huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-43842: kernel: wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()
Component: kernel
Severity: Moderate
CWE: CWE-129 (Improper Validation of Array Index)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)
Public date: 2024-08-17T00:00:00+00:00

A possible array out-of-bounds read flaw was found in the Linux kernel. This issue may lead to a crash.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a2a095c08b95372d6d0c5819b77f071af5e75366
CVE-2024-43846: kernel: lib: objagg: Fix general protection fault
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

linux kernel's lib objagg can incorrectly permit object nesting in an unallowed circumstance, based on lack of appropriate checks stemming from assumption violations. The incorrect object creation from this assumption can lead to general protection fault.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8161263362154cbebfbf4808097b956a6a8cb98a
CVE-2024-43853: kernel: cgroup/cpuset: Prevent UAF in proc_cpuset_show()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

A use-after-free (UAF) flaw was found in the proc_cpuset_show() function. This issue can allow an attacker to access the css of the root caused by a race condition when the cgroup_root should be freed when it is unmounted from the resource.

Statement: The cpuset resource can only impact the availability of the system by skipping limitations from the CPU and causing a Denial of Service attack.

Affected upstream versions: 4.6
Fixed upstream versions: 0, 4.19.321, 5.10.225, 5.15.166, 5.4.283, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 27d6dbdc6485d68075a0ebf8544d6425c1ed84bb
CVE-2024-43854: kernel: block: initialize integrity buffer to zero before writing it to media
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

A flaw was found in the Linux kernel, where it initialized the integrity buffer to zero before writing it to media. Metadata added by bio_integrity_prep uses plain kmalloc, which leads to random kernel memory being written. Protection Information (PI) metadata is limited to the app tag not used by kernel-generated metadata, but for non-PI metadata, the entire buffer leaks kernel memory, potentially exposing sensitive internal kernel data.


Affected upstream versions: 2.6.27
Fixed upstream versions: 0, 4.19.322, 5.10.226, 5.15.165, 5.4.284, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9f4af4cf08f9a0329ade3d938f55d2220c40d0a6
CVE-2024-43855: kernel: md: fix deadlock between mddev_suspend and flush bio
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

A denial of service vulnerability exists in the Linux kernel. A deadlock condition occurs when mddev is being suspended while some of the flush bio is in progress, leading to a loss of availability.


Affected upstream versions: 6.1.75 < 6.1.103, 6.6.14 < 6.6.44, 6.7.2 < 6.8, 6.8
Fixed upstream versions: 0, 6.1.103, 6.10.3, 6.11, 6.6.44, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 32226070813140234b6c507084738e8e8385c5c6
CVE-2024-43856: kernel: dma: fix call order in dmam_free_coherent
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

A vulnerability was found in the Linux kernel's dma subsystem in the dmam_free_coherent() function where a race condition is possible between the calls to dmam_free_coherent() and devres_destroy() leading to a double entry in the devres list. This flaw could potentially lead to memory corruption or unexpected behavior.

Statement: Red Hat believes this vulnerability to be of moderate impact because elevated privileges are required to trigger this vulnerability, seeing as DMA is low-level memory management operation typically limited to kernel-mode operations, and drivers often need elevated privileges to interact with hardware.

Affected upstream versions: 2.6.21
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fe2d246080f035e0af5793cb79067ba125e4fb63
CVE-2024-43865: kernel: s390/fpu: Re-add exception handling in load_fpu_state()
Component: kernel
Severity: Moderate
CWE: CWE-703 (Improper Check or Handling of Exceptional Conditions)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2024-08-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

s390/fpu: Re-add exception handling in load_fpu_state()

With the recent rewrite of the fpu code exception handling for the
lfpc instruction within load_fpu_state() was erroneously removed.

Add it again to prevent that loading invalid floating point register
values cause an unhandled specification exception.


Affected upstream versions: 6.9
Fixed upstream versions: 0, 6.10.4, 6.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 494b14138201f07343e5488db6360c828fcc8cf6
CVE-2024-43866: kernel: net/mlx5: Always drain health in shutdown callback
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Always drain health in shutdown callback

There is no point in recovery during device shutdown. if health
work started need to wait for it to avoid races and NULL pointer
access.

