control->nr_scanned.  However, this can result in underflow of
nr_scanned, under a condition where shrink_folio_list() does not increment
nr_scanned, i.e., when folio_trylock() fails.

The underflow can cause the divisor, i.e., scale=scanned+reclaimed in
vmpressure_calc_level(), to become zero, resulting in the following crash:

  [exception RIP: vmpressure_work_fn+101]
  process_one_work at ffffffffa3313f2b

Since scan_control->nr_scanned has no established semantics, the potential
double counting has minimal risks.  Therefore, fix the problem by not
deducting scan_control->nr_scanned in evict_folios().


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8de7bf77f21068a5f602bb1e59adbc5ab533509d
CVE-2024-42321: kernel: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE

The following splat is easy to reproduce upstream as well as in -stable
kernels. Florian Westphal provided the following commit:

  d1dab4f71d37 ("net: add and use __skb_get_hash_symmetric_net")

but this complementary fix has been also suggested by Willem de Bruijn
and it can be easily backported to -stable kernel which consists in
using DEBUG_NET_WARN_ON_ONCE instead to silence the following splat
given __skb_get_hash() is used by the nftables tracing infrastructure to
to identify packets in traces.

[69133.561393] ------------[ cut here ]------------
[69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/
[...]
[69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379
[69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0
[69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff
ff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff <0f> 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8
[69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246
[69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19
[69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418
[69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000
[69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400
[69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28
[69133.562020] FS:  00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000
[69133.562027] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0
[69133.562040] Call Trace:
[69133.562044]  <IRQ>
[69133.562049]  ? __warn+0x9f/0x1a0
[ 1211.841384]  ? __skb_flow_dissect+0x107e/0x2860
[...]
[ 1211.841496]  ? bpf_flow_dissect+0x160/0x160
[ 1211.841753]  __skb_get_hash+0x97/0x280
[ 1211.841765]  ? __skb_get_hash_symmetric+0x230/0x230
[ 1211.841776]  ? mod_find+0xbf/0xe0
[ 1211.841786]  ? get_stack_info_noinstr+0x12/0xe0
[ 1211.841798]  ? bpf_ksym_find+0x56/0xe0
[ 1211.841807]  ? __rcu_read_unlock+0x2a/0x70
[ 1211.841819]  nft_trace_init+0x1b9/0x1c0 [nf_tables]
[ 1211.841895]  ? nft_trace_notify+0x830/0x830 [nf_tables]
[ 1211.841964]  ? get_stack_info+0x2b/0x80
[ 1211.841975]  ? nft_do_chain_arp+0x80/0x80 [nf_tables]
[ 1211.842044]  nft_do_chain+0x79c/0x850 [nf_tables]


Affected upstream versions: 5.2
Fixed upstream versions: 0, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: eb03d9826aa646577342a952d658d4598381c035
CVE-2024-42322: kernel: ipvs: properly dereference pe in ip_vs_add_service
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

An improper dereference was found in the Linux kernel in ip_vs_add_service. This may lead to a crash.


Affected upstream versions: 4.7
Fixed upstream versions: 0, 5.10.237, 5.15.181, 6.1.119, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 36c997f1e03601475ad0fda0e0f59b7a209e756b
CVE-2024-42353: webob: WebOb's location header normalization during redirect leads to open redirect
Component: webob
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2024-08-14T00:00:00+00:00

A vulnerability was found in the WebOb package. WebOb normalizes the HTTP Location header using urlparse and urljoin. If the URL starts with //, urlparse treats the following part as the hostname, and replaces the original request's hostname. This issue, combined with user interaction, may become a vulnerability.


Affected upstream versions: <= 1.8.7
Fixed upstream versions: 1.8.8
Upstream repository: https://github.com/Pylons/webob
Upstream fix commit: f689bcf4f0a1f64f1735b1d5069aef5be6974b5b
CVE-2024-42472: flatpak: Access to files outside sandbox for apps using persistent= (--persist)
Component: flatpak
Severity: Important
CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'))
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2024-08-14T00:00:00+00:00

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the designated sandbox. As a result, the attacker could potentially manipulate the file system, leading to unauthorized actions that compromise the security and integrity of the system.

