huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-42084: kernel: ftruncate: pass a signed offset
Component: kernel
Severity: Moderate
CWE: CWE-96 (Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection'))
CVSS v3: 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N)
Public date: 2024-07-29T00:00:00+00:00

An unexpected file truncate flaw was found when opening files with specific parameters in the Linux kernel's file-system. This vulnerability allows a local user to corrupt specific files when having access to these files.

Statement: This issue only occurs in compact mode on 64-bit architectures.

Affected upstream versions: 3.9
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c329760749b5419769e57cb2be80955d2805f9c9
CVE-2024-42090: kernel: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A deadlock flaw was found in the Linux kernel’s pinctrl subsystem. This flaw allows a local user to crash the system.

Statement: No known reproducer for this issue. It can happen due to some complex preconditions and in-error path handling.

Affected upstream versions: 3.10
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e65a0dc2e85efb28e182aca50218e8a056d0ce04
CVE-2024-42094: kernel: net/iucv: Avoid explicit cpumask var allocation on stack
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: Avoid explicit cpumask var allocation on stack

For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask
variable on stack is not recommended since it can cause potential stack
overflow.

Instead, kernel code should always use *cpumask_var API(s) to allocate
cpumask var in config-neutral way, leaving allocation strategy to
CONFIG_CPUMASK_OFFSTACK.

Use *cpumask_var API(s) to address it.

Statement: This issue is considered to be a moderate impact flaw, as the exploitation in this will not cause an Intigrity (I:L) threat with the available usecase and may only cause a DOS.

Affected upstream versions: 2.6.21
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2b085521be5292016097b5e7ca81b26be3f7098d
CVE-2024-42096: kernel: x86: stop playing stack games in profile_pc()
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86: stop playing stack games in profile_pc()

The 'profile_pc()' function is used for timer-based profiling, which
isn't really all that relevant any more to begin with, but it also ends
up making assumptions based on the stack layout that aren't necessarily
valid.

Basically, the code tries to account the time spent in spinlocks to the
caller rather than the spinlock, and while I support that as a concept,
it's not worth the code complexity or the KASAN warnings when no serious
profiling is done using timers anyway these days.

And the code really does depend on stack layout that is only true in the
simplest of cases.  We've lost the comment at some point (I think when
the 32-bit and 64-bit code was unified), but it used to say:

	Assume the lock function has either no stack frame or a copy
	of eflags from PUSHF.

which explains why it just blindly loads a word or two straight off the
stack pointer and then takes a minimal look at the values to just check
if they might be eflags or the return pc:

	Eflags always has bits 22 and up cleared unlike kernel addresses

but that basic stack layout assumption assumes that there isn't any lock
debugging etc going on that would complicate the code and cause a stack
frame.

It causes KASAN unhappiness reported for years by syzkaller [1] and
others [2].

With no real practical reason for this any more, just remove the code.

Just for historical interest, here's some background commits relating to
this code from 2006:

  0cb91a229364 ("i386: Account spinlocks to the caller during profiling for !FP kernels")
  31679f38d886 ("Simplify profile_pc on x86-64")

and a code unification from 2009:

  ef4512882dbe ("x86: time_32/64.c unify profile_pc")

but the basics of this thing actually goes back to before the git tree.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 65ebdde16e7f5da99dbf8a548fb635837d78384e
CVE-2024-42101: kernel: drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A flaw was found in the Linux kernel’s nouveau module. The return value of the drm_mode_duplicate function is not checked in the nouveau_connector_get_modes function in the drivers/gpu/drm/nouveau/nouveau_connector.c file, possibly causing a NULL pointer dereference and resulting in a denial of service.


Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 4.19.318, 5.10.222, 5.15.163, 5.4.280, 6.1.98, 6.10, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9baf60323efa992b7c915094529f0a1882c34e7e
CVE-2024-42102: kernel: Revert &#34;mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again&#34;
Component: kernel
Severity: Moderate
CWE: CWE-369 (Divide By Zero)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the wb_dirty_limits() function in the Linux kernel, where a removed (u64) cast in the dtc->wb_thresh * dtc->bg_thresh operation can result in multiplication overflow on 32-bit architectures. This issue could lead to memory corruption or performance issues.

