huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
Component: golang.org/x/crypto/ssh
Severity: Important
CWE: CWE-285 (Improper Authorization)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)
Public date: 2024-12-11T18:55:58.506000+00:00

A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.

Statement: This vulnerability is classified as important rather than critical because it does not directly enable unauthorized access but rather introduces a risk of authorization bypass if the application or library misuses the PublicKeyCallback API. The vulnerability relies on incorrect assumptions made by the application when handling the sequence or state of keys provided during SSH authentication. Properly implemented systems that use the Permissions field or avoid relying on external state remain unaffected. Additionally, the vulnerability does not allow direct exploitation to gain control over a system without the presence of insecure logic in the application's handling of authentication attempts.


Red Hat Enterprise Linux(RHEL) 8 & 9 and Red Hat Openshift marked as not affected as it was determined that the problem function `ServerConfig.PublicKeyCallback`, as noted in the CVE-2024-45337 issue, is not called by Podman, Buildah, containers-common, or the gvisor-tap-vsock projects.

Affected upstream versions: <= v0.30.0
Fixed upstream versions: 0.31.0
Upstream repository: https://github.com/golang/crypto
Upstream fix commit: b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
CVE-2024-45339: github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog
Component: github.com/golang/glog
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2025-01-28T01:03:24.105000+00:00

A flaw was found in glog, a logging library. This vulnerability allows an unprivileged attacker to overwrite sensitive files via a symbolic link planted in a widely writable directory, exploiting the log file path predictability.


Affected upstream versions: <= v1.2.3
Fixed upstream versions: 1.2.4
Upstream repository: https://github.com/golang/glog
Upstream fix commit: b8741656e406e66d6992bc2c9575e460ecaa0ec2
CVE-2024-45341: golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints
Component: golang
Severity: Low
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2025-01-17T00:00:00+00:00

A flaw was found in the crypto/x509 package of the Golang standard library. A certificate with a URI, which has a IPv6 address with a zone ID, may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI; this issue only affects users of private PKIs that make use of URIs.


Affected upstream versions: 1.23.0-0 < 1.23.5, 1.24.0-0 < 1.24.0-rc.2
Fixed upstream versions: 1.22.11, 1.23.5, 1.24.0-rc.2
Upstream repository: https://github.com/golang/go
Upstream fix commit: 2b2314e9f6103de322b2e247387c8b01fd0cd5a4
CVE-2024-45410: traefik: HTTP client can manipulate custom HTTP headers that are added by Traefik
Component: traefik
Severity: Important
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
Public date: 2024-09-19T14:48:10+00:00

A flaw was found in Traefik. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated.

Statement: This vulnerability in Traefik is important due to its impact on the integrity of HTTP headers that are often used for security-sensitive operations. When the X-Forwarded headers, such as X-Forwarded-Host or X-Forwarded-Tls-Client-Cert, can be removed or manipulated by the client, applications relying on these headers for trust validation, client authentication, or access control are exposed to potential privilege escalation or unauthorized access. The ability to bypass or alter these headers compromises the security model that many backend services depend on, particularly in reverse proxy or load balancer setups.

Affected upstream versions: < 2.11.9, >= 3.0.0, < 3.1.3
Fixed upstream versions: v2.11.9
Upstream repository: https://github.com/traefik/traefik
Upstream fix commit: 584144100524277829f26219baaab29a53b8134f
CVE-2024-45590: body-parser: Denial of Service Vulnerability in body-parser
Component: body-parser
Severity: Important
CWE: CWE-405 (Asymmetric Resource Consumption (Amplification))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-10T16:15:21.083000+00:00

A flaw was found in body-parser. This vulnerability causes denial of service via a specially crafted payload when the URL encoding is enabled.


Affected upstream versions: < 1.20.3
Fixed upstream versions: 1.20.3
Upstream repository: https://github.com/expressjs/body-parser
Upstream fix commit: b2695c4450f06ba3b0ccf48d872a229bb41c9bce
CVE-2024-45801: dompurify: XSS vulnerability via prototype pollution
Component: dompurify
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L)
Public date: 2024-09-16T19:16:11.080000+00:00

A flaw was found in DOMPurify. This issue may allow an attacker to use specially-crafted HTML to bypass the depth checking or use Prototype Pollution to weaken the depth check, which can lead to cross site scripting (XSS) attacks.

