huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-41039: kernel: firmware: cs_dsp: Fix overflow checking of wmfw header
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-07-29T00:00:00+00:00

A vulnerability was found in the Linux kernel's firmware driver cs_dsp.c, where a buffer overflow is possible in the wmfw header due to insufficient buffer size checks. The issue stems from the size of one of the structs that the code checks, the wmfw_adsp?_sizes struct, which can vary depending on whether the firmware used is ADSP1 or ADSP2 and Halo Core. In the second case, the wmfw_adsp2_sizes struct is 4 bytes longer, which can cause a buffer overflow, potentially leading to undefined behavior in the system.

Statement: Red Hat believes this flaw to be of moderate severity because successful exploitation of this vulnerability would require elevated privileges to be able to access/modify the firmware loading mechanism. It also presents an elevated attack complexity given that the attacker requires knowledge of the Cirrus Logic DSP firmware to be able to craft special firmware to exploit the buffer overflow. Finally, depending on when the vulnerability is executed (ex. at boot time or during runtime) the impact on the system might change drastically; in one scenario it might cause a kernel crash in another just the audio driver might stop working.

Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fd035f0810b33c2a8792effdb82bf35920221565
CVE-2024-41040: kernel: net/sched: Fix UAF when resolving a clash
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-07-29T00:00:00+00:00

A use-after-free vulnerability was found in the net/sshd tcf_ct_flow_table_process_conn of the Linux kernel. This flaw allows an attacker with a crafted payload to induce a system crash, resulting in a loss of system availability.

Statement: Because exploitation of this flaw requires an attacker to have sufficient access to a system to generate significant amounts of spurious traffic, and because an attacker has very limited control over the consequences of the data corruption caused by this vulnerability, Red Hat assesses its impact as Moderate.

Affected upstream versions: 5.10.43 < 5.10.222, 5.12.10 < 5.13, 5.13
Fixed upstream versions: 0, 5.10.222, 5.13, 5.15.163, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b81a523d54ea689414f67c9fb81a5b917a41ed55
CVE-2024-41042: kernel: netfilter: nf_tables: prefer nft_chain_validate
Component: kernel
Severity: Low
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: prefer nft_chain_validate

nft_chain_validate already performs loop detection because a cycle will
result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE).

It also follows maps via ->validate callback in nft_lookup, so there
appears no reason to iterate the maps again.

nf_tables_check_loops() and all its helper functions can be removed.
This improves ruleset load time significantly, from 23s down to 12s.

This also fixes a crash bug. Old loop detection code can result in
unbounded recursion:

BUG: TASK stack guard page was hit at ....
Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN
CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1
[..]

with a suitable ruleset during validation of register stores.

I can't see any actual reason to attempt to check for this from
nft_validate_register_store(), at this point the transaction is still in
progress, so we don't have a full picture of the rule graph.

For nf-next it might make sense to either remove it or make this depend
on table->validate_state in case we could catch an error earlier
(for improved error reporting to userspace).


Affected upstream versions: 3.13
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.105, 6.10, 6.6.46, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1947e4c3346faa8ac7e343652c0fd3b3e394202f
CVE-2024-41044: kernel: ppp: reject claimed-as-LCP but actually malformed packets
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

The vulnerability was found in the Linux kernel's ppp ppp_generic.c driver, in the ppp_read() and ppp_write() functions where malformed packets were erroneously identified as LCP packets, leading to potential issues with packet handling. This flaw could potentially lead to system instability.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.19.318, 5.10.222, 5.15.163, 5.4.280, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 97d1efd8be26615ff680cdde86937d5943138f37
CVE-2024-41049: kernel: filelock: fix potential use-after-free in posix_lock_inode
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-29T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel in trace_posix_lock_inode(). This issue occurred when the request pointer was changed to point to a lock entry added to the inode's list. Before the tracepoint could fire, another task raced in and freed the lock.

Statement: Because this vulnerability requires a degree of control over the target system sufficient to control system timings and trigger crafted race conditions, Red Hat assesses its security impact as Moderate.