Statement: Red Hat rates this as Moderate severity with an Attack Complexity rating of High, given that an attacker needs to be able to create enough dirty data (data not yet written to disk) in memory to cause the multiplication overflow, something which is more likely to be effective on systems with just 4GB of RAM, and would require the attacker to have this information about a given system when targeting their attack for a higher likelihood of success.

Affected upstream versions: 4.19.307 < 4.19.318, 5.4.269 < 5.4.280, 5.10.210 < 5.10.222, 5.15.149 < 5.15.163, 6.1.79 < 6.1.98, 6.6.18 < 6.6.39, 6.7.6 < 6.8, 6.8
Fixed upstream versions: 0, 4.19.318, 5.10.222, 5.15.163, 5.4.280, 6.1.98, 6.10, 6.6.39, 6.8, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 253f9ea7e8e53a5176bd80ceb174907b10724c1a
CVE-2024-42107: kernel: ice: Don't process extts if PTP is disabled
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ice: Don't process extts if PTP is disabled

The ice_ptp_extts_event() function can race with ice_ptp_release() and
result in a NULL pointer dereference which leads to a kernel panic.

Panic occurs because the ice_ptp_extts_event() function calls
ptp_clock_event() with a NULL pointer. The ice driver has already
released the PTP clock by the time the interrupt for the next external
timestamp event occurs.

To fix this, modify the ice_ptp_extts_event() function to check the
PTP state and bail early if PTP is not ready.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 6.10, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1c4e524811918600683b1ea87a5e0fc2db64fa9b
CVE-2024-42110: kernel: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()
Component: kernel
Severity: Moderate
CWE: CWE-372 (Incomplete Internal State Distinction)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel in the ntb_netdev_rx_handler() function which calls the function __netif_rx(), which can only be called from interrupt context, in a preemptible context. This vulnerability can lead to potential race conditions and system instability.

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability as the upstream commit that introduced this vulnerability was never incorporated into the versions or configurations of the Linux kernel used in its distributions.

Affected upstream versions: 3.9
Fixed upstream versions: 0, 6.1.98, 6.10, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4b3b6c7efee69f077b86ef7f088fb96768e46e1f
CVE-2024-42114: kernel: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the cfg80211 component in the Linux kernel, where a lack of proper range validation applied to the NL80211_ATTR_TXQ_QUANTUM can lead to a scenario where the userspace passes an extremely high value that the kernel is not designed to handle efficiently (ex. 2^31). This can cause soft lockups and system instability.

Statement: Red Hat believes this flaw is moderate severity because the privileges necessary to effectively trigger this vulnerability require the user to be able to craft and send a Netlink message with the NL80211_ATTR_TXQ_QUANTUM parameter set to an abnormally high value. The permissions necessary to set this value would require CAP_NET_ADMIN.

Affected upstream versions: 4.18
Fixed upstream versions: 0, 5.10.224, 5.15.165, 6.1.106, 6.10, 6.6.47, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 80ac0cc9c0bef984e29637b1efa93d7214b42f53
CVE-2024-42123: kernel: drm/amdgpu: fix double free err_addr pointer warnings
Component: kernel
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the amdgpu_umc_handle_bad_pages() function in the Linux kernel's amdgpu driver. If the function is called multiple times in quick succession, a double free error can occur because the err_data->err_addr pointer that is being freed is not being set to NULL in between calls. This could lead to memory corruption or crashes.

Statement: Red Hat believes this flaw is moderate severity because the permissions necessary to effectively trigger this flaw are high. A user would need to have kernel and driver access to effectively operate the driver and repeatedly trigger the amdgpu_umc_handle_bad_pages() function.

