huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-36012: kernel: Bluetooth: msft: fix slab-use-after-free in msft_do_close()
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)
Public date: 2024-05-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

Tying the msft->data lifetime to hdev by freeing it in
hci_release_dev() to fix the following case:

[use]
msft_do_close()
  msft = hdev->msft_data;
  if (!msft)                      ...(1) <- passed.
    return;
  mutex_lock(&msft->filter_lock); ...(4) <- used after freed.

[free]
msft_unregister()
  msft = hdev->msft_data;
  hdev->msft_data = NULL;         ...(2)
  kfree(msft);                    ...(3) <- msft is freed.

==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common
kernel/locking/mutex.c:587 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30
kernel/locking/mutex.c:752
Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309


Affected upstream versions: 5.12
Fixed upstream versions: 0, 6.1.91, 6.6.31, 6.8.10, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e3880b531b68f98d3941d83f2f6dd11cf4fd6b76
CVE-2024-36013: kernel: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-05-23T00:00:00+00:00

A use-after-free vulnerability exists in the Bluetooth stack of the Linux kernel. The l2cap_connect() does not return void during the function return, potentially leading to a loss of system availability.


Affected upstream versions: 3.0
Fixed upstream versions: 0, 6.1.178, 6.6.32, 6.8.11, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8629a65a48890769c47ebc9b6e57c02a80a8975e
CVE-2024-36015: kernel: ppdev: Add an error check in register_device
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ppdev: Add an error check in register_device

In register_device, the return value of ida_simple_get is unchecked,
in witch ida_simple_get will use an invalid index value.

To address this issue, index should be checked after ida_simple_get. When
the index value is abnormal, a warning message should be printed, the port
should be dropped, and the value should be recorded.


Affected upstream versions: 4.9.22 < 4.10, 4.10.7 < 4.11, 4.11
Fixed upstream versions: 0, 4.10, 4.11, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 65cd017d43f4319a56747d38308b0a24cf57299e
CVE-2024-36016: kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.4 (CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-05-29T00:00:00+00:00

A vulnerability was found in the Linux kernel's `n_gsm` driver, affecting the `tty` subsystem. It occurs when switching between basic and advanced option modes in GSM multiplexing, leading to potential out-of-bounds memory writes. This happens because certain state variables, like `gsm->len` and `gsm->state`, are not properly reset during mode changes. The issue could result in memory corruption.


Affected upstream versions: 2.6.35
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.8.12, 6.9.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9513d4148950b05bc99fa7314dc883cc0e1605e5
CVE-2024-36017: kernel: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a
struct ifla_vf_vlan_info so the size of such attribute needs to be at least
of sizeof(struct ifla_vf_vlan_info) which is 14 bytes.
The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)
which is less than sizeof(struct ifla_vf_vlan_info) so this validation
is not enough and a too small attribute might be cast to a
struct ifla_vf_vlan_info, this might result in an out of bands
read access when accessing the saved (casted) entry in ivvl.

Statement: Only out of boundary read for some specific condition with precondition could be (that impossible to trigger without privileges for access).

Affected upstream versions: 4.9
Fixed upstream versions: 0, 4.19.314, 5.10.217, 5.15.159, 5.4.276, 6.1.91, 6.6.31, 6.8.10, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8ac69ff2d0d5be9734c4402de932aa3dc8549c1a
CVE-2024-36019: kernel: regmap: maple: Fix cache corruption in regcache_maple_drop()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-05-30T00:00:00+00:00

A vulnerability was found in the Linux kernel’s `regmap` subsystem. Due to improper indexing in the `regcache_maple_drop()` function, an out-of-bounds access could corrupt the cache by overwriting parts of it with kernel memory.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3af6c5ac72dc5b721058132a0a1d7779e443175e
CVE-2024-36020: kernel: i40e: fix vf may be used uninitialized in this function warning
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-30T00:00:00+00:00

A flaw was found in the Linux kernel’s Ethernet Controller XL710 family driver. This flaw allows a local user to crash the system.


