huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-25739: kernel: crash due to a missing check for leb_size
Component: kernel
Severity: Moderate
CWE: CWE-754 (Improper Check for Unusual or Exceptional Conditions)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-12T00:00:00+00:00

A flaw was found in the Linux kernel. The create_empty_lvol function in the drivers/mtd/ubi/vtbl.c file can attempt to allocate zero bytes of memory when the LEB size is smaller than a single volume table record. This issue can result in a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v6.9
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 68a24aba7c593eafa8fd00f2f76407b9b32b47a9
CVE-2024-25742: hw: amd: Instruction raise #VC exception at exit
Component: hw
Severity: Moderate
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2024-04-05T00:00:00+00:00

A vulnerability was found in AMD SEV-SNP, where a malicious hypervisor can potentially break confidentiality and integrity of SEV-SNP on Linux guests by injecting interrupts. An attacker can inject interrupt 0x80, which is used by Linux for legacy 32-bit system calls, and arbitrarily change the value stored in EAX while a SEV VM is running.


Affected upstream versions: n/a
Fixed upstream versions: v6.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: e3ef461af35a8c74f2f4ce6616491ddb355a208f
CVE-2024-25744: kernel: untrusted VMM can trigger int80 syscall handling
Component: kernel
Severity: Moderate
CVSS v3: 5.6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H)
Public date: 2024-02-12T00:00:00+00:00

A flaw was found in the Linux kernel. A VMM can inject external interrupts on any arbitrary vector at any time, which may allow the guest OS to be manipulated from the VMM side.


Affected upstream versions: n/a
Fixed upstream versions: v6.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b82a8dbd3d2f4563156f7150c6f2ecab6e960b30
CVE-2024-26130: python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
Component: python-cryptography
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-21T00:00:00+00:00

A flaw was discovered in python-cryptography. A NULL pointer dereference can be triggered when a PKCS#12 key and certificate do not match. Specifically, if the pkcs12.serialize_key_and_certificates function is called with a non-matching certificate and private key and an encryption algorithm with hmac_hash set, the Python process may crash, leading to a denial of service.

Statement: The vulnerability in python-cryptography that leads to a NULL pointer dereference during the pkcs12.serialize_key_and_certificates function execution is classified as a moderate severity issue. While the vulnerability can result in a denial-of-service (DoS) by crashing the Python process, it requires specific conditions to trigger: a mismatch between the provided certificate's public key and private key, coupled with the use of an encryption algorithm with hmac_hash set.

The exploitation of this vulnerability does not directly lead to arbitrary code execution or data leakage. Instead, it causes a controlled termination of the Python process, which, although disruptive, is not as critical as other vulnerabilities that can lead to unauthorized access, data corruption, or code injection. However, it's important to note that denial-of-service conditions can still have operational impacts, disrupting services or causing system instability.

This issue does not affect Red Hat Enterprise Linux 6, 7, 8 and 9 as we dont ship the vulnerable code and package version.

Affected upstream versions: >= 38.0.0, < 42.0.4
Fixed upstream versions: 43.0.0
Upstream repository: https://github.com/pyca/cryptography
Upstream fix commit: 97d231672763cdb5959a3b191e692a362f1b9e55
CVE-2024-26141: rubygem-rack: Possible DoS Vulnerability with Range Header in Rack
Component: rubygem-rack
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-02-22T00:00:00+00:00

A denial of service (DoS) vulnerability was found in rubygem-rack in how it parses Range Header. Carefully crafted range headers can cause a server to respond with an unexpectedly large response. Responding with large responses could lead to a denial of service issue.

Statement: Red Hat rates this vulnerability as a Moderate impact as this requires a specifically crafted response.

Affected upstream versions: >= 3.0.0, < 3.0.9.1, >= 1.3.0, < 2.2.8.1
Fixed upstream versions: v3.0.9.1
Upstream repository: https://github.com/rack/rack
Upstream fix commit: 4849132bef471adb21131980df745f4bb84de2d9
CVE-2024-26144: rubygem-activestorage: Possible Sensitive Session Information Leak in Active Storage
Component: rubygem-activestorage
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2024-02-25T00:00:00+00:00

A flaw was found in Active Storage that may lead to a sensitive session information leak. By default, Active Storage sends a `Set-Cookie` header along with the user’s session cookie when serving blobs and sets `Cache-Control` to public. Certain proxies may cache `Set-Cookie`, leading to an information leak.


