huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-43804: python-urllib3: Cookie request header isn't stripped during cross-origin redirects
Component: python-urllib3
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N)
Public date: 2023-10-04T00:00:00+00:00

A flaw was found in urllib3, a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, which is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.


Affected upstream versions: >= 2.0.0, < 2.0.6, < 1.26.17
Fixed upstream versions: 1.26.17
Upstream repository: https://github.com/urllib3/urllib3
Upstream fix commit: 01220354d389cd05474713f8c982d05c9b17aafb
CVE-2023-4387: kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2022-05-14T00:00:00+00:00

A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.


Affected upstream versions: <= v5.17
Fixed upstream versions: 0:4.18.0-425.3.1.el8, 0:5.14.0-162.6.1.el9_1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 9e7fef9521e73ca8afd7da9e58c14654b02dfad8
CVE-2023-44270: PostCSS: Improper input validation in PostCSS
Component: PostCSS
Severity: Moderate
CWE: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2023-09-29T00:00:00+00:00

There's a flaw in the PostCSS package where it fails to properly validate the input CSS, causing commented lines to be interpreted as code. An attacker may leverage that by crafting a CSS file with comments containing CSS code in order to force PostCSS to include the malicious CSS elements in its output. An successful attack may lead to integrity impact as it may inject elements in a web page when parsing untrusted CSS input.


Affected upstream versions: n/a
Fixed upstream versions: 8.4.31
Upstream repository: https://github.com/postcss/postcss
Upstream fix commit: 58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
CVE-2023-44271: python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument
Component: python-pillow
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-06-30T00:00:00+00:00

A flaw was found in Pillow. A denial of service issue uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for TrueType in ImageFont when text length in an ImageDraw instance operates on a long text argument.

Statement: This security vulnerability is categorized as having a moderate impact because it only results in increased memory consumption when exceptionally long strings are utilized as text input.

Affected upstream versions: n/a
Fixed upstream versions: 10.0.0
Upstream repository: https://github.com/python-pillow/Pillow
Upstream fix commit: 1fe1bb49c452b0318cad12ea9d97c3bef188e9a7
CVE-2023-44387: gradle: Incorrect permission assignment for symlinked files used in copy or archiving operations
Component: gradle
Severity: Low
CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)
CVSS v3: 3.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N)
Public date: 2023-10-05T00:00:00+00:00

A flaw was found in Gradle. When copying files or creating archives, Gradle does not preserve symbolic links, instead resolving them to their underlying target file, but permissions of the new file use those of the link instead of those from the target file. This issue can lead to files with broader permissions than intended, as symbolic links are usually world-readable and writeable.


Affected upstream versions: >= 7.6.0, < 7.6.3, < 8.4.0
Fixed upstream versions: v7.6.3
Upstream repository: https://github.com/gradle/gradle
Upstream fix commit: 3b406191e24d69e7e42dc3f3b5cc50625aa930b7
CVE-2023-44466: kernel: buffer overflow in ceph file net/ceph/messenger_v2.c
Component: kernel
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-09-29T00:00:00+00:00

An flaw was found in net/ceph/messenger_v2.c in the Linux Kernel. An integer signing error leads to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This issue occurs due to an untrusted length taken from a TCP packet in ceph_decode_32.


Affected upstream versions: n/a
Fixed upstream versions: v6.5
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: a282a2f10539dce2aa619e71e1817570d557fc97
CVE-2023-44487: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
Component: HTTP/2
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-10-10T00:00:00+00:00

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.

CVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language packages.

Security Bulletin
https://access.redhat.com/security/vulnerabilities/RHSB-2023-003

Statement: NGINX has been marked as Moderate Impact because, for performance and resource consumption reasons, NGINX limits the number of concurrent streams to a default of 128. In addition, to optimally balance network and server performance, NGINX allows the client to persist HTTP connections for up to 1000 requests by default using an HTTP keepalive.

The majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a "Moderate" level of impact.

rhc component is no longer impacted by CVE-2023-44487 & CVE-2023-39325.

Affected upstream versions: n/a
Fixed upstream versions: netty-4.1.100.Final
Upstream repository: https://github.com/netty/netty
Upstream fix commit: 58f75f665aa81a8cbcf6ffa74820042a285c5e61
CVE-2023-44488: libvpx: crash related to VP9 encoding in libvpx
Component: libvpx
Severity: Important
CWE: CWE-755 (Improper Handling of Exceptional Conditions)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-30T00:00:00+00:00

A heap-based buffer overflow flaw was found in libvpx, a library used to process VP9 video codecs data. This issue occurs when processing certain specially formatted video data via a crafted HTML page, allowing an attacker to crash or remotely execute arbitrary code in an application, such as a web browser that is compiled with this library.

Statement: This security issue has been classified as having an Important security impact. Desktop users are at a high risk of exploitation of this flaw with very minimal interaction. It may compromise the confidentiality, integrity, or availability of resources.