Affected upstream versions: 4.19.264 < 4.19.312, 5.4.223 < 5.4.274, 5.10.153 < 5.10.215, 5.15.77 < 5.15.154, 6.0.7 < 6.1, 6.1
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.154, 5.4.274, 6.1, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d
CVE-2024-36025: kernel: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-05-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's qla2xxx SCSI driver, specifically in the `qla_edif_app_getstats()` function, where an off-by-one error in array access could lead to memory corruption. This issue affects the `app_reply->elem[]` array, where an incorrect comparison allowed out-of-bounds access.


Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.156, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8c820f7c8e9b46238d277c575392fe9930207aab
CVE-2024-36030: kernel: octeontx2-af: fix the double free in rvu_npc_freemem()
Component: kernel
Severity: Low
CWE: CWE-415 (Double Free)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: fix the double free in rvu_npc_freemem()

Clang static checker(scan-build) warning：
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c:line 2184, column 2
Attempt to free released memory.

npc_mcam_rsrcs_deinit() has released 'mcam->counters.bmap'. Deleted this
redundant kfree() to fix this double free problem.


Affected upstream versions: 6.8
Fixed upstream versions: 0, 6.8.9, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f5aa87a2c0a72132ffc793fb0a5375b2a65d520a
CVE-2024-36031: kernel: keys: Fix overwrite of key expiration on instantiation
Component: kernel
Severity: Low
CWE: CWE-665 (Improper Initialization)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
Public date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

keys: Fix overwrite of key expiration on instantiation

The expiry time of a key is unconditionally overwritten during
instantiation, defaulting to turn it permanent. This causes a problem
for DNS resolution as the expiration set by user-space is overwritten to
TIME64_MAX, disabling further DNS updates. Fix this by restoring the
condition that key_set_expiry is only called when the pre-parser sets a
specific expiry.


Affected upstream versions: 5.10.206 < 5.10.217, 5.15.146 < 5.15.159, 6.1.70 < 6.1.91, 6.6.9 < 6.6.31, 6.7
Fixed upstream versions: 0, 5.10.217, 5.15.159, 6.1.91, 6.10, 6.6.31, 6.8.10, 6.9.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ad2011ea787928b2accb5134f1e423b11fe80a8a
CVE-2024-36244: kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: extend minimum interval restriction to entire cycle too

It is possible for syzbot to side-step the restriction imposed by the
blamed commit in the Fixes: tag, because the taprio UAPI permits a
cycle-time different from (and potentially shorter than) the sum of
entry intervals.

We need one more restriction, which is that the cycle time itself must
be larger than N * ETH_ZLEN bit times, where N is the number of schedule
entries. This restriction needs to apply regardless of whether the cycle
time came from the user or was the implicit, auto-calculated value, so
we move the existing "cycle == 0" check outside the "if "(!new->cycle_time)"
branch. This way covers both conditions and scenarios.

Add a selftest which illustrates the issue triggered by syzbot.


Affected upstream versions: 5.4.68 < 5.5, 5.8.12 < 5.9, 5.9
Fixed upstream versions: 0, 5.5, 5.9, 6.1.119, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 34d83c3e6e97867ae061d14eb52123404aab1cbc
CVE-2024-36270: kernel: netfilter: tproxy: bail out if IP has been disabled on the device
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: tproxy: bail out if IP has been disabled on the device

syzbot reports:
general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
[..]
RIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62
Call Trace:
 nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline]
 nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168

__in_dev_get_rcu() can return NULL, so check for this.


Affected upstream versions: 2.6.37
Fixed upstream versions: 0, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 10f0af5234dafd03d2b75233428ec3f11cf7e43d
CVE-2024-36286: kernel: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
Component: kernel
Severity: Moderate
CWE: CWE-667 (Improper Locking)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()

syzbot reported that nf_reinject() could be called without rcu_read_lock() :