Statement: This vulnerability in Flatpak represents a significant severity issue due to its potential to undermine the core principles of application sandboxing, which are designed to isolate applications and protect the integrity and confidentiality of the system. By exploiting the persistent=subdir option, a malicious or compromised application can manipulate bind mounts via symlinks, thereby escaping the confines of its designated sandbox. This allows unauthorized access to the host filesystem, enabling the potential for unauthorized data manipulation, exfiltration, or system compromise. The risk is further exacerbated by the presence of a race condition, which can be exploited by running multiple instances of a malicious app concurrently.

Affected upstream versions: < 1.14.10, >= 1.15.0, < 1.15.10
Fixed upstream versions: v0.6.3
Upstream repository: https://github.com/containers/bubblewrap
Upstream fix commit: 68e75c3091c87583c28a439b45c45627a94d622c
CVE-2024-4340: sqlparse: parsing heavily nested list leads to denial of service
Component: sqlparse
Severity: Moderate
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-30T00:00:00+00:00

A flaw was found in sqlparse. This issue occurs in a heavily nested list in sqlparse.parse(), where a recursion error may be triggered, which can lead to a denial of service.


Affected upstream versions: <= 0.4.4
Fixed upstream versions: 0.5.0
Upstream repository: https://github.com/andialbrecht/sqlparse
Upstream fix commit: b4a39d9850969b4e1d6940d32094ee0b42a2cf03
CVE-2024-43788: webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule
Component: webpack
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2024-08-27T17:15:07.967000+00:00

A DOM Clobbering vulnerability was found in Webpack via `AutoPublicPathRuntimeModule`. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script through seemingly benign HTML markups in the webpage, for example, through a post or comment, and leverages the gadgets (pieces of JS code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to Cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or ID attributes.

Statement: The severity of this issue is classified as moderate rather than important due to the specific conditions required for exploitation. DOM Clobbering, while serious, can only be leveraged in environments where an attacker has the ability to inject unsanitized HTML attributes (e.g., `name` or `id`) into a web page. This limits the attack surface to applications that improperly sanitize user input and rely on Webpack-generated files. Furthermore, the exploitation depends on existing vulnerabilities in the sanitization process, rather than the direct execution of arbitrary scripts. As a result, while the issue can lead to XSS, its impact is constrained by the contextual requirement of HTML injection, lowering its overall severity compared to more direct XSS vectors.

Affected upstream versions: >= 5.0.0-alpha.0, < 5.94.0
Fixed upstream versions: v5.94.0
Upstream repository: https://github.com/webpack/webpack
Upstream fix commit: 955e057abc6cc83cbc3fa1e1ef67a49758bf5a61
CVE-2024-43796: express: Improper Input Handling in Express Redirects
Component: express
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2024-09-10T15:15:17.510000+00:00

A flaw was found in Express. This vulnerability allows untrusted code execution via passing untrusted user input to response.redirect(), even if the input is sanitized.


Affected upstream versions: < 4.20.0, >= 5.0.0-alpha.1, < 5.0.0
Fixed upstream versions: 4.20.0
Upstream repository: https://github.com/expressjs/express
Upstream fix commit: 54271f69b511fea198471e6ff3400ab805d6b553
CVE-2024-43799: send: Code Execution Vulnerability in Send Library
Component: send
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2024-09-10T15:15:17.727000+00:00

A flaw was found in the Send library. This vulnerability allows remote code execution via untrusted input passed to the SendStream.redirect() function.


Affected upstream versions: < 0.19.0
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/pillarjs/send
Upstream fix commit: ae4f2989491b392ae2ef3b0015a019770ae65d35
CVE-2024-43800: serve-static: Improper Sanitization in serve-static
Component: serve-static
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2024-09-10T15:15:17.937000+00:00

A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect().

Statement: rhdh-hub-container 1.2 and 1.3 have included patches for this vulnerability.

Affected upstream versions: < 1.16.0, >= 2.0.0, < 2.1.0
Fixed upstream versions: 1.16.0
Upstream repository: https://github.com/expressjs/serve-static
Upstream fix commit: 0c11fad159898cdc69fd9ab63269b72468ecaf6b
CVE-2024-43803: Bare Metal Operator: BMO can expose particularly named secrets from other namespaces via BMH CRD
Component: Bare Metal Operator
Severity: Moderate
CWE: CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere)
CVSS v3: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-09-03T19:15:14.800000+00:00

A flaw was found in the Bare Metal Operator (BMO). The BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost (BMH) CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for the Name and Namespace of the Secret, meaning that the baremetal-operator will read a Secret from any namespace. This flaw allows a user with access to create or edit a BareMetalHost can exfiltrate a Secret from another namespace by using it as the userData for provisioning some host, for example. Note that this need not be a real host; it could be a random VM.

