huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-41082: kernel: nvme-fabrics: use reserved tag for reg read/write command
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme-fabrics: use reserved tag for reg read/write command

In some scenarios, if too many commands are issued by nvme command in
the same time by user tasks, this may exhaust all tags of admin_q. If
a reset (nvme reset or IO timeout) occurs before these commands finish,
reconnect routine may fail to update nvme regs due to insufficient tags,
which will cause kernel hang forever. In order to workaround this issue,
maybe we can let reg_read32()/reg_read64()/reg_write32() use reserved
tags. This maybe safe for nvmf:

1. For the disable ctrl path,  we will not issue connect command
2. For the enable ctrl / fw activate path, since connect and reg_xx()
   are called serially.

So the reserved tags may still be enough while reg_xx() use reserved tags.

Statement: Following issue marked as moderate with "not affected or will not fix" for Red Hat Enterprise Linux, as it is not vulnerable to this CVE. This is because the CVE does not impact the versions or configurations of the Linux kernel used in Red Hat's distributions.

Affected upstream versions: 5.4
Fixed upstream versions: 0, 6.10, 6.9.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 165da9c67a26f08c9b956c15d701da7690f45bcb
CVE-2024-41084: kernel: cxl/region: Avoid null pointer dereference in region lookup
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cxl/region: Avoid null pointer dereference in region lookup

cxl_dpa_to_region() looks up a region based on a memdev and DPA.
It wrongly assumes an endpoint found mapping the DPA is also of
a fully assembled region. When not true it leads to a null pointer
dereference looking up the region name.

This appears during testing of region lookup after a failure to
assemble a BIOS defined region or if the lookup raced with the
assembly of the BIOS defined region.

Failure to clean up BIOS defined regions that fail assembly is an
issue in itself and a fix to that problem will alleviate some of
the impact. It will not alleviate the race condition so let's harden
this path.

The behavior change is that the kernel oops due to a null pointer
dereference is replaced with a dev_dbg() message noting that an
endpoint was mapped.

Additional comments are added so that future users of this function
can more clearly understand what it provides.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a9e099e29e925f8b31cfe53e8a786b9796f8e453
CVE-2024-41085: kernel: cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cxl/mem: Fix no cxl_nvd during pmem region auto-assembling

When CXL subsystem is auto-assembling a pmem region during cxl
endpoint port probing, always hit below calltrace.

 BUG: kernel NULL pointer dereference, address: 0000000000000078
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 RIP: 0010:cxl_pmem_region_probe+0x22e/0x360 [cxl_pmem]
 Call Trace:
  <TASK>
  ? __die+0x24/0x70
  ? page_fault_oops+0x82/0x160
  ? do_user_addr_fault+0x65/0x6b0
  ? exc_page_fault+0x7d/0x170
  ? asm_exc_page_fault+0x26/0x30
  ? cxl_pmem_region_probe+0x22e/0x360 [cxl_pmem]
  ? cxl_pmem_region_probe+0x1ac/0x360 [cxl_pmem]
  cxl_bus_probe+0x1b/0x60 [cxl_core]
  really_probe+0x173/0x410
  ? __pfx___device_attach_driver+0x10/0x10
  __driver_probe_device+0x80/0x170
  driver_probe_device+0x1e/0x90
  __device_attach_driver+0x90/0x120
  bus_for_each_drv+0x84/0xe0
  __device_attach+0xbc/0x1f0
  bus_probe_device+0x90/0xa0
  device_add+0x51c/0x710
  devm_cxl_add_pmem_region+0x1b5/0x380 [cxl_core]
  cxl_bus_probe+0x1b/0x60 [cxl_core]

The cxl_nvd of the memdev needs to be available during the pmem region
probe. Currently the cxl_nvd is registered after the endpoint port probe.
The endpoint probe, in the case of autoassembly of regions, can cause a
pmem region probe requiring the not yet available cxl_nvd. Adjust the
sequence so this dependency is met.

This requires adding a port parameter to cxl_find_nvdimm_bridge() that
can be used to query the ancestor root port. The endpoint port is not
yet available, but will share a common ancestor with its parent, so
start the query from there instead.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.10, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1d064e4fbebcf5b18dc10c1f3973487eb163b600
CVE-2024-41089: kernel: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A flaw was found in the nouveau driver module of the Linux kernel in which certain TV tuner cards can cause a null pointer dereference when querying the capabilities of some displays, resulting in a denial of service.


Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ffabad4aa91e33ced3c6ae793fb37771b3e9cb51
CVE-2024-41090: kernel: virtio-net: tap: mlx5_core short frame denial of service
Component: kernel
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Public date: 2024-07-24T17:00:00+00:00

A denial of service (DoS) attack was found in the mlx5 driver in the Linux kernel. A KVM guest VM using virtio-net can crash the host by sending a short packet, for example, size < ETH_HLEN. The packet may traverse through vhost-net, macvtap, and vlan without any validation or drop. When this packet is presented to the mlx5 driver on the host side, the kernel panic happens since mlx5_core assumes the frame size is always >= ETH_HLEN.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.223, 5.15.164, 5.4.281, 6.1.102, 6.10.2, 6.11, 6.6.43, 6.9.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8be915fc5ff9a5e296f6538be12ea75a1a93bdea
CVE-2024-41091: kernel: virtio-net: tun: mlx5_core short frame denial of service
Component: kernel
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Public date: 2024-07-24T17:00:00+00:00

A denial of service (DoS) attack was found in the mlx5 driver in the Linux kernel. A KVM guest VM using virtio-net can crash the host by sending a short packet, for example, size < ETH_HLEN. The packet may traverse through vhost-net, macvtap, and vlan without any validation or drop. When this packet is presented to the mlx5 driver on the host side, the kernel panic happens since mlx5_core assumes the frame size is always >= ETH_HLEN.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.223, 5.15.164, 5.4.281, 6.1.102, 6.10.2, 6.11, 6.6.43, 6.9.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 32b0aaba5dbc85816898167d9b5d45a22eae82e9
CVE-2024-41092: kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-29T00:00:00+00:00

A use-after-free was found in drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c in the Linux kernel. This issue can be caused by a race among revocation of fence registers on one side and sequential execution of signal callbacks invoked on completion of a request that was using them on the other, processed in parallel to revocation of those fence registers.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.221, 5.15.162, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f771b91f21c46ad1217328d05e72a2c7e3add535
CVE-2024-41093: kernel: drm/amdgpu: avoid using null object of framebuffer
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: avoid using null object of framebuffer

Instead of using state->fb->obj[0] directly, get object from framebuffer
by calling drm_gem_fb_get_obj() and return error code when object is
null to avoid using null object of framebuffer.


Affected upstream versions: 4.2
Fixed upstream versions: 0, 5.15.162, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7f35e01cb0ea4d295f5c067bb5c67dfcddaf05bc
CVE-2024-41094: kernel: drm/fbdev-dma: Only set smem_start is enable per module option
Component: kernel
Severity: Low
CWE: CWE-1102 (Reliance on Machine-Dependent Data Representation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/fbdev-dma: Only set smem_start is enable per module option

Only export struct fb_info.fix.smem_start if that is required by the
user and the memory does not come from vmalloc().

Setting struct fb_info.fix.smem_start breaks systems where DMA
memory is backed by vmalloc address space. An example error is
shown below.

[    3.536043] ------------[ cut here ]------------
[    3.540716] virt_to_phys used for non-linear address: 000000007fc4f540 (0xffff800086001000)
[    3.552628] WARNING: CPU: 4 PID: 61 at arch/arm64/mm/physaddr.c:12 __virt_to_phys+0x68/0x98
[    3.565455] Modules linked in:
[    3.568525] CPU: 4 PID: 61 Comm: kworker/u12:5 Not tainted 6.6.23-06226-g4986cc3e1b75-dirty #250
[    3.577310] Hardware name: NXP i.MX95 19X19 board (DT)
[    3.582452] Workqueue: events_unbound deferred_probe_work_func
[    3.588291] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    3.595233] pc : __virt_to_phys+0x68/0x98
[    3.599246] lr : __virt_to_phys+0x68/0x98
[    3.603276] sp : ffff800083603990
[    3.677939] Call trace:
[    3.680393]  __virt_to_phys+0x68/0x98
[    3.684067]  drm_fbdev_dma_helper_fb_probe+0x138/0x238
[    3.689214]  __drm_fb_helper_initial_config_and_unlock+0x2b0/0x4c0
[    3.695385]  drm_fb_helper_initial_config+0x4c/0x68
[    3.700264]  drm_fbdev_dma_client_hotplug+0x8c/0xe0
[    3.705161]  drm_client_register+0x60/0xb0
[    3.709269]  drm_fbdev_dma_setup+0x94/0x148

Additionally, DMA memory is assumed to by contiguous in physical
address space, which is not guaranteed by vmalloc().