WARNING: suspicious RCU usage
6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Not tainted

net/netfilter/nfnetlink_queue.c:263 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
2 locks held by syz-executor.4/13427:
  #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
  #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2190 [inline]
  #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_core+0xa86/0x1830 kernel/rcu/tree.c:2471
  #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
  #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: nfqnl_flush net/netfilter/nfnetlink_queue.c:405 [inline]
  #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: instance_destroy_rcu+0x30/0x220 net/netfilter/nfnetlink_queue.c:172

stack backtrace:
CPU: 0 PID: 13427 Comm: syz-executor.4 Not tainted 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
 <IRQ>
  __dump_stack lib/dump_stack.c:88 [inline]
  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
  lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712
  nf_reinject net/netfilter/nfnetlink_queue.c:323 [inline]
  nfqnl_reinject+0x6ec/0x1120 net/netfilter/nfnetlink_queue.c:397
  nfqnl_flush net/netfilter/nfnetlink_queue.c:410 [inline]
  instance_destroy_rcu+0x1ae/0x220 net/netfilter/nfnetlink_queue.c:172
  rcu_do_batch kernel/rcu/tree.c:2196 [inline]
  rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471
  handle_softirqs+0x2d6/0x990 kernel/softirq.c:554
  __do_softirq kernel/softirq.c:588 [inline]
  invoke_softirq kernel/softirq.c:428 [inline]
  __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
  irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>


Affected upstream versions: 2.6.25
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8658bd777cbfcb0c13df23d0ea120e70517761b9
CVE-2024-36477: kernel: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer

The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the
maximum transfer length and the size of the transfer buffer. As such, it
does not account for the 4 bytes of header that prepends the SPI data
frame. This can result in out-of-bounds accesses and was confirmed with
KASAN.

Introduce SPI_HDRSIZE to account for the header and use to allocate the
transfer buffer.


Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1547183852dcdfcc25878db7dd3620509217b0cd
CVE-2024-36489: kernel: tls: fix missing memory barrier in tls_init
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
Public date: 2024-06-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tls: fix missing memory barrier in tls_init

In tls_init(), a write memory barrier is missing, and store-store
reordering may cause NULL dereference in tls_{setsockopt,getsockopt}.

CPU0                               CPU1
-----                              -----
// In tls_init()
// In tls_ctx_create()
ctx = kzalloc()
ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1)

// In update_sk_prot()
WRITE_ONCE(sk->sk_prot, tls_prots)     -(2)

                                   // In sock_common_setsockopt()
                                   READ_ONCE(sk->sk_prot)->setsockopt()

                                   // In tls_{setsockopt,getsockopt}()
                                   ctx->sk_proto->setsockopt()    -(3)

In the above scenario, when (1) and (2) are reordered, (3) can observe
the NULL value of ctx->sk_proto, causing NULL dereference.

To fix it, we rely on rcu_assign_pointer() which implies the release
barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is
initialized, we can ensure that ctx->sk_proto are visible when
changing sk->sk_prot.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.219, 5.15.161, 6.1.93, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d72e126e9a36d3d33889829df8fc90100bb0e071
CVE-2024-3651: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()
Component: python-idna
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-12T00:00:00+00:00

A flaw was found in the python-idna library. A malicious argument was sent to the idna.encode() function can trigger an uncontrolled resource consumption, resulting in a denial of service.

Statement: The vulnerability in the idna.encode() function, allowing for resource consumption via specially crafted arguments, is categorized as a moderate severity issue due to its potential impact on system availability rather than data integrity or confidentiality. While the vulnerability can lead to a denial-of-service condition, it requires the passing of unusually large or maliciously crafted inputs to exploit. Normal usage scenarios typically do not encounter such inputs.

Affected upstream versions: unspecified < 3.7
Fixed upstream versions: 3.7
Upstream repository: https://github.com/kjd/idna
Upstream fix commit: 1d365e17e10d72d0b7876316fc7b9ca0eebdd38d
CVE-2024-36620: github.com/moby/moby: NULL Pointer Dereference in Moby
Component: github.com/moby/moby
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-11-29T00:00:00+00:00

A flaw was found in Moby. This vulnerability allows an attacker to cause a NULL pointer dereference, potentially leading to a denial of service via improper handling in the image history functionality.