Affected upstream versions: 5.4.257 < 5.4.280, 5.10.197 < 5.10.222, 5.15.133 < 5.15.163, 6.1.55 < 6.1.100, 6.5.5 < 6.6, 6.6
Fixed upstream versions: 0, 5.10.222, 5.15.163, 5.4.280, 6.1.100, 6.10, 6.6, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1cbbb3d9475c403ebedc327490c7c2b991398197
CVE-2024-41055: kernel: mm: prevent derefencing NULL ptr in pfn_section_valid()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm: prevent derefencing NULL ptr in pfn_section_valid()

Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing
memory_section->usage") changed pfn_section_valid() to add a READ_ONCE()
call around "ms->usage" to fix a race with section_deactivate() where
ms->usage can be cleared.  The READ_ONCE() call, by itself, is not enough
to prevent NULL pointer dereference.  We need to check its value before
dereferencing it.


Affected upstream versions: 5.10.210 < 5.10.222, 5.15.149 < 5.15.163, 6.1.76 < 6.1.100, 6.6.15 < 6.6.41, 6.7.3 < 6.8, 6.8
Fixed upstream versions: 0, 5.10.222, 5.15.163, 6.1.100, 6.10, 6.6.41, 6.8, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0100aeb8a12d51950418e685f879cc80cb8e5982
CVE-2024-41056: kernel: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-07-29T00:00:00+00:00

A buffer overrun flaw exists in the Linux kernel when the strlen function is used on name fields in V1 wmfw files. This issue results in a loss of system availability.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 16d76857d6b5426f41b587d0bb925de3f25bfb21
CVE-2024-41057: kernel: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-29T00:00:00+00:00

A potential use after free was found in the Linux kernel.

Statement: Red Hat Product Security has rated the attack complexity as high for the following reasons:

1. To get this bug to work, precise ordering in concurrent operations on cache volumes/cookies need to be broken, thereby causing a race condition.
2. Reproducing a use-after-free from a race is not very deterministic
3. The state is super important as cachefiles_withdraw_cookies() are called only during specific lifecycle events.
4. It can not be easily triggered by unprivileged users.

Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8de253177112a47c9af157d23ae934779188b4e1
CVE-2024-41058: kernel: cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-29T00:00:00+00:00

A slab-use-after-free was found in fscache_withdraw_volume() in the Linux kernel.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 90f17e47f1e209c6a3c92a1d038a0a80c95c460e
CVE-2024-41060: kernel: drm/radeon: check bo_va-&gt;bo is non-NULL before using it
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: check bo_va->bo is non-NULL before using it

The call to radeon_vm_clear_freed might clear bo_va->bo, so
we have to check it before dereferencing it.


Affected upstream versions: 3.19
Fixed upstream versions: 0, 5.10.234, 5.15.164, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e8d3c53c6f1cccea9c03113f06dd39521c228831
CVE-2024-41062: kernel: bluetooth/l2cap: sync sock recv cb and release
Component: kernel
Severity: Moderate
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bluetooth/l2cap: sync sock recv cb and release

The problem occurs between the system call to close the sock and hci_rx_work,
where the former releases the sock and the latter accesses it without lock protection.

           CPU0                       CPU1
           ----                       ----
           sock_close                 hci_rx_work
	   l2cap_sock_release         hci_acldata_packet
	   l2cap_sock_kill            l2cap_recv_frame
	   sk_free                    l2cap_conless_channel
	                              l2cap_sock_recv_cb

If hci_rx_work processes the data that needs to be received before the sock is
closed, then everything is normal; Otherwise, the work thread may access the
released sock when receiving data.

Add a chan mutex in the rx callback of the sock to achieve synchronization between
the sock release and recv cb.

Sock is dead, so set chan data to NULL, avoid others use invalid sock pointer.

Statement: Following issue marked as moderate with "not affected or will not fix" for Red Hat Enterprise Linux, as it is not vulnerable to this CVE. This is because the CVE does not impact the versions or configurations of the Linux kernel used in Red Hat's distributions.