Statement: The vulnerability in DOMPurify, while significant, is categorized as moderate severity rather than important due to its specific conditions for exploitation. The issue requires not only a sophisticated nesting technique to bypass the depth checks but also the ability to leverage Prototype Pollution to weaken these protections. This makes the attack scenario relatively complex and less likely to be encountered in general use cases. Furthermore, the flaw impacts only certain configurations and usage patterns, thus reducing its immediate risk.

Affected upstream versions: < 2.5.4, >=3.0.0, < 3.1.3
Fixed upstream versions: 3.1.3
Upstream repository: https://github.com/cure53/DOMPurify
Upstream fix commit: 1e520262bf4c66b5efda49e2316d6d1246ca7b21
CVE-2024-45811: vite: server.fs.deny is bypassed when using `?import&raw`
Component: vite
Severity: Moderate
CWE: CWE-41 (Improper Resolution of Path Equivalence)
CVSS v3: 4.8 (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2024-09-17T18:44:12+00:00

A flaw was found in ViteJS. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists, which can allow an attacker to access arbitrary files via the browser.

Statement: This vulnerability is classified as moderate rather than high severity because it requires specific conditions for exploitation. The attacker must have access to the Vite server, which typically runs in a local development environment rather than in production. Additionally, the bypass allows file access only if the file path is already known or predictable, limiting the attacker's ability to arbitrarily explore the file system. While it exposes file content outside the Vite serving allow list, the scope of access is constrained, and the impact can be mitigated by proper server configurations and deployment practices.

Affected upstream versions: >= 5.4.0, < 5.4.6, >= 5.3.0, < 5.3.6, >= 5.0.0, < 5.2.14, >= 4.0.0, < 4.5.5, < 3.2.11
Fixed upstream versions: v5.3.6
Upstream repository: https://github.com/vitejs/vite
Upstream fix commit: 4573a6fd6f1b097fb7296a3e135e0646b996b249
CVE-2024-45812: vite: XSS via DOM Clobbering gadget found in vite bundled scripts
Component: vite
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-09-17T20:15:06.037000+00:00

A DOM clobbering vulnerability was found in ViteJS. This may lead to cross-site scripting (XSS) attacks on websites that include Vite-bundled files configured with an output format of cjs, iife, or umd, and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes.

Statement: This issue is classified as moderate severity rather than important due to the specific conditions required to exploit the vulnerability. While DOM Clobbering can lead to Cross-Site Scripting (XSS), the attack surface is relatively limited. Exploitation is contingent on the presence of unsanitized user-supplied HTML with certain scriptless attributes (`name`, `id`) and the use of particular Vite build outputs (`cjs`, `iife`, `umd`). In environments following proper input sanitization practices, the risk is significantly mitigated. Moreover, the vulnerability does not enable direct code injection or compromise by default but rather leverages existing script elements, reducing the likelihood of widespread exploitation compared to higher severity issues.

Affected upstream versions: >= 5.4.0, < 5.4.6, >= 5.3.0, < 5.3.6, >= 5.0.0, < 5.2.14, >= 4.0.0, < 4.5.5, < 3.2.11
Fixed upstream versions: plugin-legacy@5.4.3
Upstream repository: https://github.com/vitejs/vite
Upstream fix commit: ade1d89660e17eedfd35652165b0c26905259fad
CVE-2024-45813: find-my-way: ReDoS vulnerability in multiparametric routes
Component: find-my-way
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-18T17:15:19.163000+00:00

A regular expression denial of service (ReDoS) flaw was found in find-my-way. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, such as `/:a-:b-`. This issue may cause a denial of service in some instances.


Affected upstream versions: < 8.2.2, = 9.0.0
Fixed upstream versions: v9.0.1
Upstream repository: https://github.com/delvedor/find-my-way
Upstream fix commit: 5e9e0eb5d8d438e06a185d5e536a896572dd0440
CVE-2024-4603: openssl: Excessive time spent checking DSA keys and parameters
Component: openssl
Severity: Low
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-05-16T00:00:00+00:00

A flaw was found in OpenSSL. Applications that use the EVP_PKEY_param_check() or EVP_PKEY_public_check() function to check a DSA public key or DSA parameters may experience long delays when checking excessively long DSA keys or parameters.  In applications that allow untrusted sources to provide the key or parameters that are checked, an attacker may be able to cause a denial of service. These functions are not called by OpenSSL on untrusted DSA keys. The applications that directly call these functions are the ones that may be vulnerable to this issue.

