huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-38562: kernel: wifi: nl80211: Avoid address calculations via out of bounds array indexing
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-06-19T00:00:00+00:00

A vulnerability has been identified in the Linux kernel, specifically involving a possible out-of-bounds array indexing within the net/wireless/nl80211.c file (related to the wireless networking subsystem). This flaw can lead to a kernel-level crash, resulting in a denial-of-service condition for the affected system.


Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ed74398642fcb19f6ff385c35a7d512c6663e17b
CVE-2024-38564: kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
Component: kernel
Severity: Low
CWE: CWE-665 (Improper Initialization)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

bpf_prog_attach uses attach_type_to_prog_type to enforce proper
attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses
bpf_prog_get and relies on bpf_prog_attach_check_attach_type
to properly verify prog_type <> attach_type association.

Add missing attach_type enforcement for the link_create case.
Otherwise, it's currently possible to attach cgroup_skb prog
types to other cgroup hooks.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6675c541f540a29487a802d3135280b69b9f568d
CVE-2024-38570: kernel: gfs2: Fix potential glock use-after-free on unmount
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-06-19T00:00:00+00:00

A vulnerability was found in the Linux kernel within the gfs2 component, where potential use-after-free issues could occur on unmount. When DLM lockspaces are released with remaining locks, callbacks for asynchronous lock contention may access freed objects, causing unexpected behavior.

Statement: This vulnerability is rated as a moderate severity due to its localized impact. Exploitation requires specific conditions during unmount, affecting stability without extensive security risks, as it impacts only the file system’s lock management on unmount.

Affected upstream versions: 3.8
Fixed upstream versions: 0, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0636b34b44589b142700ac137b5f69802cfe2e37
CVE-2024-38573: kernel: cppc_cpufreq: Fix possible null pointer dereference
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

A NULL pointer dereference flaw was found in cppc_cpufreq_get_rate() in the Linux kernel. This issue may result in a crash.


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.161, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9a185cc5a79ba408e1c73375706630662304f618
CVE-2024-38575: kernel: wifi: brcmfmac: pcie: handle randbuf allocation failure
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

in linux kernel wifi, the kzalloc() in brcmf_pcie_download_fw_nvram() will return null if the physical memory has run out. Thereafter if get_random_bytes()  is used, a null pointer dereference is triggered, causing allocation failure.


Affected upstream versions: 6.1.30 < 6.1.93, 6.3.4 < 6.4, 6.4
Fixed upstream versions: 0, 6.1.93, 6.10, 6.4, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0eb2c0528e232b3c32cde9d5e1c9f80ba2996e49
CVE-2024-38579: kernel: crypto: bcm - Fix pointer arithmetic
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

crypto: bcm - Fix pointer arithmetic

In spu2_dump_omd() value of ptr is increased by ciph_key_len
instead of hash_iv_len which could lead to going beyond the
buffer boundaries.
Fix this bug by changing ciph_key_len to hash_iv_len.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Affected upstream versions: 4.11
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c256b616067bfd6d274c679c06986b78d2402434
CVE-2024-38580: kernel: epoll: be better about file lifetimes
Component: kernel
Severity: Low
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-06-19T00:00:00+00:00

A flaw was found in the Linux kernel. Inappropriate file lifetime handling may lead to availability issues.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.15.161, 6.1.93, 6.6.33, 6.8.12, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cbfd1088e24ec4c1199756a37cb8e4cd0a4b016e
CVE-2024-38581: kernel: drm/amdgpu/mes: fix use-after-free issue
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-06-19T00:00:00+00:00

A flaw was found in the Linux kernel. This issue is due to a possible use-after-free in drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 6.1.93, 6.6.33, 6.8.12, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 70b1bf6d9edc8692d241f59a65f073aec6d501de
CVE-2024-38586: kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets.
Component: kernel
Severity: Moderate
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

in linux kernel r8169, when transmitting small fragmented packets, invalid entries were inserted into the transmit ring buffer, leading to calls to dma_unmap_single() with a null address.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.221, 5.15.161, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 61c1c98e2607120ce9c3fa1bf75e6da909712b27
CVE-2024-38593: kernel: net: micrel: Fix receiving the timestamp in the frame for lan8841
Component: kernel
Severity: Moderate
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: micrel: Fix receiving the timestamp in the frame for lan8841