Hence, drain health WQ on shutdown callback.


Affected upstream versions: 4.13.16 < 4.14, 4.14
Fixed upstream versions: 0, 4.14, 6.1.113, 6.10.4, 6.11, 6.6.45
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5005e2e159b300c1b8c6820a1e13a62eb0127b9b
CVE-2024-43869: kernel: perf: Fix event leak upon exec and file release
Component: kernel
Severity: Moderate
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
Public date: 2024-08-21T00:00:00+00:00

Linux kernel perf pending task work is never waited upon the matching event release; in the case of a child event, released via free_event() directly, this can potentially result in a leaked event.


Affected upstream versions: 5.15.84 < 5.15.165, 6.0.14 < 6.1, 6.1
Fixed upstream versions: 0, 5.15.165, 6.1, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9ad46f1fef421d43cdab3a7d1744b2f43b54dae0
CVE-2024-43870: kernel: perf: Fix event leak upon exit
Component: kernel
Severity: Moderate
CWE: CWE-404 (Improper Resource Shutdown or Release)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-08-21T00:00:00+00:00

A logical flaw exists in the Linux kernel.  When a task is scheduled, pending sigtrap deliveries are deferred to the target task upon resuming to userspace via task_work. However, failures are ignored while adding an event's callback to the task_work engine. Since the last call for the event exit happens after task work is eventually closed, there is a small window where the pending sigtrap can be queued to be ignored.


Affected upstream versions: 5.15.84 < 5.15.165, 6.0.14 < 6.1, 6.1
Fixed upstream versions: 0, 5.15.165, 6.1, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 67fad724f1b568b356c1065d50df46e6b30eb2f7
CVE-2024-43871: kernel: devres: Fix memory leakage caused by driver API devm_free_percpu()
Component: kernel
Severity: Moderate
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

devres: Fix memory leakage caused by driver API devm_free_percpu()

It will cause memory leakage when use driver API devm_free_percpu()
to free memory allocated by devm_alloc_percpu(), fixed by using
devres_release() instead of devres_destroy() within devm_free_percpu().


Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 700e8abd65b10792b2f179ce4e858f2ca2880f85
CVE-2024-43873: kernel: vhost/vsock: always initialize seqpacket_allow
Component: kernel
Severity: Moderate
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-08-21T00:00:00+00:00

Improper handling of seqpacket_allow initialization was found in the Linux kernel in drivers/vhost/vsock.c.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.165, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ea558f10fb05a6503c6e655a1b7d81fdf8e5924c
CVE-2024-43879: kernel: wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()

Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in
cfg80211_calculate_bitrate_he(), leading to below warning:

kernel: invalid HE MCS: bw:6, ru:6
kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211]

Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth.

Statement: Following issue marked as moderate with "not affected or will not fix" for Red Hat Enterprise Linux, as it is not vulnerable to this CVE. This is because the CVE does not impact the versions or configurations of the Linux kernel used in Red Hat's distributions.

Affected upstream versions: 4.19
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 45d20a1c54be4f3173862c7b950d4468447814c9
CVE-2024-43880: kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning
Component: kernel
Severity: Moderate
CWE: CWE-284 (Improper Access Control)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-21T00:00:00+00:00

A flaw incorrect memory access in the Linux kernel Mellanox network (Ethernet or RDMA) device driver was found. A local user could use this flaw to crash the system.

Statement: Red Hat Enterprise Linux 8 and 9 affected.

Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4dc09f6f260db3c4565a4ec52ba369393598f2fb
CVE-2024-43882: kernel: exec: Fix ToCToU between perm check and set-uid/gid usage
Component: kernel
Severity: Moderate
CWE: CWE-266 (Incorrect Privilege Assignment)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-08-21T00:00:00+00:00

A vulnerability was found in the Linux kernel. The fix addresses a race condition during file execution (exec), where a file’s permissions could change between an initial check and execution, potentially allowing unauthorized privilege escalation. Specifically, a non-privileged user could gain root access by exploiting a brief window during which file permissions are modified, such as when package managers update executables with setuid.


