huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-52530: kernel: wifi: mac80211: fix potential key use-after-free
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-03-02T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s IEEE 802.11 networking stack implementation functionality, used by Wifi, in how a user triggers the error path of the ieee80211_gtk_rekey_add function. This flaw allows a local user to crash the system.

Statement: Red Hat Enterprise Linux 9 is not affected by this vulnerability.

Affected upstream versions: 3.2.95 < 3.3, 3.16.50 < 3.17, 3.18.82 < 3.19, 4.1.47 < 4.2, 4.4.99 < 4.5, 4.9.63 < 4.10, 4.13.14 < 4.14, 4.14
Fixed upstream versions: 0, 3.17, 3.19, 3.3, 4.10, 4.14, 4.2, 4.5, 5.10.228, 5.15.169, 5.4.285, 6.1.57, 6.5.7, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2408f491ff998d674707725eadc47d8930aced09
CVE-2023-52560: kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions()
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-03-02T00:00:00+00:00

A potential memory leak flaw was found in damon_do_test_apply_three_regions() in the Linux kernel. This issue may lead to minor memory issues, resulting in compromised availability.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.56, 6.5.6, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9a4fe81a8644b717d57d81ce5849e16583b13fe8
CVE-2023-52562: kernel: mm/slab_common: slab_caches list corruption after kmem_cache_destroy()
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()

After the commit in Fixes:, if a module that created a slab cache does not
release all of its allocated objects before destroying the cache (at rmmod
time), we might end up releasing the kmem_cache object without removing it
from the slab_caches list thus corrupting the list as kmem_cache_destroy()
ignores the return value from shutdown_cache(), which in turn never removes
the kmem_cache object from slabs_list in case __kmem_cache_shutdown() fails
to release all of the cache's slabs.

This is easily observable on a kernel built with CONFIG_DEBUG_LIST=y
as after that ill release the system will immediately trip on list_add,
or list_del, assertions similar to the one shown below as soon as another
kmem_cache gets created, or destroyed:

  [ 1041.213632] list_del corruption. next->prev should be ffff89f596fb5768, but was 52f1e5016aeee75d. (next=ffff89f595a1b268)
  [ 1041.219165] ------------[ cut here ]------------
  [ 1041.221517] kernel BUG at lib/list_debug.c:62!
  [ 1041.223452] invalid opcode: 0000 [#1] PREEMPT SMP PTI
  [ 1041.225408] CPU: 2 PID: 1852 Comm: rmmod Kdump: loaded Tainted: G    B   W  OE      6.5.0 #15
  [ 1041.228244] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc37 05/24/2023
  [ 1041.231212] RIP: 0010:__list_del_entry_valid+0xae/0xb0

Another quick way to trigger this issue, in a kernel with CONFIG_SLUB=y,
is to set slub_debug to poison the released objects and then just run
cat /proc/slabinfo after removing the module that leaks slab objects,
in which case the kernel will panic:

  [   50.954843] general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 [#1] PREEMPT SMP PTI
  [   50.961545] CPU: 2 PID: 1495 Comm: cat Kdump: loaded Tainted: G    B   W  OE      6.5.0 #15
  [   50.966808] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc37 05/24/2023
  [   50.972663] RIP: 0010:get_slabinfo+0x42/0xf0

This patch fixes this issue by properly checking shutdown_cache()'s
return value before taking the kmem_cache_release() branch.


Affected upstream versions: 5.19.8 < 5.20, 6.0
Fixed upstream versions: 0, 5.20, 6.1.56, 6.5.6, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a5569bb187521432f509b69dda7d29f78b2d38b0
CVE-2023-52565: kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu()
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2024-03-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Fix OOB read

If the index provided by the user is bigger than the mask size, we might do
an out of bound read.


Affected upstream versions: 6.1.16 < 6.1.56, 6.2.3 < 6.3, 6.3
Fixed upstream versions: 0, 6.1.56, 6.3, 6.5.6, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 09635bf4cdd4adf2160198a6041bcc7ca46c0558
CVE-2023-52574: kernel: team: NULL pointer dereference when team device type is changed
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-02T00:00:00+00:00

A NULL pointer dereference flaw was found in drivers/net/team/team.c in the Linux kernel.