Statement: Only OpenSSL 3.3, 3.2, 3.1 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

Affected upstream versions: 3.0.0 < 3.0.14, 3.1.0 < 3.1.6, 3.2.0 < 3.2.2, 3.3.0 < 3.3.1
Fixed upstream versions: 3.0.14, 3.1.6, 3.2.2, 3.3.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 3559e868e58005d15c6013a0c1fd832e51c73397
CVE-2024-46673: kernel: scsi: aacraid: Fix double-free on probe failure
Component: kernel
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-09-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: aacraid: Fix double-free on probe failure

aac_probe_one() calls hardware-specific init functions through the
aac_driver_ident::init pointer, all of which eventually call down to
aac_init_adapter().

If aac_init_adapter() fails after allocating memory for aac_dev::queues,
it frees the memory but does not clear that member.

After the hardware-specific init function returns an error,
aac_probe_one() goes down an error path that frees the memory pointed to
by aac_dev::queues, resulting.in a double-free.


Affected upstream versions: 2.6.15
Fixed upstream versions: 0, 4.19.321, 5.10.225, 5.15.166, 5.4.283, 6.1.108, 6.10.8, 6.11, 6.6.49
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d237c7d06ffddcdb5d36948c527dc01284388218
CVE-2024-46675: kernel: usb: dwc3: core: Prevent USB core invalid event buffer address access
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: core: Prevent USB core invalid event buffer address access

This commit addresses an issue where the USB core could access an
invalid event buffer address during runtime suspend, potentially causing
SMMU faults and other memory issues in Exynos platforms. The problem
arises from the following sequence.
        1. In dwc3_gadget_suspend, there is a chance of a timeout when
        moving the USB core to the halt state after clearing the
        run/stop bit by software.
        2. In dwc3_core_exit, the event buffer is cleared regardless of
        the USB core's status, which may lead to an SMMU faults and
        other memory issues. if the USB core tries to access the event
        buffer address.

To prevent this hardware quirk on Exynos platforms, this commit ensures
that the event buffer address is not cleared by software  when the USB
core is active during runtime suspend by checking its status before
clearing the buffer address.


Affected upstream versions: 4.8
Fixed upstream versions: 0, 4.19.321, 5.10.225, 5.15.166, 5.4.283, 6.1.108, 6.10.8, 6.11, 6.6.49
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: eca3f543f817da87c00d1a5697b473efb548204f
CVE-2024-46679: kernel: ethtool: check device is present when getting link settings
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-13T00:00:00+00:00

A flaw was found in ethtool in the Linux kernel, where sysfs reader getting link settings can attempt to read the device state on a device that is not present, leading to a crash.


Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 5.10.225, 5.15.166, 5.4.283, 6.1.108, 6.10.8, 6.11, 6.6.49
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ec7b4f7f644018ac293cb1b02528a40a32917e62
CVE-2024-46689: kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB
Component: kernel
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: cmd-db: Map shared memory as WC, not WB

Linux does not write into cmd-db region. This region of memory is write
protected by XPU. XPU may sometime falsely detect clean cache eviction
as "write" into the write protected region leading to secure interrupt
which causes an endless loop somewhere in Trust Zone.

The only reason it is working right now is because Qualcomm Hypervisor
maps the same region as Non-Cacheable memory in Stage 2 translation
tables. The issue manifests if we want to use another hypervisor (like
Xen or KVM), which does not know anything about those specific mappings.

Changing the mapping of cmd-db memory from MEMREMAP_WB to MEMREMAP_WT/WC
removes dependency on correct mappings in Stage 2 tables. This patch
fixes the issue by updating the mapping to MEMREMAP_WC.

I tested this on SA8155P with Xen.


Affected upstream versions: 4.18
Fixed upstream versions: 0, 5.10.225, 5.15.166, 5.4.283, 6.1.108, 6.10.8, 6.11, 6.6.49
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0ee9594c974368a17e85a431e9fe1c14fb65c278
CVE-2024-46695: kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook
Component: kernel
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L)
Public date: 2024-09-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

selinux,smack: don't bypass permissions check in inode_setsecctx hook

Marek Gresko reports that the root user on an NFS client is able to
change the security labels on files on an NFS filesystem that is
exported with root squashing enabled.