Affected upstream versions: >= 5.2.0, < 6.1.7.7, >= 7.0.0, < 7.0.8.1
Fixed upstream versions: v7.0.8.1
Upstream repository: https://github.com/rails/rails
Upstream fix commit: 723f54566023e91060a67b03353e7c03e7436433
CVE-2024-26146: rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing
Component: rubygem-rack
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-02-22T00:00:00+00:00

A denial of service (DoS) vulnerability was found in rubygem-rack in how it parses Rack Header. Carefully crafted headers can cause header parsing in Rack to take longer than expected, resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.


Affected upstream versions: >= 3.0.0, < 3.0.9.1, >= 2.2.0, < 2.2.8.1, >= 2.1.0, < 2.1.4.4, < 2.0.9.4
Fixed upstream versions: v2.0.9.4
Upstream repository: https://github.com/rack/rack
Upstream fix commit: 30b8e39a578b25d4bdcc082c1c52c6f164b59716
CVE-2024-26147: helm: Missing YAML Content Leads To Panic
Component: helm
Severity: Moderate
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-22T00:00:00+00:00

A vulnerability was found in Helm. This flaw may lead to a panic when Helm parses index and plugin yaml files missing expected content, leading to a denial of service.

Statement: Red Hat rates this as Moderate since this would impact the Helm client and requires a malicious plugin to be in place, which can be removed.

Affected upstream versions: < 3.14.2
Fixed upstream versions: v3.15.0
Upstream repository: https://github.com/helm/helm
Upstream fix commit: bb4cc9125503a923afb7988f3eb478722a8580af
CVE-2024-26581: kernel: nftables: nft_set_rbtree skip end interval element from gc
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-02-20T00:00:00+00:00

A flaw was found in the Linux kernel’s Netfilter subsystem. This issue occurs in the nft_set_rbtree. rbtree lazy gc on insert, which might collect an end interval element just added in a transaction and skip the end interval elements not yet active.

Statement: Only privileged user (with access to NetFilter) can trigger this bug. The bug actual only for latest versions of the Red Hat Enterprise Linux 9.

Affected upstream versions: 5.4.262 < 5.4.269, 5.10.190 < 5.10.210, 5.15.124 < 5.15.149, 6.1.43 < 6.1.78, 6.4.8 < 6.5, 6.5
Fixed upstream versions: 0, 5.10.210, 5.15.149, 5.4.269, 6.1.78, 6.5, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c60d252949caf9aba537525195edae6bbabc35eb
CVE-2024-26582: kernel: tls: use-after-free with partial reads and async decrypt
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-02-21T00:00:00+00:00

A use-after-free vulnerability was found in the tls subsystem of the Linux kernel. The tls_decrypt_sg() function doesn't take references on the pages from clear_skb, so the put_page() in tls_decrypt_done() releases them and a use-after-free can be triggered in process_rx_list when trying to read from the partially-read skb. This issue could lead to a denial of service condition or code execution.

Statement: Red Hat Enterprise Linux 6 and 7 are not affected by this CVE as they did not include kernel TLS support (upstream commit 3c4d755). Red Hat Enterprise Linux 8 is not affected as it did not include the upstream commit that introduced this flaw (fd31f39 "tls: rx: decrypt into a fresh skb").

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 20b4ed034872b4d024b26e2bc1092c3f80e5db96
CVE-2024-26583: kernel: tls: race between async notify and socket close
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-21T00:00:00+00:00

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread that calls recvmsg/sendmsg may exit as soon as the async crypto handler calls complete(); any code past that point risks touching already freed data. This could lead to a use-after-free issue and a denial of service condition.

Statement: Red Hat Enterprise Linux 6 and 7 are not affected by this CVE as they did not include kernel TLS support (upstream commit 3c4d755).

Affected upstream versions: 5.4.44 < 5.5, 5.6.16 < 5.7, 5.7
Fixed upstream versions: 0, 5.15.160, 5.5, 5.7, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7
CVE-2024-26584: kernel: tls: handle backlogging of crypto requests
Component: kernel
Severity: Low
CWE: CWE-393 (Return of Wrong Status Code)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-21T00:00:00+00:00

A flaw was found in the tls subsystem of the Linux kernel. When setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on requests to the crypto API, crypto_aead_encrypt and crypto_aead_decrypt functions can return  -EBUSY instead of -EINPROGRESS in valid situations. This issue could lead to undefined behavior and a denial of service condition.

