huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-39503: kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type

Lion Ackermann reported that there is a race condition between namespace cleanup
in ipset and the garbage collection of the list:set type. The namespace
cleanup can destroy the list:set type of sets while the gc of the set type is
waiting to run in rcu cleanup. The latter uses data from the destroyed set which
thus leads use after free. The patch contains the following parts:

- When destroying all sets, first remove the garbage collectors, then wait
  if needed and then destroy the sets.
- Fix the badly ordered "wait then remove gc" for the destroy a single set
  case.
- Fix the missing rcu locking in the list:set type in the userspace test
  case.
- Use proper RCU list handlings in the list:set type.

The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).

Statement: Only local users with `CAP_NET_ADMIN` capability (or root) can trigger this issue. 
On Red Hat Enterprise Linux, local unprivileged users can exploit unprivileged user namespaces (CONFIG_USER_NS) to grant themselves this capability.

The OpenShift Container Platform (OCP) control planes or master machines are based on Red Hat Enterprise Linux CoreOS (RHCOS) that consists primarily of RHEL components, hence is also affected by this kernel vulnerability. Like it is mentioned earlier, the successful exploit needs necessary privileges (CAP_NET_ADMIN) and direct, local access . Local user in RHCOS is already a root with full permissions, hence existence of this vulnerability does not bring any value from the potential attacker perspective. From the OpenShift containers perspective, this vulnerability cannot be exploited as in OpenShift the cluster processes on the node are namespaced, which means that switching in the running OpenShift container the namespace will not bring necessary capabilities.
This means that for OpenShift, the impact of this vulnerability is Low.
Similar to CVE-2023-32233 vulnerability has been explained in the following blog post as an example of "Container escape vulnerability":
https://www.redhat.com/en/blog/containers-vulnerability-risk-assessment

Affected upstream versions: 5.4.269 < 5.4.279, 5.10.210 < 5.10.221, 5.15.149 < 5.15.162, 6.1.79 < 6.1.95, 6.6.18 < 6.6.35, 6.7.6 < 6.8, 6.8
Fixed upstream versions: 0, 5.10.221, 5.15.162, 5.4.279, 6.1.95, 6.10, 6.6.35, 6.8, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c0761d1f1ce1d5b85b5e82bbb714df12de1aa8c3
CVE-2024-39504: kernel: netfilter: nft_inner: validate mandatory meta and payload
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's Netfilter subsystem in the nft_inner component, where the issue occurs when mandatory netlink attributes for payload and meta expressions are not validated in embedded inner expressions, which can lead to a NULL pointer dereference from user space which allow attackers to exploit the system, potentially causing crashes.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b30669fdea0ca03aa22995e6c99f7e7d9dee89ff
CVE-2024-39506: kernel: liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's LiquidIO driver within the lio_vf_rep_copy_packet function, where the issue arises from a NULL pointer check on pg_info->page that is not appropriately handled before it is passed to skb_add_rx_frag(), potentially leading to a NULL pointer dereference.


Affected upstream versions: 4.15
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 87d6bdc006f0cbf297a3b2ad6e40ede4c3ee5dc2
CVE-2024-39507: kernel: net: hns3: fix kernel crash problem in concurrent scenario
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix kernel crash problem in concurrent scenario

When link status change, the nic driver need to notify the roce
driver to handle this event, but at this time, the roce driver
may uninit, then cause kernel crash.

To fix the problem, when link status change, need to check
whether the roce registered, and when uninit, need to wait link
update finish.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.15.162, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 62b5dfb67bfa8bd0301bf3442004563495f9ee48
CVE-2024-39508: kernel: io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
Component: kernel
Severity: Moderate
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's io_uring subsystem within the io_wq handling functions, where the issue stems from concurrent access to worker->flags, which can lead to data races when multiple tasks manipulate this structure simultaneously, which result in  crashes, impacting the reliability of asynchronous I/O operations.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ab702c3483db9046bab9f40306f1a28b22dbbdc0
CVE-2024-40094: graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java
Component: graphql-java
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in GraphQL Java, affecting versions prior to 21.5. This flaw allows an attacker to perform a denial of service (DoS) attack via introspection queries. The issue arises due to the improper handling of ExecutableNormalizedFields (ENFs), which are not adequately considered during the introspection query process. This issue could lead to resource exhaustion and service disruption under certain conditions.


Affected upstream versions: n/a
Fixed upstream versions: v22.0
Upstream repository: https://github.com/graphql-java/graphql-java
Upstream fix commit: 97743bc1b5caa2b0bd894dc8e128b47e4d771e4a
CVE-2024-4032: python: incorrect IPv4 and IPv6 private ranges
Component: python
Severity: Low
CWE: CWE-440 (Expected Behavior Violation)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-06-17T00:00:00+00:00

A flaw was found in Python. The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. Due to this issue, it is possible that values will not be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.