Resolve this by checking the module flag drm_leak_fbdev_smem when
DRM allocated the instance of struct fb_info. Fbdev-dma then only
sets smem_start only if required (via FBINFO_HIDE_SMEM_START). Also
guarantee that the framebuffer is not located in vmalloc address
space.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f29fcfbf6067c0d8c83f84a045da9276c08deac5
CVE-2024-41095: kernel: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A flaw was found in the Linux kernel’s nouveau module. The return value of the drm_mode_duplicate function is not checked in the nv17_tv_get_ld_modes function in the drivers/gpu/drm/nouveau/dispnv04/tvnv17.c file, possibly causing a NULL pointer dereference and resulting in a denial of service.


Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9289cd3450d1da3e271ef4b054d4d2932c41243e
CVE-2024-41096: kernel: PCI/MSI: Fix UAF in msi_capability_init
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-29T00:00:00+00:00

A use after free vulnerability was found in the Linux Kernel. Failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init(), which accesses the descriptor for unmasking in the error exit path, leading to a loss of confidentiality, integrity, and availability.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.109, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0ae40b2d0a5de6b045504098e365d4fdff5bbeba
CVE-2024-41097: kernel: usb: atm: cxacru: fix endpoint checking in cxacru_bind()
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: cxacru: fix endpoint checking in cxacru_bind()

Syzbot is still reporting quite an old issue [1] that occurs due to
incomplete checking of present usb endpoints. As such, wrong
endpoints types may be used at urb sumbitting stage which in turn
triggers a warning in usb_submit_urb().

Fix the issue by verifying that required endpoint types are present
for both in and out endpoints, taking into account cmd endpoint type.

Unfortunately, this patch has not been tested on real hardware.

[1] Syzbot report:
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 8667 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502
Modules linked in:
CPU: 0 PID: 8667 Comm: kworker/0:4 Not tainted 5.14.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502
...
Call Trace:
 cxacru_cm+0x3c0/0x8e0 drivers/usb/atm/cxacru.c:649
 cxacru_card_status+0x22/0xd0 drivers/usb/atm/cxacru.c:760
 cxacru_bind+0x7ac/0x11a0 drivers/usb/atm/cxacru.c:1209
 usbatm_usb_probe+0x321/0x1ae0 drivers/usb/atm/usbatm.c:1055
 cxacru_usb_probe+0xdf/0x1e0 drivers/usb/atm/cxacru.c:1363
 usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:517 [inline]
 really_probe+0x23c/0xcd0 drivers/base/dd.c:595
 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747
 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777
 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894
 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
 __device_attach+0x228/0x4a0 drivers/base/dd.c:965
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487
 device_add+0xc2f/0x2180 drivers/base/core.c:3354
 usb_set_configuration+0x113a/0x1910 drivers/usb/core/message.c:2170
 usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238
 usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293


Affected upstream versions: 2.6.35.5 < 2.6.36, 2.6.36
Fixed upstream versions: 0, 2.6.36, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5159a81924311c1ec786ad9fdef784ead8676a6a
CVE-2024-41110: moby: Authz zero length regression
Component: moby
Severity: Critical
CWE: CWE-807 (Reliance on Untrusted Inputs in a Security Decision)
CVSS v3: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2024-07-23T00:00:00+00:00

A vulnerability was found in Authorization plugins in Docker Engine (AuthZ). Using a specially-crafted API request, an Engine API client could make the daemon forward a request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request that it would have otherwise denied if the body had been forwarded to it.

Statement: This flaw is a regression of a fix from a 2019 issue for this same scenario, which was not carried forward.
Anyone who depends on authorization plugins that introspect the request or response body to make access control decisions may be impacted.

Red Hat does not ship AuthZ plugin in any of the current container tools such as Podman, Buildah, Skopeo, and containernetworking-plugins, therefore, they are not affected.