Statement: Red Hat Enterprise Linux 6 and 7 are not affected by this CVE as they did not include kernel TLS support (upstream commit 3c4d755). Because exploitation of this flaw requires either control of system parameters related to cryptography or the ability to generate a significant amount of network traffic to the system, Red Hat assesses the impact of this vulnerability as Low.

Affected upstream versions: 4.16
Fixed upstream versions: 0, 5.15.160, 6.1.84, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3ade391adc584f17b5570fd205de3ad029090368
CVE-2024-26585: kernel: tls: race between tx work scheduling and socket close
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-02-21T00:00:00+00:00

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(), which could lead to undefined behavior and a denial of service.

Statement: Red Hat Enterprise Linux 6 and 7 are not affected by this CVE as they did not include kernel TLS support (upstream commit 3c4d755).

Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.15.165, 6.1.84, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dd32621f19243f89ce830919496a5dcc2158aa33
CVE-2024-26586: kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption
Component: kernel
Severity: Moderate
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-02-22T00:00:00+00:00

A kernel stack flaw that corrupted the Linux kernel’s Mellanox Technologies Spectrum Ethernet driver was found when a user initialized more than 16 access control lists (ACLs). This flaw allows a local user to crash or potentially escalate their privileges on the system.


Affected upstream versions: 4.19
Fixed upstream versions: 0, 5.10.209, 5.15.148, 6.1.79, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 56750ea5d15426b5f307554e7699e8b5f76c3182
CVE-2024-26589: kernel: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
Component: kernel
Severity: Low
CWE: CWE-822 (Untrusted Pointer Dereference)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-22T00:00:00+00:00

A vulnerability has been identified in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The flaw resides within the handling of PTR_TO_FLOW_KEYS (pointer to flow keys) in the check_flow_keys_access() function.

Specifically, while fixed offsets are validated for PTR_TO_FLOW_KEYS, the system currently fails to prohibit variable offset pointer arithmetic for this pointer type. This oversight allows a malicious or specially crafted BPF program to perform an unchecked variable offset addition to the flow keys pointer. This results in an out-of-bounds memory access, which can lead to a kernel crash. This issue directly impacts system availability by causing a denial of service.

Statement: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command:
~~~
# cat /proc/sys/kernel/unprivileged_bpf_disabled
~~~
A setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 29ffa63f21bcdcef3e36b03cccf9d0cd031f6ab0
CVE-2024-26591: kernel: bpf: Fix re-attachment branch in bpf_tracing_prog_attach
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-22T00:00:00+00:00

bpf: Fix re-attachment branch in bpf_tracing_prog_attach

The following case can cause a crash due to missing attach_btf:

1) load rawtp program
2) load fentry program with rawtp as target_fd
3) create tracing link for fentry program with target_fd = 0
4) repeat 3

In the end we have:

- prog->aux->dst_trampoline == NULL
- tgt_prog == NULL (because we did not provide target_fd to link_create)
- prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X)
- the program was loaded for tgt_prog but we have no way to find out which one

    BUG: kernel NULL pointer dereference, address: 0000000000000058
    Call Trace:
     
     ? __die+0x20/0x70
     ? page_fault_oops+0x15b/0x430
     ? fixup_exception+0x22/0x330
     ? exc_page_fault+0x6f/0x170
     ? asm_exc_page_fault+0x22/0x30
     ? bpf_tracing_prog_attach+0x279/0x560
     ? btf_obj_id+0x5/0x10
     bpf_tracing_prog_attach+0x439/0x560
     __sys_bpf+0x1cf4/0x2de0
     __x64_sys_bpf+0x1c/0x30
     do_syscall_64+0x41/0xf0
     entry_SYSCALL_64_after_hwframe+0x6e/0x76

Return -EINVAL in this situation.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a7b98aa10f895e2569403896f2d19b73b6c95653
CVE-2024-26593: kernel: i2c: i801: Fix block process call transactions
Component: kernel
Severity: Low
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

i2c: i801: Fix block process call transactions

According to the Intel datasheets, software must reset the block
buffer index twice for block process call transactions: once before
writing the outgoing data to the buffer, and once again before
reading the incoming data from the buffer.

The driver is currently missing the second reset, causing the wrong
portion of the block buffer to be read.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.210, 5.15.149, 5.4.269, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d074d5ff5ae77b18300e5079c6bda6342a4d44b7
CVE-2024-26595: kernel: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-23T00:00:00+00:00

A flaw was found in the Linux kernel, where a faulty error handler in the driver for certain Mellanox hardware could lead to a null pointer reference. This issue affects system stability.


