huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-42228: kernel: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
Component: kernel
Severity: Moderate
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's amdgpu driver in the amdgpu_vce_ring_parse_cs() function where the size variable is initialized with a pointer that may not be properly set before use. This issue could lead to unpredictable behavior in the system.

Statement: Red Hat believes this flaw to be of Moderate severity with a low impact on confidentiality given that the component primarily impacted by this vulnerability is an AMD GPU driver, which is used mainly for rendering graphics on the system. As such, a successful exploit of this vulnerability would likely not result in any sensitive information being leaked.

Affected upstream versions: 4.2
Fixed upstream versions: 0, 4.19.321, 5.10.225, 5.15.166, 5.4.283, 6.1.108, 6.10, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d35cf41c8eb5d9fe95b21ae6ee2910f9ba4878e8
CVE-2024-42237: kernel: firmware: cs_dsp: Validate payload length before processing block
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Validate payload length before processing block

Move the payload length check in cs_dsp_load() and cs_dsp_coeff_load()
to be done before the block is processed.

The check that the length of a block payload does not exceed the number
of remaining bytes in the firwmware file buffer was being done near the
end of the loop iteration. However, some code before that check used the
length field without validating it.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 259955eca9b7acf1299b1ac077d8cfbe12df35d8
CVE-2024-42238: kernel: firmware: cs_dsp: Return error if block header overflows file
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-07T00:00:00+00:00

A denial of service vulnerability was found in the Linux kernel. No error was returned from the cs_dsp_power_up() function if a block header is longer than the amount of data left in the file.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b8be70566b33abbd0180105070b4c67cfef8c44f
CVE-2024-42240: kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-07T00:00:00+00:00

A denial of service vulnerability was found in the Linux kernel. When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set, then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY and calls the clear_bhb_loop() before the TF flag is cleared. This causes the #DB handler (exc_debug_kernel()) to issue a warning that results in a software crash.


Affected upstream versions: 5.15.154 < 5.15.163, 6.1.85 < 6.1.100, 6.6.26 < 6.6.41, 6.8.5 < 6.9, 6.9
Fixed upstream versions: 0, 5.15.163, 6.1.100, 6.10, 6.6.41, 6.9, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: db56615e96c439e13783d7715330e824b4fd4b84
CVE-2024-42241: kernel: mm/shmem: disable PMD-sized page cache if needed
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-07T00:00:00+00:00

A denial of service vulnerability was found in the Linux Kernel. In architectures such as ARM64 where the base page size is 64KB, a 512MB page cache could lead to a software crash.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 93893eacb372b0a4a30f7de6609b08c3ba6c4fd9
CVE-2024-42244: kernel: USB: serial: mos7840: fix crash on resume
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: mos7840: fix crash on resume

Since commit c49cfa917025 ("USB: serial: use generic method if no
alternative is provided in usb serial layer"), USB serial core calls the
generic resume implementation when the driver has not provided one.

This can trigger a crash on resume with mos7840 since support for
multiple read URBs was added back in 2011. Specifically, both port read
URBs are now submitted on resume for open ports, but the context pointer
of the second URB is left set to the core rather than mos7840 port
structure.

Fix this by implementing dedicated suspend and resume functions for
mos7840.

Tested with Delock 87414 USB 2.0 to 4x serial adapter.

[ johan: analyse crash and rewrite commit message; set busy flag on
         resume; drop bulk-in check; drop unnecessary usb_kill_urb() ]


Affected upstream versions: 3.3
Fixed upstream versions: 0, 5.10.222, 5.15.163, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 932a86a711c722b45ed47ba2103adca34d225b33
CVE-2024-42245: kernel: Revert "sched/fair: Make sure to try to detach at least one movable task"
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Revert "sched/fair: Make sure to try to detach at least one movable task"

This reverts commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06.

b0defa7ae03ec changed the load balancing logic to ignore env.max_loop if
all tasks examined to that point were pinned. The goal of the patch was
to make it more likely to be able to detach a task buried in a long list
of pinned tasks. However, this has the unfortunate side effect of
creating an O(n) iteration in detach_tasks(), as we now must fully
iterate every task on a cpu if all or most are pinned. Since this load
balance code is done with rq lock held, and often in softirq context, it
is very easy to trigger hard lockups. We observed such hard lockups with
a user who affined O(10k) threads to a single cpu.

When I discussed this with Vincent he initially suggested that we keep
the limit on the number of tasks to detach, but increase the number of
tasks we can search. However, after some back and forth on the mailing
list, he recommended we instead revert the original patch, as it seems
likely no one was actually getting hit by the original issue.


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d467194018dd536fe6c65a2fd3aedfcdb1424903
CVE-2024-42246: kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
Component: kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-07T00:00:00+00:00

A flaw was found in the Linux kernel's bpf programs. Under certain conditions, when the kernel attempts to initiate a network connection using the kernel_connect function, it can return a value that causes the cx_tcp_setup_socket function to loop. This issue can lead to continuous data writing to the Syslog, filling up the available space and causing the kernel to freeze and become unresponsive.