Affected upstream versions: 3.9.0 < 3.9.20, 3.10.0 < 3.10.15, 3.11.0 < 3.11.10, 3.12.0 < 3.12.4, 3.13.0a1 < 3.13.0a6
Fixed upstream versions: 3.9
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 22adf29da8d99933ffed8647d3e0726edd16f7f8
CVE-2024-40634: argocd: Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint in Argo CD
Component: argocd
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-22T00:00:00+00:00

A vulnerability was found in Argo CD. This flaw allows an unauthenticated attacker to send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation leading to service disruption by triggering an out-of-memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments.


Affected upstream versions: >= 1.0.0, < 2.9.20, >= 2.10.0, < 2.10.15, >= 2.11.0, < 2.11.6
Fixed upstream versions: v2.10.15
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 46c0c0b64deaab1ece70cb701030b76668ad0cdc
CVE-2024-40635: containerd: containerd has an integer overflow in User ID handling
Component: containerd
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 4.6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)
Public date: 2025-03-17T21:32:37.894000+00:00

A flaw was found in containerd package. Containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This issue could cause unexpected behavior for environments that require containers to run as a non-root user.

Statement: For Red Hat OpenShift GitOps and OpenShift Container Platform deployments, image sources are controlled through OpenShift's Image configuration and RBAC policies. Administrators can restrict image imports to trusted registries using allowedRegistriesForImport and registrySources configuration.In typical GitOps deployments, application images are pulled from pre-approved registries configured by platform administrators.

Affected upstream versions: < 1.6.38, >= 1.7.0-beta.0, < 1.7.27, >= 2.0.0-beta.0, < 2.0.4
Fixed upstream versions: v1.7.27
Upstream repository: https://github.com/containerd/containerd
Upstream fix commit: 05044ec0a9a75232cad458027ca83437aae3f4da
CVE-2024-4067: micromatch: vulnerable to Regular Expression Denial of Service
Component: micromatch
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-12-12T00:00:00+00:00

A flaw was found in the NPM package `micromatch` where it is vulnerable to a regular expression denial of service (ReDoS). The issue occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will readily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.


Affected upstream versions: <= 4.0.7
Fixed upstream versions: 4.0.8
Upstream repository: https://github.com/micromatch/micromatch
Upstream fix commit: 03aa8052171e878897eee5d7bb2ae0ae83ec2ade
CVE-2024-4068: braces: fails to limit the number of characters it can handle
Component: braces
Severity: Moderate
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-04T00:00:00+00:00

A flaw was found in the NPM package `braces.` It fails to limit the number of characters it can handle, which could lead to memory exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, causing the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.


Affected upstream versions: <= 3.0.2
Fixed upstream versions: 3.0.3
Upstream repository: https://github.com/micromatch/braces
Upstream fix commit: 415d660c3002d1ab7e63dbf490c9851da80596ff
CVE-2024-40896: libxml2: XXE vulnerability
Component: libxml2
Severity: Critical
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Public date: 2024-12-23T00:00:00+00:00

A flaw was found in libxml2. In the affected versions of libxml2, the SAX parser can generate events for external entities, even if custom SAX handlers try to override entity content by setting it to "checked." This vulnerability allows classic  XML External Entity (XXE) attacks.

Statement: This vulnerability is marked as critical severity instead of important due to its potential to completely compromise system security. By exploiting the XXE vulnerability, an attacker can achieve arbitrary file disclosure (e.g., reading `/etc/passwd`), which exposes sensitive system information and credentials. 

In worst-case scenarios, the flaw can lead to Remote Code Execution (RCE) in misconfigured environments or cause a Denial of Service (DoS) through resource exhaustion. The issue is especially critical because it stems from a broken protection mechanism (due to the renaming of the "checked" member), silently leaving downstream applications vulnerable without their knowledge.

Affected upstream versions: 2.11.0 < 2.11.9, 2.12.0 < 2.12.9, 2.13.0 < 2.13.3
Fixed upstream versions: 2.11.9, 2.12.9, 2.13.3
Upstream repository: https://gitlab.gnome.org/GNOME/libxml2
Upstream fix commit: 1a8932303969907f6572b1b6aac4081c56adb5c6
CVE-2024-40901: kernel: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory

There is a potential out-of-bounds access when using test_bit() on a single
word. The test_bit() and set_bit() functions operate on long values, and
when testing or setting a single word, they can exceed the word
boundary. KASAN detects this issue and produces a dump:

	 BUG: KASAN: slab-out-of-bounds in _scsih_add_device.constprop.0 (./arch/x86/include/asm/bitops.h:60 ./include/asm-generic/bitops/instrumented-atomic.h:29 drivers/scsi/mpt3sas/mpt3sas_scsih.c:7331) mpt3sas

	 Write of size 8 at addr ffff8881d26e3c60 by task kworker/u1536:2/2965

For full log, please look at [1].

Make the allocation at least the size of sizeof(unsigned long) so that
set_bit() and test_bit() have sufficient room for read/write operations
without overwriting unallocated memory.