Affected upstream versions: n/a
Fixed upstream versions: client/v0.1.0
Upstream repository: https://github.com/moby/moby
Upstream fix commit: ab570ab3d62038b3d26f96a9bb585d0b6095b9b4
CVE-2024-36880: kernel: Bluetooth: qca: add missing firmware sanity checks
Component: kernel
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 4.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
Public date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: qca: add missing firmware sanity checks

Add the missing sanity checks when parsing the firmware files before
downloading them to avoid accessing and corrupting memory beyond the
vmalloced buffer.


Affected upstream versions: 4.3
Fixed upstream versions: 0, 5.15.159, 6.1.91, 6.6.31, 6.8.10, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ed53949cc92e28aaa3463d246942bda1fbb7f307
CVE-2024-36881: kernel: mm/userfaultfd: reset ptes when close() for wr-protected ones
Component: kernel
Severity: Moderate
CWE: CWE-281 (Improper Preservation of Permissions)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/userfaultfd: reset ptes when close() for wr-protected ones

Userfaultfd unregister includes a step to remove wr-protect bits from all
the relevant pgtable entries, but that only covered an explicit
UFFDIO_UNREGISTER ioctl, not a close() on the userfaultfd itself.  Cover
that too.  This fixes a WARN trace.

The only user visible side effect is the user can observe leftover
wr-protect bits even if the user close()ed on an userfaultfd when
releasing the last reference of it.  However hopefully that should be
harmless, and nothing bad should happen even if so.

This change is now more important after the recent page-table-check
patch we merged in mm-unstable (446dd9ad37d0 ("mm/page_table_check:
support userfault wr-protect entries")), as we'll do sanity check on
uffd-wp bits without vma context.  So it's better if we can 100%
guarantee no uffd-wp bit leftovers, to make sure each report will be
valid.


Affected upstream versions: 5.19.6 < 5.20, 6.0
Fixed upstream versions: 0, 5.20, 6.6.31, 6.8.10, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 377f3a9a3d032a52325a5b110379a25dd1ab1931
CVE-2024-36882: kernel: mm: use memalloc_nofs_save() in page_cache_ra_order()
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm: use memalloc_nofs_save() in page_cache_ra_order()

See commit f2c817bed58d ("mm: use memalloc_nofs_save in readahead path"),
ensure that page_cache_ra_order() do not attempt to reclaim file-backed
pages too, or it leads to a deadlock, found issue when test ext4 large
folio.

 INFO: task DataXceiver for:7494 blocked for more than 120 seconds.
 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 task:DataXceiver for state:D stack:0     pid:7494  ppid:1      flags:0x00000200
 Call trace:
  __switch_to+0x14c/0x240
  __schedule+0x82c/0xdd0
  schedule+0x58/0xf0
  io_schedule+0x24/0xa0
  __folio_lock+0x130/0x300
  migrate_pages_batch+0x378/0x918
  migrate_pages+0x350/0x700
  compact_zone+0x63c/0xb38
  compact_zone_order+0xc0/0x118
  try_to_compact_pages+0xb0/0x280
  __alloc_pages_direct_compact+0x98/0x248
  __alloc_pages+0x510/0x1110
  alloc_pages+0x9c/0x130
  folio_alloc+0x20/0x78
  filemap_alloc_folio+0x8c/0x1b0
  page_cache_ra_order+0x174/0x308
  ondemand_readahead+0x1c8/0x2b8
  page_cache_async_ra+0x68/0xb8
  filemap_readahead.isra.0+0x64/0xa8
  filemap_get_pages+0x3fc/0x5b0
  filemap_splice_read+0xf4/0x280
  ext4_file_splice_read+0x2c/0x48 [ext4]
  vfs_splice_read.part.0+0xa8/0x118
  splice_direct_to_actor+0xbc/0x288
  do_splice_direct+0x9c/0x108
  do_sendfile+0x328/0x468
  __arm64_sys_sendfile64+0x8c/0x148
  invoke_syscall+0x4c/0x118
  el0_svc_common.constprop.0+0xc8/0xf0
  do_el0_svc+0x24/0x38
  el0_svc+0x4c/0x1f8
  el0t_64_sync_handler+0xc0/0xc8
  el0t_64_sync+0x188/0x190


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.91, 6.6.31, 6.8.10, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7629ef6dda1564098aadeef38e5fbd11ee8627c4