Customers using this application, which does server-side video codecs by linking to the libvpx library, are also potentially impacted by this flaw and are advised to update to the fixed versions of the package.

Affected upstream versions: n/a
Fixed upstream versions: v1.13.1
Upstream repository: https://github.com/webmproject/libvpx
Upstream fix commit: df9fd9d5b7325060b2b921558a1eb20ca7880937
CVE-2023-4459: kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-05-14T00:00:00+00:00

A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.

Statement: For the Red Hat Enterprise Linux 8.7 (and higher versions) the patch that resolves the problem already applied (so no need to update then).
Similar for the Red Hat Enterprise Linux 9.1 (and higher versions) the patch that resolves the problem already applied. Only Red Hat Enterprise Linux 9.0 affected.

Affected upstream versions: <= v5.17
Fixed upstream versions: 0:4.18.0-193.133.1.el8_2, 0:4.18.0-193.133.1.rt13.184.el8_2, 0:4.18.0-305.125.1.el8_4, 0:4.18.0-305.125.1.rt7.201.el8_4, 0:4.18.0-372.87.1.el8_6, 0:5.14.0-70.93.1.rt21.165.el9_0, 0:5.14.0-70.93.2.el9_0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: edf410cb74dc612fd47ef5be319c5a0bcd6e6ccd
CVE-2023-45143: node-undici: cookie leakage
Component: node-undici
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 3.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L)
Public date: 2023-10-12T00:00:00+00:00

A flaw was found in the Undici node package due to the occurrence of Cross-origin requests, possibly leading to a cookie header leakage. By default, cookie headers are forbidden request headers, and they must be enabled. This flaw allows a malicious user to access this leaked cookie if they have control of the redirection.

Statement: Since this requires a non-standard configuration, as well as control of the redirection, Red Hat rates this as having a Low impact.

Red Hat Developer Hub has included a fix for this.

Affected upstream versions: < 5.26.2
Fixed upstream versions: v5.26.2
Upstream repository: https://github.com/nodejs/undici
Upstream fix commit: e041de359221ebeae04c469e8aff4145764e6d76
CVE-2023-45145: redis: possible bypass of Unix socket permissions on startup
Component: redis
Severity: Low
CWE: CWE-269 (Improper Privilege Management)
CVSS v3: 3.6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2023-10-18T00:00:00+00:00

A flaw was found in Redis, an in-memory database that persists on disk. On startup, Redis listens on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection.


Affected upstream versions: >= 2.6.0-rc1, < 6.2.14, >= 7.0.0, < 7.0.14, >= 7.1.0, < 7.2.2
Fixed upstream versions: 7.4.0
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 03345ddc7faf7af079485f2cbe5d17a1611cbce1
CVE-2023-45286: go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2
Component: go-resty
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2023-11-28T00:00:00+00:00

A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.


Affected upstream versions: 2.10.0 < 2.11.0
Fixed upstream versions: 2.11.0
Upstream repository: https://github.com/go-resty/resty
Upstream fix commit: 577fed8730d79f583eb48dfc81674164e1fc471e
CVE-2023-4535: OpenSC: out-of-bounds read in MyEID driver handling encryption using symmetric keys
Component: OpenSC
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.5 (CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L)
Public date: 2023-09-25T00:00:00+00:00

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Statement: This CVE does not affect Red Hat Enterprise Linux 8 as the affected functionality was introduced in OpenSC-0.23.0 and RHEL-8 uses OpenSC-0.20.0 and lower versions.

Affected upstream versions: <= 0.23.0
Fixed upstream versions: 0:0.23.0-3.el9_3
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: f1993dc4e0b33050b8f72a3558ee88b24c4063b2
CVE-2023-45539: haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers
Component: haproxy
Severity: Moderate
CWE: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2023-11-28T00:00:00+00:00

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.0
Upstream repository: https://git.haproxy.org/haproxy.git
Upstream fix commit: 2eab6d354322932cfec2ed54de261e4347eca9a6
CVE-2023-45803: urllib3: Request body not stripped after redirect from 303 status changes request method to GET
Component: urllib3
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 4.2 (CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2023-10-13T00:00:00+00:00

A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as `POST` to `GET`, as is required by HTTP RFCs. This issue requires a previously trusted service to become compromised in order to have an impact on confidentiality, therefore, the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies; if this is the case, this vulnerability isn't exploitable.

Statement: Both of the following conditions must be true to be affected by this vulnerability: 
1. Using urllib3 and submitting sensitive information in the HTTP request body such as form data or JSON
2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised

Affected upstream versions: >= 2.0.0, < 2.0.7, < 1.26.18
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/urllib3/urllib3
Upstream fix commit: 4e98d57809dacab1cbe625fddeec1a290c478ea9
CVE-2023-45862: kernel: drivers/usb/storage/ene_ub6250.c
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-04T00:00:00+00:00

An out-of-bounds memory access flaw was found in the Linux kernel ENE SD/MS Card reader driver. This issue occurs when using a malicious USB device, which could allow a local user to crash the system.