The blamed commit started to use the ptp workqueue to get the second
part of the timestamp. And when the port was set down, then this
workqueue is stopped. But if the config option NETWORK_PHY_TIMESTAMPING
is not enabled, then the ptp_clock is not initialized so then it would
crash when it would try to access the delayed work.
So then basically by setting up and then down the port, it would crash.
The fix consists in checking if the ptp_clock is initialized and only
then cancel the delayed work.


Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3ddf170e4a604f5d4d9459a36993f5e92b53e8b0
CVE-2024-38596: kernel: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
Component: kernel
Severity: Low
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg

A data-race condition has been identified in af_unix. In one data path,
the write function unix_release_sock() atomically writes to
sk->sk_shutdown using WRITE_ONCE. However, on the reader side,
unix_stream_sendmsg() does not read it atomically. Consequently, this
issue is causing the following KCSAN splat to occur:

	BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg

	write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28:
	unix_release_sock (net/unix/af_unix.c:640)
	unix_release (net/unix/af_unix.c:1050)
	sock_close (net/socket.c:659 net/socket.c:1421)
	__fput (fs/file_table.c:422)
	__fput_sync (fs/file_table.c:508)
	__se_sys_close (fs/open.c:1559 fs/open.c:1541)
	__x64_sys_close (fs/open.c:1541)
	x64_sys_call (arch/x86/entry/syscall_64.c:33)
	do_syscall_64 (arch/x86/entry/common.c:?)
	entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

	read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14:
	unix_stream_sendmsg (net/unix/af_unix.c:2273)
	__sock_sendmsg (net/socket.c:730 net/socket.c:745)
	____sys_sendmsg (net/socket.c:2584)
	__sys_sendmmsg (net/socket.c:2638 net/socket.c:2724)
	__x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750)
	x64_sys_call (arch/x86/entry/syscall_64.c:33)
	do_syscall_64 (arch/x86/entry/common.c:?)
	entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

	value changed: 0x01 -> 0x03

The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7").

Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.")
addressed a comparable issue in the past regarding sk->sk_shutdown.
However, it overlooked resolving this particular data path.
This patch only offending unix_stream_sendmsg() function, since the
other reads seem to be protected by unix_state_lock() as discussed in


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fca6072e1a7b1e709ada5604b951513b89b4bd0a
CVE-2024-38598: kernel: md: fix resync softlockup when bitmap size is less than array size
Component: kernel
Severity: Moderate
CWE: CWE-667 (Improper Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

md: fix resync softlockup when bitmap size is less than array size

Is is reported that for dm-raid10, lvextend + lvchange --syncaction will
trigger following softlockup:

kernel:watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [mdX_resync:6976]
CPU: 7 PID: 3588 Comm: mdX_resync Kdump: loaded Not tainted 6.9.0-rc4-next-20240419 #1
RIP: 0010:_raw_spin_unlock_irq+0x13/0x30
Call Trace:
 <TASK>
 md_bitmap_start_sync+0x6b/0xf0
 raid10_sync_request+0x25c/0x1b40 [raid10]
 md_do_sync+0x64b/0x1020
 md_thread+0xa7/0x170
 kthread+0xcf/0x100
 ret_from_fork+0x30/0x50
 ret_from_fork_asm+0x1a/0x30

And the detailed process is as follows:

md_do_sync
 j = mddev->resync_min
 while (j < max_sectors)
  sectors = raid10_sync_request(mddev, j, &skipped)
   if (!md_bitmap_start_sync(..., &sync_blocks))
    // md_bitmap_start_sync set sync_blocks to 0
    return sync_blocks + sectors_skippe;
  // sectors = 0;
  j += sectors;
  // j never change

Root cause is that commit 301867b1c168 ("md/raid10: check
slab-out-of-bounds in md_bitmap_get_counter") return early from
md_bitmap_get_counter(), without setting returned blocks.