[1] Link: https://lore.kernel.org/all/ZkNcALr3W3KGYYJG@gmail.com/


Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e9bce7c751f6d6c7be88c0bc081a66aaf61a23ee
CVE-2024-40903: kernel: usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the tcpm_register_source_caps function in the Linux kernel's USB Type-C TCPM component. This issue arises when new, potentially invalid source capabilities are advertised while existing capabilities are unregistered, leading to a use-after-free condition if the registration fails.


Affected upstream versions: 6.1.91 < 6.1.95, 6.6.31 < 6.6.35, 6.8.10 < 6.9, 6.9
Fixed upstream versions: 0, 6.1.95, 6.10, 6.6.35, 6.9, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4053696594d7235f3638d49a00cf0f289e4b36a3
CVE-2024-40904: kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
Component: kernel
Severity: Moderate
CWE: CWE-667 (Improper Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's CDC WDM driver, where excessive logging in the interrupt-URB completion callback could lead to CPU lockups, which occurs when the driver rapidly resubmits interrupt URBs after receiving a -EPROTO status, causing a backlog of error messages that ultimately results in a soft lockup.


Affected upstream versions: 2.6.28
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 217d1f44fff560b3995a685a60aa66e55a7f0f56
CVE-2024-40905: kernel: ipv6: fix possible race in __fib6_drop_pcpu_from()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's IPv6 routing component in the __fib6_drop_pcpu_from() function, resulting in a race condition, this vulnerability occurs when the multiple CPUs access and modify a pointer simultaneously, leading to a potential null pointer dereference.


Affected upstream versions: 4.2
Fixed upstream versions: 0, 5.10.221, 5.15.162, 5.4.279, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c90af1cced2f669a7b2304584be4ada495eaa0e5
CVE-2024-40906: kernel: net/mlx5: Always stop health timer during driver removal
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's mlx5 driver, in the driver removal process where the teardown_hca function can fail, where the health timer may continue running, leading to a use-after-free condition when the timer attempts to access freed resources.


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e7d4485d47839f4d1284592ae242c4e65b2810a9
CVE-2024-40907: kernel: ionic: fix kernel panic in XDP_TX action
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's ionic driver, in the XDP_TX action, where the driver sends a packet using a received page that is subsequently freed, if the RX ring buffer is not reset to NULL after this operation, it results in a use of a freed page, leading to a kernel panic.


Affected upstream versions: 6.9
Fixed upstream versions: 0, 6.10, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8812aa35f3e930f61074b9c1ecea26f354992c21
CVE-2024-40911: kernel: wifi: cfg80211: Lock wiphy in cfg80211_get_station
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel in wifi driver in cfg80211_get_station function, where the wiphy was not locked before calling rdev_get_station(), which lead to a NULL pointer dereference when a station disconnects and reconnects during a work queue operation, resulting in a kernel panic.


Affected upstream versions: 3.16
Fixed upstream versions: 0, 5.15.162, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dfd84ce41663be9ca3f69bd657c45f49b69344d9
CVE-2024-40912: kernel: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's mac80211 component within the ieee80211_sta_ps_deliver_wakeup() function, where improper locking of the sta->ps_lock can lead to a deadlock condition, which occurs because the function uses a spin lock without preventing softirq execution on the same CPU, causing potential stalls.


Affected upstream versions: 3.2.56 < 3.3, 3.4.84 < 3.5, 3.10.34 < 3.11, 3.12.15 < 3.13, 3.13.7 < 3.14, 3.14
Fixed upstream versions: 0, 3.11, 3.13, 3.14, 3.3, 3.5, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e51637e0c66a6f72d134d9f95daa47ea62b43c7e
CVE-2024-40913: kernel: cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
Component: kernel
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's cachefiles component, regarding the handling of anonymous file descriptors. This issue occurs when an anonymous fd is exposed to userland before confirming the success of the copy_to_user() operation, which can lead to a use-after-free condition.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: eac51d9daacd61dcc93333ff6a890cf3efc8c1c0
CVE-2024-40914: kernel: mm/huge_memory: don&#39;t unpoison huge_zero_folio
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's memory management component in the unpoison_memory() function, where it involves improper handling of huge_zero_folio when memory failures occur, which can lead to a kernel panic due to an erroneous reference count.


Affected upstream versions: 5.15.41 < 5.15.162, 5.17.9 < 5.18, 5.18
Fixed upstream versions: 0, 5.15.162, 5.18, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 688bb46ad339497b5b7f527b6636d2afe04b46af
CVE-2024-40919: kernel: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()

In case of token is released due to token->state == BNXT_HWRM_DEFERRED,
released token (set to NULL) is used in log messages. This issue is
expected to be prevented by HWRM_ERR_CODE_PF_UNAVAILABLE error code. But
this error code is returned by recent firmware. So some firmware may not
return it. This may lead to NULL pointer dereference.
Adjust this issue by adding token pointer check.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cde177fa235cd36f981012504a6376315bac03c9