Statement: This issue is considered moderate rather than important because it requires specific conditions to be exploited. The vulnerability relies on an attacker already having the ability to create or modify a BareMetalHost resource, which typically requires elevated permissions. Furthermore, the flaw only allows exfiltration of Secrets by referencing them in another namespace, but does not directly expose or escalate privileges across the cluster. It also doesn't impact the integrity or availability of the system but is limited to confidentiality concerns within a specific scope. Proper RBAC policies can mitigate this risk, reducing its overall severity.

Affected upstream versions: >= 0.7.0, < 0.8.0, >= 0.6.0, < 0.6.2, < 0.5.2
Fixed upstream versions: v0.6.2
Upstream repository: https://github.com/metal3-io/baremetal-operator
Upstream fix commit: 3af4882e9c5fadc1a7550f53daea21dccd271f74
CVE-2024-43820: kernel: dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
Component: kernel
Severity: Low
CWE: CWE-839 (Numeric Range Comparison Without Minimum Check)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume

rm-raid devices will occasionally trigger the following warning when
being resumed after a table load because DM_RECOVERY_RUNNING is set:

WARNING: CPU: 7 PID: 5660 at drivers/md/dm-raid.c:4105 raid_resume+0xee/0x100 [dm_raid]

The failing check is:
WARN_ON_ONCE(test_bit(MD_RECOVERY_RUNNING, &mddev->recovery));

This check is designed to make sure that the sync thread isn't
registered, but md_check_recovery can set MD_RECOVERY_RUNNING without
the sync_thread ever getting registered. Instead of checking if
MD_RECOVERY_RUNNING is set, check if sync_thread is non-NULL.


Affected upstream versions: 6.7.12 < 6.8, 6.8.3 < 6.9, 6.9
Fixed upstream versions: 0, 6.10.3, 6.11, 6.8, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a5c15a78c0e1631b7df822b56e8b6424e4d1ca3e
CVE-2024-43821: kernel: scsi: lpfc: Fix a possible null pointer dereference
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix a possible null pointer dereference

In function lpfc_xcvr_data_show, the memory allocation with kmalloc might
fail, thereby making rdp_context a null pointer. In the following context
and functions that use this pointer, there are dereferencing operations,
leading to null pointer dereference.

To fix this issue, a null pointer check should be added. If it is null,
use scnprintf to notify the user and return len.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 57600a7dd2b52c904f7c8d2cac0fd8c23868e680
CVE-2024-43823: kernel: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

A NULL pointer dereference was found in the Linux kernel in case of DT error in ks_pcie_setup_rc_app_regs(). This may lead to a crash.

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability.

Affected upstream versions: 5.10
Fixed upstream versions: 0, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bbba48ad67c53feea05936ea1e029dcca8057506
CVE-2024-43826: kernel: nfs: pass explicit offset/count to trace events
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

nfs in linux kernel permits using nfs_folio_length without locking the folio and without checking for null mapping. This can permit truncation and lead to kernel crash.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.10.3, 6.11, 6.6.130
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1562138b9cababf637eee485e98491f9206a990d
CVE-2024-43828: kernel: ext4: fix infinite loop when replaying fast_commit
Component: kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix infinite loop when replaying fast_commit

When doing fast_commit replay an infinite loop may occur due to an
uninitialized extent_status struct.  ext4_ext_determine_insert_hole() does
not detect the replay and calls ext4_es_find_extent_range(), which will
return immediately without initializing the 'es' variable.

Because 'es' contains garbage, an integer overflow may happen causing an
infinite loop in this function, easily reproducible using fstest generic/039.

This commit fixes this issue by unconditionally initializing the structure
in function ext4_es_find_extent_range().

Thanks to Zhang Yi, for figuring out the real problem!


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.224, 5.15.165, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5ed0496e383cb6de120e56991385dce70bbb87c1
CVE-2024-43830: kernel: leds: trigger: Unregister sysfs attributes before calling deactivate()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-08-17T00:00:00+00:00

leds in linux kernel permits calling sysfs attributes show/store functions after deactivate has been called.


Affected upstream versions: 4.19
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c3b7a650c8717aa89df318364609c86cbc040156