Affected upstream versions: 3.4
Fixed upstream versions: 0, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 605572e64cd9cebb05ed609d96cff05b50d18cdf
CVE-2024-41063: kernel: Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
Component: kernel
Severity: Low
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: cancel all works upon hci_unregister_dev()

syzbot is reporting that calling hci_release_dev() from hci_error_reset()
due to hci_dev_put() from hci_error_reset() can cause deadlock at
destroy_workqueue(), for hci_error_reset() is called from
hdev->req_workqueue which destroy_workqueue() needs to flush.

We need to make sure that hdev->{rx_work,cmd_work,tx_work} which are
queued into hdev->workqueue and hdev->{power_on,error_reset} which are
queued into hdev->req_workqueue are no longer running by the moment

       destroy_workqueue(hdev->workqueue);
       destroy_workqueue(hdev->req_workqueue);

are called from hci_release_dev().

Call cancel_work_sync() on these work items from hci_unregister_dev()
as soon as hdev->list is removed from hci_dev_list.


Affected upstream versions: 4.19.309 < 4.19.319, 5.4.271 < 5.4.281, 5.10.212 < 5.10.223, 5.15.151 < 5.15.164, 6.1.81 < 6.1.101, 6.6.21 < 6.6.42, 6.7.9 < 6.8, 6.8
Fixed upstream versions: 0, 4.19.319, 5.10.223, 5.15.164, 5.4.281, 6.1.101, 6.10, 6.6.42, 6.8, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 48542881997e17b49dc16b93fe910e0cfcf7a9f9
CVE-2024-41064: kernel: powerpc/eeh: avoid possible crash when edev-&gt;pdev changes
Component: kernel
Severity: Moderate
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

powerpc/eeh: avoid possible crash when edev->pdev changes

If a PCI device is removed during eeh_pe_report_edev(), edev->pdev
will change and can cause a crash, hold the PCI rescan/remove lock
while taking a copy of edev->pdev->bus.

Statement: Following issue marked as moderate with "not affected or will not fix" for Red Hat Enterprise Linux, as it is not vulnerable to this CVE. This is because the CVE does not impact the versions or configurations of the Linux kernel used in Red Hat's distributions.

Affected upstream versions: 3.7
Fixed upstream versions: 0, 5.10.223, 5.15.164, 5.4.281, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8836e1bf5838ac6c08760e0a2dd7cf6410aa7ff3
CVE-2024-41065: kernel: powerpc/pseries: Whitelist dtl slub object for copying to userspace
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

powerpc/pseries: Whitelist dtl slub object for copying to userspace

Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-*
results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as
shown below.

    kernel BUG at mm/usercopy.c:102!
    Oops: Exception in kernel mode, sig: 5 [#1]
    LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
    Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc
    scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse
    CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85
    Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries
    NIP:  c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8
    REGS: c000000120c078c0 TRAP: 0700   Not tainted  (6.10.0-rc3)
    MSR:  8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 2828220f  XER: 0000000e
    CFAR: c0000000001fdc80 IRQMASK: 0
    [ ... GPRs omitted ... ]
    NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0
    LR [c0000000005d23d0] usercopy_abort+0x74/0xb0
    Call Trace:
     usercopy_abort+0x74/0xb0 (unreliable)
     __check_heap_object+0xf8/0x120
     check_heap_object+0x218/0x240
     __check_object_size+0x84/0x1a4
     dtl_file_read+0x17c/0x2c4
     full_proxy_read+0x8c/0x110
     vfs_read+0xdc/0x3a0
     ksys_read+0x84/0x144
     system_call_exception+0x124/0x330
     system_call_vectored_common+0x15c/0x2ec
    --- interrupt: 3000 at 0x7fff81f3ab34

Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0")
requires that only whitelisted areas in slab/slub objects can be copied to
userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY.
Dtl contains hypervisor dispatch events which are expected to be read by
privileged users. Hence mark this safe for user access.
Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the
entire object.