Affected upstream versions: 4.17
Fixed upstream versions: 0, 4.19.322, 5.10.226, 5.15.167, 5.4.284, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bc790261218952635f846aaf90bcc0974f6f62c6
CVE-2024-42253: kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
Component: kernel
Severity: Low
CWE: CWE-667 (Improper Locking)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gpio: pca953x: fix pca953x_irq_bus_sync_unlock race

Ensure that `i2c_lock' is held when setting interrupt latch and mask in
pca953x_irq_bus_sync_unlock() in order to avoid races.

The other (non-probe) call site pca953x_gpio_set_multiple() ensures the
lock is held before calling pca953x_write_regs().

The problem occurred when a request raced against irq_bus_sync_unlock()
approximately once per thousand reboots on an i.MX8MP based system.

 * Normal case

   0-0022: write register AI|3a {03,02,00,00,01} Input latch P0
   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0
   0-0022: write register AI|08 {ff,00,00,00,00} Output P3
   0-0022: write register AI|12 {fc,00,00,00,00} Config P3

 * Race case

   0-0022: write register AI|08 {ff,00,00,00,00} Output P3
   0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register ***
   0-0022: write register AI|12 {fc,00,00,00,00} Config P3
   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0


Affected upstream versions: 4.7
Fixed upstream versions: 0, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 58a5c93bd1a6e949267400080f07e57ffe05ec34
CVE-2024-42258: kernel: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines

Yves-Alexis Perez reported commit 4ef9ad19e176 ("mm: huge_memory: don't
force huge page alignment on 32 bit") didn't work for x86_32 [1].  It is
because x86_32 uses CONFIG_X86_32 instead of CONFIG_32BIT.

!CONFIG_64BIT should cover all 32 bit machines.

[1] https://lore.kernel.org/linux-mm/CAHbLzkr1LwH3pcTgM+aGQ31ip2bKqiqEQ8=FQB+t2c3dhNKNHA@mail.gmail.com/


Affected upstream versions: 6.1.81 < 6.1.105, 6.7.6 < 6.8, 6.8
Fixed upstream versions: 0, 6.1.105, 6.10.3, 6.11, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 89f2914dd4b47d2fad3deef0d700f9526d98d11f
CVE-2024-42265: kernel: protect the fetch of -&gt;fd[fd] in do_dup2() from mispredictions
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

protect the fetch of ->fd[fd] in do_dup2() from mispredictions

both callers have verified that fd is not greater than ->max_fds;
however, misprediction might end up with
        tofree = fdt->fd[fd];
being speculatively executed.  That's wrong for the same reasons
why it's wrong in close_fd()/file_close_fd_locked(); the same
solution applies - array_index_nospec(fd, fdt->max_fds) could differ
from fd only in case of speculative execution on mispredicted path.


Affected upstream versions: 3.7
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.104, 6.10.4, 6.11, 6.6.45
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ed42e8ff509d2a61c6642d1825032072dab79f26
CVE-2024-42268: kernel: net/mlx5: Fix missing lock on sync reset reload
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

On sync reset reload work, when remote host updates devlink on reload
actions performed on that host, it misses taking devlink lock before
calling devlink_remote_reload_actions_performed() which results in
triggering lock assert. This may lead to a crash.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.104, 6.10.4, 6.11, 6.6.45
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5d07d1d40aabfd61bab21115639bd4f641db6002
CVE-2024-42271: kernel: net/iucv: fix use after free in iucv_sock_close()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

A possible use-after-free vulnerability was found in the Linux kernel in iucv_sock_close(). This issue may lead to a crash or memory corruption.

Statement: This flaw is only applicable to systems using IUCV networking on s390 hardware, typically mainframes. Additionally, exploitation requires privileges necessary to establish and tear down IUCV connections with either the volume of connections or control over timing necessary to cause a race condition. Because of the specificity required of both the target and its deployment, Red Hat has assessed the impact of this flaw as Moderate.

Affected upstream versions: 3.4
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.104, 6.10.4, 6.11, 6.6.45
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 84f40b46787ecb67c7ad08a5bb1376141fa10c01
CVE-2024-42272: kernel: sched: act_ct: take care of padding in struct zones_ht_key
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

rhashtable_lookup() may be using padding bytes which are not initialized. This may lead to possible compromised Availability.

Statement: Red Hat Enterprise Linux 7 and 8 are not affected by this vulnerability.

Affected upstream versions: 5.10.221 < 5.10.224, 5.15.162 < 5.15.165, 6.1.96 < 6.1.104, 6.6.36 < 6.6.45, 6.9.7 < 6.10, 6.10
Fixed upstream versions: 0, 5.10.224, 5.15.165, 6.1.104, 6.10, 6.10.4, 6.11, 6.6.45
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7c03ab555eb1ba26c77fd7c25bdf44a0ac23edee
CVE-2024-42276: kernel: nvme-pci: add missing condition check for existence of mapped data
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

nvme-pci in linux kernel does not call nvme_unmap_data for the same instances of nvme_map_data, which can lead to incorrect dereferencing.