Affected upstream versions: 4.11
Fixed upstream versions: 0, 6.1.120, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 75fa2d8b3c0175b519c99ace54ab8474cfd0077e
CVE-2024-26598: kernel: kvm: Avoid potential UAF in LPI translation cache
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-02-23T00:00:00+00:00

A flaw was found in the Linux kernel pertaining to a potential use-after-free (UAF) scenario in a system involving Logical Partitioning Interrupts (LPI) translation cache operations. Specifically, the issue arises when a cache hit occurs concurrently with an operation that invalidates the cache, such as a DISCARD ITS command. The root cause is traced to vgic_its_check_cache() not appropriately managing the reference count of the vgic_irq object. Upon returning from this function, the reference count of vgic_irq is not incremented. This issue can lead to the object being prematurely freed while still in use by other parts of the system, potentially resulting in undefined behavior or system instability.

Statement: The vulnerability is assessed as having a Moderate severity due to its potential to cause system instability or undefined behavior under specific conditions. Specifically, the issue arises from concurrent operations involving the LPI translation cache and commands that invalidate this cache, such as DISCARD ITS commands. The root cause lies in vgic_its_check_cache() failing to increment the reference count of the vgic_irq object before releasing the lock. This oversight can lead to a use-after-free scenario where the object may be prematurely freed while still in use elsewhere in the system. As a consequence, if the object is accessed or modified after being freed, it can result in unpredictable behavior, crashes, or even security vulnerabilities if an attacker can control the timing of cache invalidation and subsequent accesses.

Affected upstream versions: 3.11
Fixed upstream versions: 0, 5.10.209, 5.15.148, 5.4.269, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d04acadb6490aa3314f9c9e087691e55de153b88
CVE-2024-26600: kernel: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-24T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel in the phy-omap-usb2 driver. This issue arises when the external PHY used with phy-omap-usb2 does not implement the send_srp() function. If this function is called without proper implementation, it can result in a system crash, especially during operations like waking up an idle Ethernet gadget.

Statement: CVE-2024-26600 is rated as a Low severity because the vulnerability involves a NULL pointer dereference in the phy-omap-usb2 driver, leading to a kernel crash only under specific conditions where the external PHY lacks the send_srp() implementation. This issue does not allow for arbitrary code execution or privilege escalation, limiting its impact to a denial of service (DoS) condition that affects system stability but not security integrity. The specific hardware and configuration requirements further reduce the likelihood of widespread exploitation, justifying its classification.

Affected upstream versions: 3.7
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.78, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 486218c11e8d1c8f515a3bdd70d62203609d4b6b
CVE-2024-26601: kernel: ext4: regenerate buddy after block freeing failed if under fc replay
Component: kernel
Severity: Moderate
CWE: CWE-118 (Incorrect Access of Indexable Resource ('Range Error'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-24T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem related to the fast commit replay process. During this process, blocks that are already marked as free can be incorrectly marked as free again, leading to the corruption of the buddy bitmap, which is used to track free and allocated blocks. This corruption can result in filesystem inconsistencies and potential data loss. The issue is resolved by reintroducing the mb_regenerate_buddy() function, which regenerates the buddy bitmap to ensure its integrity.

Statement: CVE-2024-26601 is considered a Moderate severity issue because its impact is limited to specific conditions during the fast commit replay process of the ext4 filesystem. The vulnerability involves the marking of already free blocks as free, which leads to buddy bitmap corruption. However, this scenario is relatively rare and typically occurs only under certain workload patterns. Additionally, the corruption affects internal filesystem metadata rather than user data directly, reducing the immediate risk of data loss or system compromise. The issue can be mitigated by regenerating the buddy bitmap, and standard filesystem integrity checks and recovery procedures can often address any inconsistencies that arise.

Affected upstream versions: 5.10.181 < 5.10.211, 5.11
Fixed upstream versions: 0, 5.10.211, 5.15.150, 6.1.78, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 94ebf71bddbcd4ab1ce43ae32c6cb66396d2d51a
CVE-2024-26602: kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier
Component: kernel
Severity: Moderate
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-24T00:00:00+00:00

A flaw was found in sys_membarrier in the Linux kernel in sched/membarrier in how a user calls it at too high of a frequency. This flaw allows a local user to saturate the machine.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 944d5fe50f3f03daacfea16300e656a1691c4a23