Fix this problem by always set returned blocks from
md_bitmap_get_counter"(), as it used to be.

Noted that this patch just fix the softlockup problem in kernel, the
case that bitmap size doesn't match array size still need to be fixed.


Affected upstream versions: 4.19.291 < 4.19.316, 5.4.251 < 5.4.278, 5.10.188 < 5.10.219, 5.15.121 < 5.15.161, 6.1.39 < 6.1.93, 6.3.13 < 6.4, 6.4.4 < 6.5, 6.5
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.4, 6.5, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d4b9c764d48fa41caa24cfb4275f3aa9fb4bd798
CVE-2024-38600: kernel: ALSA: Fix deadlocks with kctl removals at disconnection
Component: kernel
Severity: Low
CWE: CWE-833 (Deadlock)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: Fix deadlocks with kctl removals at disconnection

In snd_card_disconnect(), we set card->shutdown flag at the beginning,
call callbacks and do sync for card->power_ref_sleep waiters at the
end.  The callback may delete a kctl element, and this can lead to a
deadlock when the device was in the suspended state.  Namely:

* A process waits for the power up at snd_power_ref_and_wait() in
  snd_ctl_info() or read/write() inside card->controls_rwsem.

* The system gets disconnected meanwhile, and the driver tries to
  delete a kctl via snd_ctl_remove*(); it tries to take
  card->controls_rwsem again, but this is already locked by the
  above.  Since the sleeper isn't woken up, this deadlocks.

An easy fix is to wake up sleepers before processing the driver
disconnect callbacks but right after setting the card->shutdown flag.
Then all sleepers will abort immediately, and the code flows again.

So, basically this patch moves the wait_event() call at the right
timing.  While we're at it, just to be sure, call wait_event_all()
instead of wait_event(), although we don't use exclusive events on
this queue for now.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.161, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ff80185e7b7b547a0911fcfc8aefc61c3e8304d7
CVE-2024-38604: kernel: block: refine the EOF check in blkdev_iomap_begin
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

block: refine the EOF check in blkdev_iomap_begin

blkdev_iomap_begin rounds down the offset to the logical block size
before stashing it in iomap->offset and checking that it still is
inside the inode size.

Check the i_size check to the raw pos value so that we don't try a
zero size write if iter->pos is unaligned.


Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 910717920c8c3f9386277a44c44d448058a18084
CVE-2024-38605: kernel: ALSA: core: Fix NULL module pointer assignment at card init
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: core: Fix NULL module pointer assignment at card init

The commit 81033c6b584b ("ALSA: core: Warn on empty module")
introduced a WARN_ON() for a NULL module pointer passed at snd_card
object creation, and it also wraps the code around it with '#ifdef
MODULE'.  This works in most cases, but the devils are always in
details.  "MODULE" is defined when the target code (i.e. the sound
core) is built as a module; but this doesn't mean that the caller is
also built-in or not.  Namely, when only the sound core is built-in
(CONFIG_SND=y) while the driver is a module (CONFIG_SND_USB_AUDIO=m),
the passed module pointer is ignored even if it's non-NULL, and
card->module remains as NULL.  This would result in the missing module
reference up/down at the device open/close, leading to a race with the
code execution after the module removal.

For addressing the bug, move the assignment of card->module again out
of ifdef.  The WARN_ON() is still wrapped with ifdef because the
module can be really NULL when all sound drivers are built-in.

Note that we keep 'ifdef MODULE' for WARN_ON(), otherwise it would
lead to a false-positive NULL module check.  Admittedly it won't catch
perfectly, i.e. no check is performed when CONFIG_SND=y.  But, it's no
real problem as it's only for debugging, and the condition is pretty
rare.