Affected upstream versions: 3.7
Fixed upstream versions: 0, 4.14.327, 4.19.296, 5.10.198, 5.15.134, 5.4.258, 6.1.56, 6.5.6, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1779eb51b9cc628cee551f252701a85a2a50a457
CVE-2023-52580: kernel: net/core: kernel crash in ETH_P_1588 flow dissector
Component: kernel
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-02T00:00:00+00:00

A flaw was found in the ETH_P_1588 flow dissector in the Linux Kernel, which can lead to a kernel crash.


Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.134, 6.1.56, 6.5.6, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f90a7b9586d72f907092078a9f394733ca502cc9
CVE-2023-52581: kernel: netfilter: nf_tables: memory leak when more than 255 elements expired
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-03-02T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s nftables sub-component due to a race problem between the set GC and transaction in the Linux Kernel. This flaw allows a local attacker to crash the system. This flaw is similar to the previous CVE-2023-4244 but for a different part of the source code.

Statement: Exploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace.

Also, on non-containerized deployments of Red Hat Enterprise Linux, you can disable user namespaces by setting user.max_user_namespaces to 0:

$ echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf
$ sysctl -p /etc/sysctl.d/userns.conf

On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.

Affected upstream versions: 6.4.11 < 6.5, 6.5
Fixed upstream versions: 0, 6.5, 6.5.6, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7cf055b43756b10aa2b851c927c940f5ed652125
CVE-2023-52585: kernel: drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-06T00:00:00+00:00

A vulnerability was found in the amdgpu_ras_query_error_status_helper() function in the Linunx kernel which could lead to a possible NULL pointer dereference, causing data corruption or crashes.

Statement: Red Hat Enterprise Linux 8 is not impacted by this vulnerability, as it does not contain the vulnerable amdgpu_ras_query_error_status_helper() function.

Affected upstream versions: 4.2
Fixed upstream versions: 0, 5.10.218, 5.15.160, 5.4.277, 6.1.92, 6.6.32, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 467139546f3fb93913de064461b1a43a212d7626
CVE-2023-52594: kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-06T00:00:00+00:00

A potential array-index-out-of-bounds read flaw was found in the Linux kernel in ath9k_htc_txstatus(). This issue may lead to a crash.


Affected upstream versions: 3.0
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f44f073c78112ff921a220d01b86d09f2ace59bc
CVE-2023-52595: kernel: wifi: rt2x00: restart beacon queue when hardware reset
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-06T00:00:00+00:00

A flaw was found in the Linux kernel. When a hardware reset is triggered, all registers are reset, so all queues are forced to stop in the hardware interface. However, mac80211 will not automatically stop the queue. If the beacon queue is not manually stopped, it will be deadlocked and unable to restart.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e1f113b57ddd18274d7c83618deca25cc880bc48
CVE-2023-52597: kernel: KVM: s390: fix setting of fpc register
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2024-03-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: fix setting of fpc register

kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control
(fpc) register of a guest cpu. The new value is tested for validity by
temporarily loading it into the fpc register.

This may lead to corruption of the fpc register of the host process:
if an interrupt happens while the value is temporarily loaded into the fpc
register, and within interrupt context floating point or vector registers
are used, the current fp/vx registers are saved with save_fpu_regs()
assuming they belong to user space and will be loaded into fp/vx registers
when returning to user space.

test_fp_ctl() restores the original user space / host process fpc register
value, however it will be discarded, when returning to user space.

In result the host process will incorrectly continue to run with the value
that was supposed to be used for a guest cpu.

Fix this by simply removing the test. There is another test right before
the SIE context is entered which will handles invalid values.

This results in a change of behaviour: invalid values will now be accepted
instead of that the ioctl fails with -EINVAL. This seems to be acceptable,
given that this interface is most likely not used anymore, and this is in
addition the same behaviour implemented with the memory mapped interface
(replace invalid values with zero) - see sync_regs() in kvm-s390.c.