Affected upstream versions: 3.0
Fixed upstream versions: 0, 5.10.223, 5.15.164, 5.4.281, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a7b952941ce07e1e7a2cafd08c64a98e14f553e6
CVE-2024-41066: kernel: ibmvnic: Add tx check to prevent skb leak
Component: kernel
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ibmvnic: Add tx check to prevent skb leak

Below is a summary of how the driver stores a reference to an skb during
transmit:
    tx_buff[free_map[consumer_index]]->skb = new_skb;
    free_map[consumer_index] = IBMVNIC_INVALID_MAP;
    consumer_index ++;
Where variable data looks like this:
    free_map == [4, IBMVNIC_INVALID_MAP, IBMVNIC_INVALID_MAP, 0, 3]
                                               	consumer_index^
    tx_buff == [skb=null, skb=<ptr>, skb=<ptr>, skb=null, skb=null]

The driver has checks to ensure that free_map[consumer_index] pointed to
a valid index but there was no check to ensure that this index pointed
to an unused/null skb address. So, if, by some chance, our free_map and
tx_buff lists become out of sync then we were previously risking an
skb memory leak. This could then cause tcp congestion control to stop
sending packets, eventually leading to ETIMEDOUT.

Therefore, add a conditional to ensure that the skb address is null. If
not then warn the user (because this is still a bug that should be
patched) and free the old pointer to prevent memleak/tcp problems.

Statement: This vulnerability exists in the driver for IBM System i/p virtual network adapters. By exploiting this vulnerability, an attacker can cause a leak in memory pools used for processing network traffic, which can cause the kernel's congestion control mechanisms to erroneously stop transmitting packets, effectively a denial of service. Because the affected hardware is uncommon, and because an attacker must be able to generate a large amount of network traffic that is handled specifically by a virtual NIC on that hardware, Red Hat assesses the impact of this vulnerability as Low.

Affected upstream versions: 5.12.17 < 5.13, 5.13.2 < 5.14, 5.14
Fixed upstream versions: 0, 5.13, 5.14, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 16ad1557cae582e79bb82dddd612d9bdfaa11d4c
CVE-2024-41073: kernel: nvme: avoid double free special payload
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme: avoid double free special payload

If a discard request needs to be retried, and that retry may fail before
a new special payload is added, a double free will result. Clear the
RQF_SPECIAL_LOAD when the request is cleaned.


Affected upstream versions: 4.10
Fixed upstream versions: 0, 5.10.237, 5.15.164, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 882574942a9be8b9d70d13462ddacc80c4b385ba
CVE-2024-41076: kernel: NFSv4: Fix memory leak in nfs4_set_security_label
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-07-29T00:00:00+00:00

A vulnerability was found in the nfs4_set_security_label() in the Linux kernel, where the function fails to free the nfs_fattr attribute before exiting, leaving said memory allocation present. As the nfs4_set_security_label() is called repeatedly over time, this may lead to memory exhaustion.

Statement: Red Hat believes this flaw to be of low severity as the only effect of this vulnerability is to lead to memory leakage which, called repeatedly over time, may lead to memory exhaustion and impact the system's performance. Given that the max xattr size on NFSv4 systems is quite small (typically 1KB; and security xattrs tend to be significantly smaller) it is safe to assume that a system's availability being impacted solely from memory exhaustion caused by this vulnerability is unlikely and thus its impact is low.

Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 899604a7c958771840941caff9ee3dd8193d984c
CVE-2024-41077: kernel: null_blk: fix validation of block size
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

null_blk: fix validation of block size

Block size should be between 512 and PAGE_SIZE and be a power of 2. The current
check does not validate this, so update the check.

Without this patch, null_blk would Oops due to a null pointer deref when
loaded with bs=1536 [1].


[axboe: remove unnecessary braces and != 0 check]


Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.223, 5.15.164, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9625afe1dd4a158a14bb50f81af9e2dac634c0b1
CVE-2024-41079: kernel: nvmet: always initialize cqe.result
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvmet: always initialize cqe.result

The spec doesn't mandate that the first two double words (aka results)
for the command queue entry need to be set to 0 when they are not
used (not specified). Though, the target implemention returns 0 for TCP
and FC but not for RDMA.

Let's make RDMA behave the same and thus explicitly initializing the
result field. This prevents leaking any data from the stack.


Affected upstream versions: 4.8
Fixed upstream versions: 0, 5.15.209, 6.1.101, 6.10, 6.6.42, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c6a2cf8b0764f3ba7d9bff58c8775a6d4476bb29