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.219, 5.15.161, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d7ff29a429b56f04783152ad7bbd7233b740e434
CVE-2024-38608: kernel: net/mlx5e: Fix netif state handling
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

A vulnerability was found in the Linux kernel within the net/mlx5e component, where improper handling of network interface states could lead to a NULL pointer dereference or resource leaks if network registration fails during initialization. This condition could cause system instability, as resources may not be cleaned up correctly, although it presents a low risk due to limited overall impact.

Statement: This vulnerability is rated as low severity, as it requires specific conditions in network interface setup and does not compromise confidentiality or integrity. Its impact is restricted to potential stability issues under rare circumstances.

Affected upstream versions: 4.12
Fixed upstream versions: 0, 6.10, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f7e6cfb864a53af71c5cc904f1cc22215d68f5c6
CVE-2024-38612: kernel: ipv6: sr: fix invalid unregister error path
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: fix invalid unregister error path

The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL
is not defined. In that case if seg6_hmac_init() fails, the
genl_unregister_family() isn't called.

This issue exist since commit 46738b1317e1 ("ipv6: sr: add option to control
lwtunnel support"), and commit 5559cea2d5aa ("ipv6: sr: fix possible
use-after-free and null-ptr-deref") replaced unregister_pernet_subsys()
with genl_unregister_family() in this error path.


Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 10610575a3ac2a702bf5c57aa931beaf847949c7
CVE-2024-38615: kernel: cpufreq: exit() callback is optional
Component: kernel
Severity: Low
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: exit() callback is optional

The exit() callback is optional and shouldn't be called without checking
a valid pointer first.

Also, we must clear freq_table pointer even if the exit() callback isn't
present.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2d730b465e377396d2a09a53524b96b111f7ccb6
CVE-2024-38618: kernel: ALSA: timer: Set lower bound of start tick time
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: Set lower bound of start tick time

Currently ALSA timer doesn't have the lower limit of the start tick
time, and it allows a very small size, e.g. 1 tick with 1ns resolution
for hrtimer.  Such a situation may lead to an unexpected RCU stall,
where  the callback repeatedly queuing the expire update, as reported
by fuzzer.

This patch introduces a sanity check of the timer start tick time, so
that the system returns an error when a too small start size is set.
As of this patch, the lower limit is hard-coded to 100us, which is
small enough but can still work somehow.


Affected upstream versions: 2.6.29
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 68396c825c43664b20a3a1ba546844deb2b4e48f
CVE-2024-38619: kernel: usb-storage: alauda: Check whether the media is initialized
Component: kernel
Severity: Low
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb-storage: alauda: Check whether the media is initialized

The member "uzonesize" of struct alauda_info will remain 0
if alauda_init_media() fails, potentially causing divide errors
in alauda_read_data() and alauda_write_lba().
- Add a member "media_initialized" to struct alauda_info.
- Change a condition in alauda_check_media() to ensure the
  first initialization.
- Add an error check for the return value of alauda_init_media().


Affected upstream versions: 2.6.16
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e0aab7b07a9375337847c9d74a5ec044071e01c8
CVE-2024-38627: kernel: stm class: Fix a double free in stm_register_device()
Component: kernel
Severity: Low
CWE: CWE-415 (Double Free)
CVSS v3: 5.6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-06-21T00:00:00+00:00

A vulnerability was found in the Linux kernel's stm class, where an improper memory management sequence in stm_register_device() could lead to a double-free error. This issue occurs when the put_device(&stm->dev) call triggers stm_device_release() to free "stm", making the subsequent vfree(stm) call redundant and potentially harmful.

Statement: Red Hat assesses the impact of this vulnerability as Low because this flaw can be mitigated by blocklisting a kernel module that is not typically used in production systems, and an attacker would need elevated privileges to have complete control over the consequences of the memory corruption caused by this issue.

Affected upstream versions: 4.4.178 < 4.5, 4.7
Fixed upstream versions: 0, 4.19.316, 4.5, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6cc30ef8eb6d8f8d6df43152264bbf8835d99931