Affected upstream versions: >= 19.03.0, <= 19.03.15, >= 20.0.0, <= 20.10.27, >= 23.0.0, <= 23.0.14, >= 24.0.0, <= 24.0.9, >= 25.0.0, <= 25.0.5, >= 26.0.0, <= 26.0.2, >= 26.1.0, <= 26.1.14, >= 27.0.0, <= 27.0.3, = 27.1.0
Fixed upstream versions: v26.1.5
Upstream repository: https://github.com/moby/moby
Upstream fix commit: 411e817ddf710ff8e08fa193da80cb78af708191
CVE-2024-41810: python-twisted: Reflected XSS via HTML Injection in Redirect Response
Component: python-twisted
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)
Public date: 2024-07-29T16:24:00+00:00

A Cross-site scripting (XSS) vulnerability exists in Python-Twisted in the twisted.web.util.redirectTo function. This flaw allows an attacker to control the redirect URL, leading to reflected XSS in the HTML body of the redirect response. If exploited, a remote attacker could inject malicious HTML, causing unauthorized JavaScript execution within the victim's browser session. This issue can result in unauthorized access to the victim’s account and data or allow the attacker to perform operations on behalf of the victim.

Statement: The vulnerability is exploitable only in Firefox. All other tested browsers will display an error message to the user and will not render the HTML body.

Affected upstream versions: <= 24.3.0
Fixed upstream versions: twisted-24.7.0
Upstream repository: https://github.com/twisted/twisted
Upstream fix commit: 046a164f89a0f08d3239ecebd750360f8914df33
CVE-2024-41818: fast-xml-parser: ReDOS at currency parsing in currency.js
Component: fast-xml-parser
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-28T00:00:00+00:00

A regular expression denial of service (ReDoS) flaw was found in fast-xml-parser in the currency.js script. By sending a specially crafted regex input, a remote attacker could cause a denial of service condition.

Statement: Red Hat has decided to rate this vulnerability as Important due to the potential loss of Availability and the low complexity.

Affected upstream versions: >= 4.3.5, < 4.4.1
Fixed upstream versions: v4.4.1
Upstream repository: https://github.com/NaturalIntelligence/fast-xml-parser
Upstream fix commit: d0bfe8a3a2813a185f39591bbef222212d856164
CVE-2024-41946: rexml: DoS vulnerability in REXML
Component: rexml
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2024-08-01T00:00:00+00:00

A flaw was found in the REXML package. Reading an XML file that contains many entity expansions may lead to a denial of service due to resource starvation. An attacker can use this flaw to trick a user into processing an untrusted XML file.


Affected upstream versions: < 3.3.3
Fixed upstream versions: v3.3.3
Upstream repository: https://github.com/ruby/rexml
Upstream fix commit: 033d1909a8f259d5a7c53681bcaf14f13bcf0368
CVE-2024-42070: kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers

register store validation for NFT_DATA_VALUE is conditional, however,
the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This
only requires a new helper function to infer the register type from the
set datatype so this conditional check can be removed. Otherwise,
pointer to chain object can be leaked through the registers.


Affected upstream versions: 3.13
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 40188a25a9847dbeb7ec67517174a835a677752f
CVE-2024-42078: kernel: nfsd: initialise nfsd_info.mutex early.
Component: kernel
Severity: Low
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nfsd: initialise nfsd_info.mutex early.

nfsd_info.mutex can be dereferenced by svc_pool_stats_start()
immediately after the new netns is created.  Currently this can
trigger an oops.

Move the initialisation earlier before it can possibly be dereferenced.


Affected upstream versions: 6.8
Fixed upstream versions: 0, 6.10, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7e8b94045bc77ce4f085ddfb9eb04e5760e66169
CVE-2024-42079: kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix NULL pointer dereference in gfs2_log_flush

In gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush
lock to provide exclusion against gfs2_log_flush().

In gfs2_log_flush(), check if sdp->sd_jdesc is non-NULL before
dereferencing it.  Otherwise, we could run into a NULL pointer
dereference when outstanding glock work races with an unmount
(glock_work_func -> run_queue -> do_xmote -> inode_go_sync ->
gfs2_log_flush).


Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.200, 6.1.162, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c3c5cfa3170c0940bc66a142859caac07d19b9d6
CVE-2024-42082: kernel: xdp: Remove WARN() from __xdp_reg_mem_model()
Component: kernel
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A flaw was found in the Linux kernel's xdp subsystem in the __xdp_reg_mem_model() function where a memory allocation failure will trigger a warning if the function __mem_id_init_hash_table() returns an error. This warning is unnecessary as it elevates the severity of a memory allocation failure and pollutes the kernel log with redundant and unnecessary warnings, decreasing the readability of system logs.


Affected upstream versions: 4.18
Fixed upstream versions: 0, 5.10.221, 5.15.162, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1095b8efbb13a6a5fa583ed373ee1ccab29da2d0