Affected upstream versions: n/a
Fixed upstream versions: v6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ce33e64c1788912976b61314b56935abd4bc97ef
CVE-2023-45863: kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write
Component: kernel
Severity: Moderate
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-01-11T00:00:00+00:00

An out-of-bounds memory write flaw was found in the load/unload module in the Linux kernel's kobject functionality, potentially triggering a race condition in the kobject_get_path function. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.


Affected upstream versions: n/a
Fixed upstream versions: v6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3bb2a01caa813d3a1845d378bbe4169ef280d394
CVE-2023-45866: bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution
Component: bluez
Severity: Moderate
CWE: CWE-1220 (Insufficient Granularity of Access Control)
CVSS v3: 6.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2023-12-07T00:00:00+00:00

A flaw was found in the HID Profile in BlueZ that opens doors for unauthorized connections, especially by devices like keyboards, to inject keystrokes without user confirmation. BlueZ lacks proper restrictions on non-bonded devices, creating a risk for attackers that are physically close to inject keystrokes and execute arbitrary commands when the device is in a discoverable state.

Statement: BlueZ was found to inadequately limit non-bonded devices from injecting HID events into the input subsystem. This vulnerability could permit a nearby attacker (physically proximate) to inject keystrokes and carry out arbitrary commands when the device is in discoverable mode.

Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input
Upstream fix commit: 25a471a83e02e1effb15d5a488b3f0085eaeb675
CVE-2023-45871: kernel: IGB driver inadequate buffer size for frames larger than MTU
Component: kernel
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-08-24T00:00:00+00:00

A flaw was found in igb_configure_rx_ring in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel. An overflow of the contents from a packet that is too large will overflow into the kernel's ring buffer, leading to a system integrity issue.

Statement: This flaw is rated as Important because of its nature of exposure to the threat of impacting Confidentiality, Integrity and Availability by an attacker while being in an adjacent physical layer with no privilege required.

Affected upstream versions: n/a
Fixed upstream versions: v6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bb5ed01cd2428cd25b1c88a3a9cba87055eb289f
CVE-2023-45897: exfatprogs: exfatprogs allows out-of-bounds memory access
Component: exfatprogs
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-10-28T00:00:00+00:00

A flaw was found in Exfatprogs, a userspace utility that contains all of the standard utilities for creating, fixing, and debugging the exfat filesystem in the linux system.This issue may allow out-of-bounds memory access such as in read_file_dentry_set. To exploit this vulnerability, the attacker must possess authorization with privileges granting basic user capabilities, and can achieve out-of-bounds memory access.


Affected upstream versions: n/a
Fixed upstream versions: 1.2.2
Upstream repository: https://github.com/exfatprogs/exfatprogs
Upstream fix commit: ec78688e5fb5a70e13df82b4c0da1e6228d3ccdf
CVE-2023-46136: python-werkzeug: high resource consumption leading to denial of service
Component: python-werkzeug
Severity: Moderate
CWE: CWE-407 (Inefficient Algorithmic Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-10-25T00:00:00+00:00

A resource consumption flaw was found in python-werkzeug. If a specially crafted file is uploaded by a remote attacker, it may cause a denial of service.

Statement: The vulnerability found in python-werkzeug, which lets attackers carry out denial of service attacks by using carefully crafted multipart data, is considered a moderate issue because it could affect system resources and availability. When this vulnerability is exploited, it can cause the CPU to work excessively hard because the parsing mechanism keeps adding data chunks to an internal buffer without checking boundaries properly. This can result in legitimate requests being delayed or denied as worker processes get overloaded, affecting how well the web application performs and responds. While this problem doesn’t directly compromise data integrity or confidentiality, exploiting it can disrupt the availability of the service, which is why it’s seen as a moderate issue.

Affected upstream versions: >= 3.0.0, < 3.0.1, >= 2.0.0rc1, < 2.3.8
Fixed upstream versions: 3.1.0
Upstream repository: https://github.com/pallets/werkzeug
Upstream fix commit: f3c803b3ade485a45f12b6d6617595350c0f03e2
CVE-2023-4622: kernel: use after free in unix_stream_sendpage
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2023-09-06T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's af_unix component that allows local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. This issue leads to a race condition where the unix_stream_sendpage() function could access a skb that is being released by garbage collection, resulting in a use-after-free issue.


Affected upstream versions: 4.2 < 6.1.47
Fixed upstream versions: 6.1.47
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 790c2f9d15b594350ae9bca7b236f2b1859de02c
CVE-2023-4623: kernel: net/sched: sch_hfsc UAF
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-09-06T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component that can be exploited to achieve local privilege escalation. If a class with a link-sharing curve, for example, with the HFSC_FSC flag set, has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free issue.


Affected upstream versions: 2.6.12 < 6.6
Fixed upstream versions: 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b3d26c5702c7d6c45456326e56d2ccf3f103e60f