Affected upstream versions: 3.13
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3a04410b0bc7e056e0843ac598825dd359246d18
CVE-2023-52598: kernel: s390/ptrace: handle setting of fpc register correctly
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-03-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

s390/ptrace: handle setting of fpc register correctly

If the content of the floating point control (fpc) register of a traced
process is modified with the ptrace interface the new value is tested for
validity by temporarily loading it into the fpc register.

This may lead to corruption of the fpc register of the tracing process:
if an interrupt happens while the value is temporarily loaded into the
fpc register, and within interrupt context floating point or vector
registers are used, the current fp/vx registers are saved with
save_fpu_regs() assuming they belong to user space and will be loaded into
fp/vx registers when returning to user space.

test_fp_ctl() restores the original user space fpc register value, however
it will be discarded, when returning to user space.

In result the tracer will incorrectly continue to run with the value that
was supposed to be used for the traced process.

Fix this by saving fpu register contents with save_fpu_regs() before using
test_fp_ctl().


Affected upstream versions: 4.3
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6ccf904aac0292e1f6b1a1be6c407c414f7cf713
CVE-2023-52606: kernel: powerpc/lib: Validate size for vector operations
Component: kernel
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-06T00:00:00+00:00

A potential stack corruption flaw was found in arch/powerpc/lib/sstep.c in the Linux kernel. This may lead to compromised Confidentiality, Integrity, or Availability.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 42084a428a139f1a429f597d44621e3a18f3e414
CVE-2023-52607: kernel: powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
Component: kernel
Severity: Moderate
CWE: CWE-395 (Use of NullPointerException Catch to Detect NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-06T00:00:00+00:00

A possible null-pointer dereference was found in pgtable_cache_add in the Linux kernel. This may cause a crash.


Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 21e45a7b08d7cd98d6a53c5fc5111879f2d96611
CVE-2023-52610: kernel: net/sched: act_ct: fix skb leak and crash on ooo frags
Component: kernel
Severity: Moderate
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-03-18T00:00:00+00:00

A memory leak flaw and potential kernel crash were found in the Linux kernel’s Conntrack module. This issue occurs when Conntrack is being used by a local user for a specific configuration, and both fragmented packets are received remotely and out of order. This flaw allows a local or remote user to crash or potentially escalate their privileges on the system.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 172ba7d46c202e679f3ccb10264c67416aaeb1c4
CVE-2023-52614: kernel: PM / devfreq: Fix buffer overflow in trans_stat_show
Component: kernel
Severity: Low
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-03-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PM / devfreq: Fix buffer overflow in trans_stat_show

Fix buffer overflow in trans_stat_show().

Convert simple snprintf to the more secure scnprintf with size of
PAGE_SIZE.

Add condition checking if we are exceeding PAGE_SIZE and exit early from
loop. Also add at the end a warning that we exceeded PAGE_SIZE and that
stats is disabled.

Return -EFBIG in the case where we don't have enough space to write the
full transition table.

Also document in the ABI that this function can return -EFBIG error.


Affected upstream versions: 3.8
Fixed upstream versions: 0, 5.10.216, 5.15.149, 6.1.76, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 087de000e4f8c878c81d9dd3725f00a1d292980c
CVE-2023-52615: kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-18T00:00:00+00:00

A vulnerability was found in the hwrng component of the Linux kernel, which caused a deadlock when reading from /dev/hwrng into memory and mmap-ed from /dev/hwrng. This issue is triggered by a recursive read during a page fault and allows a local, authenticated attacker to cause a denial of service.


Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.76, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: eafd83b92f6c044007a3591cbd476bcf90455990
CVE-2023-52619: kernel: pstore/ram: Fix crash when setting number of cpus to an odd number
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-18T00:00:00+00:00

A vulnerability was found in the pstore/ram component of the Linux kernel, which caused crashes when the number of CPU cores was set to an odd number. This issue occurs because the odd-numbered zones became misaligned. This flaw allows a local, authenticated attacker to cause a denial of service.


Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8b69c30f4e8b69131d92096cb296dc1f217101e4
CVE-2023-52620: kernel: netfilter: nf_tables: disallow timeout for anonymous sets
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-03-21T00:00:00+00:00

A vulnerability was found in netfilter/nf_tables componets of Linux Kernel allows an userspace to set timeouts for anonymous sets, which are not intended to be used this way. This could lead to unexpected behaviour or security issues.


Affected upstream versions: 4.1
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.151, 5.4.274, 6.1.81, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 116b0e8e4673a5faa8a739a19b467010c4d3058c
CVE-2023-52621: kernel: bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
Component: kernel
Severity: Low
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-26T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers

These three bpf_map_{lookup,update,delete}_elem() helpers are also
available for sleepable bpf program, so add the corresponding lock
assertion for sleepable bpf program, otherwise the following warning
will be reported when a sleepable bpf program manipulates bpf map under
interpreter mode (aka bpf_jit_enable=0):

  WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ......
  CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......
  RIP: 0010:bpf_map_lookup_elem+0x54/0x60
  ......
  Call Trace:
   <TASK>
   ? __warn+0xa5/0x240
   ? bpf_map_lookup_elem+0x54/0x60
   ? report_bug+0x1ba/0x1f0
   ? handle_bug+0x40/0x80
   ? exc_invalid_op+0x18/0x50
   ? asm_exc_invalid_op+0x1b/0x20
   ? __pfx_bpf_map_lookup_elem+0x10/0x10
   ? rcu_lockdep_current_cpu_online+0x65/0xb0
   ? rcu_is_watching+0x23/0x50
   ? bpf_map_lookup_elem+0x54/0x60
   ? __pfx_bpf_map_lookup_elem+0x10/0x10
   ___bpf_prog_run+0x513/0x3b70
   __bpf_prog_run32+0x9d/0xd0
   ? __bpf_prog_enter_sleepable_recur+0xad/0x120
   ? __bpf_prog_enter_sleepable_recur+0x3e/0x120
   bpf_trampoline_6442580665+0x4d/0x1000
   __x64_sys_getpgid+0x5/0x30
   ? do_syscall_64+0x36/0xb0
   entry_SYSCALL_64_after_hwframe+0x6e/0x76
   </TASK>

Statement: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.237, 5.15.181, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 82f2df94dac1aa9b879e74d1f82ba1b631bdc612
CVE-2023-52622: kernel: ext4: avoid online resizing failures due to oversized flex bg
Component: kernel
Severity: Low
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-26T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid online resizing failures due to oversized flex bg

When we online resize an ext4 filesystem with a oversized flexbg_size,

     mkfs.ext4 -F -G 67108864 $dev -b 4096 100M
     mount $dev $dir
     resize2fs $dev 16G

the following WARN_ON is triggered:
==================================================================
WARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550
Modules linked in: sg(E)
CPU: 0 PID: 427 Comm: resize2fs Tainted: G  E  6.6.0-rc5+ #314
RIP: 0010:__alloc_pages+0x411/0x550
Call Trace:
 <TASK>
 __kmalloc_large_node+0xa2/0x200
 __kmalloc+0x16e/0x290
 ext4_resize_fs+0x481/0xd80
 __ext4_ioctl+0x1616/0x1d90
 ext4_ioctl+0x12/0x20
 __x64_sys_ioctl+0xf0/0x150
 do_syscall_64+0x3b/0x90
==================================================================

This is because flexbg_size is too large and the size of the new_group_data
array to be allocated exceeds MAX_ORDER. Currently, the minimum value of
MAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding
maximum number of groups that can be allocated is:

 (PAGE_SIZE << MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845

And the value that is down-aligned to the power of 2 is 16384. Therefore,
this value is defined as MAX_RESIZE_BG, and the number of groups added
each time does not exceed this value during resizing, and is added multiple
times to complete the online resizing. The difference is that the metadata
in a flex_bg may be more dispersed.


Affected upstream versions: 3.3
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cd1f93ca97a9136989f3bd2bf90696732a2ed644