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3f8ec1d6b0ebd8268307d52be8301973fa5a01ec
CVE-2024-42278: kernel: ASoC: TAS2781: Fix tasdev_load_calibrated_data()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved: ASoC: TAS2781: Fix tasdev_load_calibrated_data(). This function has a reversed if statement resulting in  a no-op or leading to a NULL dereference.

Statement: Red Hat Enterprise Linux 6, 7, and 8 is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Affected upstream versions: 6.6.33 < 6.6.44, 6.9.4 < 6.10, 6.10
Fixed upstream versions: 0, 6.10, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6d98741dbd1309a6f2d7cffbb10a8f036ec3ca06
CVE-2024-42283: kernel: net: nexthop: Initialize all fields in dumped nexthops
Component: kernel
Severity: Moderate
CWE: CWE-456 (Missing Initialization of a Variable)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: nexthop: Initialize all fields in dumped nexthops

struct nexthop_grp contains two reserved fields that are not initialized by
nla_put_nh_group(), and carry garbage. This can be observed e.g. with
strace (edited for clarity):

    # ip nexthop add id 1 dev lo
    # ip nexthop add id 101 group 1
    # strace -e recvmsg ip nexthop get id 101
    ...
    recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},
                 [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52

The fields are reserved and therefore not currently used. But as they are, they
leak kernel memory, and the fact they are not just zero complicates repurposing
of the fields for new ends. Initialize the full structure.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fd06cb4a5fc7bda3dea31712618a62af72a1c6cb
CVE-2024-42284: kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error
Component: kernel
Severity: Moderate
CWE: CWE-393 (Return of Wrong Status Code)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2024-08-17T00:00:00+00:00

A flaw was found in Linux kernel tipc. tipc_udp_addr2str() does not return a nonzero value when UDP media address is invalid, which can result in a buffer overflow in tipc_media_addr_printf().

Statement: This vulnerability exists in the kernel's TIPC networking code. This functionality is typically only used for low-latency interprocess communication between nodes in a cluster computer. Additionally, an attacker must be able to create a UDP connection with an invalid address. Since this vulnerability is only applicable to systems using TIPC and exploitation requires an attacker to already have significant privileges on the target system, Red Hat assesses this flaw as having Moderate impact.

Affected upstream versions: 4.1
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7ec3335dd89c8d169e9650e4bac64fde71fdf15b
CVE-2024-42291: kernel: ice: Add a per-VF limit on number of FDIR filters
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

ice in linux kernel permits VF driver to request more than designated limit of FDIR filters, which can lead to resource exhaustion for other VFs.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.172, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e81b674ead8e2172b2a69e7b45e079239ace4dbc
CVE-2024-42292: kernel: kobject_uevent: Fix OOB access within zap_modalias_env()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

in linux kernel's kobject_uevent, zap_modalias_env incorrectly calculates the size of the memory block to move, which may cause out of bounds memory access.


Affected upstream versions: 4.15
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 81a15d28f32af01493ae8c5457e0d55314a4167d
CVE-2024-42301: kernel: dev/parport: fix the array out-of-bounds risk
Component: kernel
Severity: Moderate
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

An array out-of-bounds flaw was found in dev/parport in the Linux kernel. This issue may result in a crash.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 166a0bddcc27de41fe13f861c8348e8e53e988c8
CVE-2024-42302: kernel: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
Component: kernel
Severity: Moderate
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

A use-after-free flaw was found in concurrent DPC and hot-removal in the Linux kernel. This issue may result in a crash.

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability.

Affected upstream versions: 5.10.176 < 5.10.224, 5.15.104 < 5.15.165, 6.1.16 < 6.1.103, 6.2.3 < 6.3, 6.3
Fixed upstream versions: 0, 5.10.224, 5.15.165, 6.1.103, 6.10.3, 6.11, 6.3, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c52f9e1a9eb40f13993142c331a6cfd334d4b91d
CVE-2024-42304: kernel: ext4: make sure the first directory block is not a hole
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-17T00:00:00+00:00

The syzbot constructs a directory that has no dirblock but is non-inline,
i.e. the first directory block is a hole. And no errors are reported when
creating files in this directory. Then, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash.


Affected upstream versions: 4.19.62 < 4.19.320, 4.9.187 < 4.10, 4.14.135 < 4.15, 5.1.21 < 5.2, 5.2.4 < 5.3, 5.3
Fixed upstream versions: 0, 4.10, 4.15, 4.19.320, 5.10.224, 5.15.165, 5.2, 5.3, 5.4.282, 6.1.103, 6.10.3, 6.11, 6.6.44
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d81d7e347d1f1f48a5634607d39eb90c161c8afe