Affected upstream versions: 2.6.18
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.106, 6.10.6, 6.11, 6.6.47
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d5c3c7e26275a2d83b894d30f7582a42853a958f
CVE-2024-43884: kernel: Bluetooth: MGMT: Add error handling to pair_device()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-26T00:00:00+00:00

Bluetooth in the Linux kernel does not check for a NULL value, which could lead to dereferencing a null pointed and an eventual crash.


Affected upstream versions: 4.3
Fixed upstream versions: 0, 4.19.321, 5.10.225, 5.15.166, 5.4.283, 6.1.107, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 11b4b0e63f2621b33b2e107407a7d67a65994ca1
CVE-2024-43888: kernel: mm: list_lru: fix UAF for memory cgroup
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-08-26T00:00:00+00:00

A possible use-after-free was found in the Linux kernel in mm/list_lru.c.


Affected upstream versions: 6.8
Fixed upstream versions: 0, 6.10.5, 6.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4589f77c18dd98b65f45617b6d1e95313cf6fcab
CVE-2024-43889: kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper()
Component: kernel
Severity: Moderate
CWE: CWE-369 (Divide By Zero)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-26T00:00:00+00:00

A denial of service vulnerability exists in the Linux kernel. A possible divide-by-0 is in the padata_mt_helper() function when the ps->chunk_size is 0. This vulnerability could result in a loss of system availability.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.224, 5.15.165, 6.1.105, 6.10.5, 6.11, 6.6.46
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ab8b397d5997d8c37610252528edc54bebf9f6d3
CVE-2024-43892: kernel: memcg: protect concurrent access to mem_cgroup_idr
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-26T00:00:00+00:00

memcg in linux kernel permit concurrent access to mem_cgroup_idr which can lead to kernel crashes.


Affected upstream versions: 4.4.18 < 4.5, 4.6.6 < 4.7, 4.7
Fixed upstream versions: 0, 4.5, 4.7, 5.10.226, 5.15.167, 6.1.110, 6.10.5, 6.11, 6.6.46
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 912736a0435ef40e6a4ae78197ccb5553cb80b05
CVE-2024-43910: kernel: bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2024-08-26T00:00:00+00:00

bpf in linux kernel permits passing in a modified CONST_PTR_TO_DYNPTR to a global function as an argument. BPF helpers can use the modified CONST_PTR_TO_DYNPTR within a global function context, which can lead to out of bounds memory accesses.


Affected upstream versions: 6.8
Fixed upstream versions: 0, 6.10.5, 6.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 13663a7c644bf1dedaf461d07252db5d76c8759a
CVE-2024-43911: kernel: wifi: mac80211: fix NULL dereference at band check in starting tx ba session
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-26T00:00:00+00:00

linux wifi mac80211 connection link_data allocations can result in null pointer dereferencing.


Affected upstream versions: 6.9
Fixed upstream versions: 0, 6.10.5, 6.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a5594c1e03b0df3908b1e1202a1ba34422eed0f6
CVE-2024-43914: kernel: md/raid5: avoid BUG_ON() while continue reshape after reassembling
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-26T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

md/raid5: avoid BUG_ON() while continue reshape after reassembling

Currently, mdadm support --revert-reshape to abort the reshape while
reassembling, as the test 07revert-grow. However, following BUG_ON()
can be triggerred by the test:

kernel BUG at drivers/md/raid5.c:6278!
invalid opcode: 0000 [#1] PREEMPT SMP PTI
irq event stamp: 158985
CPU: 6 PID: 891 Comm: md0_reshape Not tainted 6.9.0-03335-g7592a0b0049a #94
RIP: 0010:reshape_request+0x3f1/0xe60
Call Trace:
 <TASK>
 raid5_sync_request+0x43d/0x550
 md_do_sync+0xb7a/0x2110
 md_thread+0x294/0x2b0
 kthread+0x147/0x1c0
 ret_from_fork+0x59/0x70
 ret_from_fork_asm+0x1a/0x30
 </TASK>

Root cause is that --revert-reshape update the raid_disks from 5 to 4,
while reshape position is still set, and after reassembling the array,
reshape position will be read from super block, then during reshape the
checking of 'writepos' that is caculated by old reshape position will
fail.