Affected upstream versions: 4.2
Fixed upstream versions: 0, 6.10, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8e24beb3c2b08a4763f920399a9cc577ed440a1a
CVE-2024-42124: kernel: scsi: qedf: Make qedf_execute_tmf() non-preemptible
Component: kernel
Severity: Moderate
CWE: CWE-372 (Incomplete Internal State Distinction)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's qedf driver function qedf_execute_tmf(), where the function call smp_processor_id() is done from preemptible code (before acquiring a lock) which can result in BUG_ON() when running an RT kernel. This can result in system inconsistencies.


Affected upstream versions: 4.11
Fixed upstream versions: 0, 5.10.222, 5.15.163, 5.4.280, 6.1.98, 6.10, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4f314aadeed8cdf42c8cf30769425b5e44702748
CVE-2024-42125: kernel: wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's rtw89 driver function rtw89_scan_get_6g_disabled_chan() caused by its handling of 6 GHz band channels during scans. A lack of proper sband checks can lead to a situation where the sband is not available due to device limitations/restrictions set by the BIOS and this leads to a NULL pointer dereference. This can lead to system instability or crashes.

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability as the commit which introduced this vulnerability is not present in the specific versions or configurations of the Linux kernel used in its distributions.

Affected upstream versions: 6.9
Fixed upstream versions: 0, 6.10, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ce4ba62f8bc5195a9a0d49c6235a9c99e619cadc
CVE-2024-42131: kernel: mm: avoid overflows in dirty throttling logic
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's memory management subsystem where a lack of proper size checks on dirty limits can lead to situations where large dirty limits end up being larger than 32-bits, resulting in potential overflows and divisions by 0. This can cause memory corruption, system instability, or crashes.

Statement: Red Hat believes this flaw is moderate severity because the privileges necessary to exploit this vulnerability are high, as it requires a user to have elevated permissions to set the dirty page limits.

Affected upstream versions: 2.6.29
Fixed upstream versions: 0, 4.19.320, 5.10.222, 5.15.163, 5.4.282, 6.1.98, 6.10, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2b2d2b8766db028bd827af34075f221ae9e9efff
CVE-2024-42132: kernel: bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A warning was observed in the Linux kernel in hci_conn_del() caused by freeing handle that was not allocated using ida allocator. This is caused by handle bigger than HCI_CONN_HANDLE_MAX passed by hci_le_big_sync_established_evt(), which makes code think it's unset connection.

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability.

Affected upstream versions: 6.6.2 < 6.6.39, 6.5.12 < 6.6, 6.7
Fixed upstream versions: 0, 6.10, 6.6, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2ae8d7742a09c275872e670c53337b3dcedaa11c
CVE-2024-42133: kernel: Bluetooth: Ignore too large handle values in BIG
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's bluetooth subsystem in the function hci_le_big_sync_established_evt() where a lack of proper checks does not validate whether a received connection handle exceeds the maximum allowed value. This could lead to system instability or crashes.


Affected upstream versions: 6.6.2 < 6.6.39, 6.5.12 < 6.6, 6.7
Fixed upstream versions: 0, 6.10, 6.6, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a06a8cc80fa203fde828a8429583f7e4fe27eca4
CVE-2024-42139: kernel: ice: Fix improper extts handling
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's ethernet ice driver, where EXTTS events are improperly handled. If the driver is removed while the managing application is running, certain EXTT events might remain enabled. This issue can lead to system instability and crashes.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 6.10, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9f69b31ae9e25dec27ad31fbc64dd99af16ee3d3
CVE-2024-42141: kernel: Bluetooth: ISO: Check socket flag instead of hcon
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Check socket flag instead of hcon

This fixes the following Smatch static checker warning:

net/bluetooth/iso.c:1364 iso_sock_recvmsg()
error: we previously assumed 'pi->conn->hcon' could be null (line 1359)

net/bluetooth/iso.c
1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1348                             size_t len, int flags)
1349 {
1350         struct sock *sk = sock->sk;
1351         struct iso_pinfo *pi = iso_pi(sk);
1352
1353         BT_DBG("sk %p", sk);
1354
1355         if (test_and_clear_bit(BT_SK_DEFER_SETUP,
                                      &bt_sk(sk)->flags)) {
1356                 lock_sock(sk);
1357                 switch (sk->sk_state) {
1358                 case BT_CONNECT2:
1359                         if (pi->conn->hcon &&
                                     ^^^^^^^^^^^^^^ If ->hcon is NULL