The end of the kerneldoc comment for __vfs_setxattr_noperm() states:

 *  This function requires the caller to lock the inode's i_mutex before it
 *  is executed. It also assumes that the caller will make the appropriate
 *  permission checks.

nfsd_setattr() does do permissions checking via fh_verify() and
nfsd_permission(), but those don't do all the same permissions checks
that are done by security_inode_setxattr() and its related LSM hooks do.

Since nfsd_setattr() is the only consumer of security_inode_setsecctx(),
simplest solution appears to be to replace the call to
__vfs_setxattr_noperm() with a call to __vfs_setxattr_locked().  This
fixes the above issue and has the added benefit of causing nfsd to
recall conflicting delegations on a file when a client tries to change
its security label.


Affected upstream versions: 3.11
Fixed upstream versions: 0, 5.10.227, 5.15.168, 6.1.113, 6.10.8, 6.11, 6.6.49
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2dbc4b7bac60b02cc6e70d05bf6a7dfd551f9dda
CVE-2024-46697: kernel: nfsd: ensure that nfsd4_fattr_args.context is zeroed out
Component: kernel
Severity: Moderate
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nfsd: ensure that nfsd4_fattr_args.context is zeroed out

If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to
checking for the security label, then args.context will be set to
uninitialized junk on the stack, which we'll then try to free.
Initialize it early.


Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.10.8, 6.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dd65b324174a64558a16ebbf4c3266e5701185d0
CVE-2024-46711: kernel: mptcp: pm: fix ID 0 endp usage after multiple re-creations
Component: kernel
Severity: Moderate
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-13T00:00:00+00:00

A flaw incorrect behavior in the Linux kernel Multipath TCP (MPTCP) functionality was found in the way. A local user could use this flaw to crash the system.

Statement: Only Red Hat Enterprise Linux 9 affected.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.109, 6.10.8, 6.11, 6.6.49
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c9c744666f7308a4daba520191e29d395260bcfe
CVE-2024-46713: kernel: perf/aux: Fix AUX buffer serialization
Component: kernel
Severity: Moderate
CWE: CWE-662 (Improper Synchronization)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf/aux: Fix AUX buffer serialization

Ole reported that event->mmap_mutex is strictly insufficient to
serialize the AUX buffer, add a per RB mutex to fully serialize it.

Note that in the lock order comment the perf_event::mmap_mutex order
was already wrong, that is, it nesting under mmap_lock is not new with
this patch.


Affected upstream versions: 4.1
Fixed upstream versions: 0, 5.10.226, 5.15.167, 6.1.110, 6.10.10, 6.11, 6.6.51
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7882923f1cb88dc1a17f2bf0c81b1fc80d44db82
CVE-2024-46722: kernel: drm/amdgpu: fix mc_data out-of-bounds read warning
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix mc_data out-of-bounds read warning

Clear warning that read mc_data[i-1] may out-of-bounds.


Affected upstream versions: 4.2
Fixed upstream versions: 0, 4.19.322, 5.10.226, 5.15.167, 5.4.284, 6.1.109, 6.10.9, 6.11, 6.6.50
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5fa4df25ecfc7b6c9006f5b871c46cfe25ea8826
CVE-2024-46723: kernel: drm/amdgpu: fix ucode out-of-bounds read warning
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix ucode out-of-bounds read warning

Clear warning that read ucode[] may out-of-bounds.


Affected upstream versions: 4.2
Fixed upstream versions: 0, 4.19.322, 5.10.226, 5.15.167, 5.4.284, 6.1.109, 6.10.9, 6.11, 6.6.50
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 82ac8f1d02886b5d8aeb9e058989d3bd6fc581e2
CVE-2024-46724: kernel: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number

Check the fb_channel_number range to avoid the array out-of-bounds
read error


Affected upstream versions: 4.2
Fixed upstream versions: 0, 5.10.226, 5.15.167, 6.1.109, 6.10.9, 6.11, 6.6.50
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 725b728cc0c8c5fafdfb51cb0937870d33a40fa4
CVE-2024-46725: kernel: drm/amdgpu: Fix out-of-bounds write warning
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix out-of-bounds write warning

Check the ring type value to fix the out-of-bounds
write warning

Statement: This flaw will need a root/admin (PR:H) to exploit the OOB write.

Affected upstream versions: 4.2
Fixed upstream versions: 0, 5.10.226, 5.15.167, 6.1.109, 6.10.9, 6.11, 6.6.50
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c253b87c7c37ec40a2e0c84e4a6b636ba5cd66b2