Fix this panic the easy way first, by converting the BUG_ON() to
WARN_ON(), and stop the reshape if checkings fail.

Noted that mdadm must fix --revert-shape as well, and probably md/raid
should enhance metadata validation as well, however this means
reassemble will fail and there must be user tools to fix the wrong
metadata.


Affected upstream versions: 2.6.30
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.105, 6.10.5, 6.11, 6.6.46
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2c92f8c1c456d556f15cbf51667b385026b2e6a0
CVE-2024-4453: gstreamer: EXIF Metadata Parsing Integer Overflow
Component: gstreamer
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-05-22T00:00:00+00:00

A flaw was found in the GStreamer library. This flaw allows a remote attacker to send specially crafted content to the victim, allowing for arbitrary code execution within the context of the affected installation's process. The vulnerability is caused by improper parsing of EXIF metadata and a lack of proper validation of user-supplied data, which triggers an integer overflow.


Affected upstream versions: fc0ef6ede6ceda8c89326b38899d4944a8091f40 and 1.24.0
Fixed upstream versions: 1.25.1
Upstream repository: https://gitlab.freedesktop.org/tpm/gstreamer
Upstream fix commit: e68eccff103ab0e91e6d77a892f57131b33902f5
CVE-2024-44931: kernel: gpio: prevent potential speculation leaks in gpio_device_get_desc()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-08-26T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gpio: prevent potential speculation leaks in gpio_device_get_desc()

Userspace may trigger a speculative read of an address outside the gpio
descriptor array.
Users can do that by calling gpio_ioctl() with an offset out of range.
Offset is copied from user and then used as an array index to get
the gpio descriptor without sanitization in gpio_device_get_desc().

This change ensures that the offset is sanitized by using
array_index_nospec() to mitigate any possibility of speculative
information leaks.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.


Affected upstream versions: 4.6
Fixed upstream versions: 0, 4.19.323, 5.10.227, 5.15.168, 5.4.285, 6.1.112, 6.10.5, 6.11, 6.6.46
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 18504710442671b02d00e6db9804a0ad26c5a479
CVE-2024-44932: kernel: idpf: fix UAFs when destroying the queues
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-08-26T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix UAFs when destroying the queues

The second tagged commit started sometimes (very rarely, but possible)
throwing WARNs from
net/core/page_pool.c:page_pool_disable_direct_recycling().
Turned out idpf frees interrupt vectors with embedded NAPIs *before*
freeing the queues making page_pools' NAPI pointers lead to freed
memory before these pools are destroyed by libeth.
It's not clear whether there are other accesses to the freed vectors
when destroying the queues, but anyway, we usually free queue/interrupt
vectors only when the queues are destroyed and the NAPIs are guaranteed
to not be referenced anywhere.

Invert the allocation and freeing logic making queue/interrupt vectors
be allocated first and freed last. Vectors don't require queues to be
present, so this is safe. Additionally, this change allows to remove
that useless queue->q_vector pointer cleanup, as vectors are still
valid when freeing the queues (+ both are freed within one function,
so it's not clear why nullify the pointers at all).


Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.10.5, 6.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3cde714b0e77206ed1b5cf31f28c18ba9ae946fd
CVE-2024-44934: kernel: net: bridge: mcast: wait for previous gc cycles when removing port
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)
Public date: 2024-08-26T00:00:00+00:00

A possible use-after-free was found in the Linux kernel in net/bridge/br_multicast.c.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.15.165, 6.1.105, 6.10.5, 6.11, 6.6.46
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1e16828020c674b3be85f52685e8b80f9008f50f