1360                             test_bit(HCI_CONN_PA_SYNC,
                                         &pi->conn->hcon->flags)) {
1361                                 iso_conn_big_sync(sk);
1362                                 sk->sk_state = BT_LISTEN;
1363                         } else {
--> 1364                         iso_conn_defer_accept(pi->conn->hcon);
                                                       ^^^^^^^^^^^^^^
                                                       then we're toast

1365                                 sk->sk_state = BT_CONFIG;
1366                         }
1367                         release_sock(sk);
1368                         return 0;
1369                 case BT_CONNECTED:
1370                         if (test_bit(BT_SK_PA_SYNC,

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability.

Affected upstream versions: 6.5.12 < 6.6, 6.6
Fixed upstream versions: 0, 6.10, 6.6, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 045669710464a21c67e690ef14698fd71857cb11
CVE-2024-42152: kernel: nvmet: fix a possible leak when destroy a ctrl during qp establishment
Component: kernel
Severity: Moderate
CWE: CWE-404 (Improper Resource Shutdown or Release)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's nvme driver. A lack of proper checks can lead to a race condition during the destruction of a queue pair when a controller is being established. This issue can lead to system instability or crashes.


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.222, 5.15.163, 6.1.98, 6.10, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2f3c22b1d3d7e86712253244797a651998c141fa
CVE-2024-42154: kernel: tcp_metrics: validate source addr length
Component: kernel
Severity: Moderate
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's tcp_metrics.c, where insufficient validation of the length of the source address for TCP metrics could lead to incorrect memory read (out of boundary read).

Statement: The impact level is limited, because:
1. Missed check existed before and worked correctly (because by default it worked for int32 value, even if it was not specified exactly).
2. Even if for some specific case fail could happen, still it can lead only to incorrect memory read.
3. Even if memory corruption happens, it should not lead to anything apart from incorrect tcp-ip statistics output to the local user.
4. This bug is restricted to local as netlink is configured to be local only out of the box.

Affected upstream versions: 3.14
Fixed upstream versions: 0, 4.19.318, 5.10.222, 5.15.163, 5.4.280, 6.1.98, 6.10, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 19d997b59fa1fd7a02e770ee0881c0652b9c32c9
CVE-2024-42159: kernel: scsi: mpi3mr: Sanitise num_phys
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2024-07-30T00:00:00+00:00

A vulnerability was found in the Linux kernel's mpi3mr driver in the mpi3mr_sas_port_add() function, where a lack of proper checks could lead to values that are larger than what the defined size of the num_phys field in the mr_sas_node structure being inserted, causing the field to be overwritten and potentially corrupting the structure. This issue could lead to memory corruption or crashes.

Statement: Red Hat believes this flaw to be of Moderate severity because the impact on confidentiality that a successful use of this vulnerability would have is low. Since this vulnerability primarily impacts how the system handles physical connections in the SCSI subsystem, sensitive information would most likely not be directly exposed.

Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.98, 6.10, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b869ec89d2ee923d46608b76e54c006680c9b4df
CVE-2024-42225: kernel: wifi: mt76: replace skb_put with skb_put_zero
Component: kernel
Severity: Moderate
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 4.8 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-07-30T00:00:00+00:00

A potential flaw was found in the Linux kernel’s MediaTek WiFi, where it was reusing uninitialized data. This flaw allows a local user to gain unauthorized access to some data potentially.

Statement: Red Hat Enterprise Linux 8.10 and later are affected.

Affected upstream versions: 4.16
Fixed upstream versions: 0, 5.15.163, 6.1.98, 6.10, 6.6.39, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dc7f14d00d0c4c21898f3504607f4a31079065a2