huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-44947: kernel: fuse: Initialize beyond-EOF page contents before setting uptodate
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-09-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fuse: Initialize beyond-EOF page contents before setting uptodate

fuse_notify_store(), unlike fuse_do_readpage(), does not enable page
zeroing (because it can be used to change partial page contents).

So fuse_notify_store() must be more careful to fully initialize page
contents (including parts of the page that are beyond end-of-file)
before marking the page uptodate.

The current code can leave beyond-EOF page contents uninitialized, which
makes these uninitialized page contents visible to userspace via mmap().

This is an information leak, but only affects systems which do not
enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the
corresponding kernel command line parameter).


Affected upstream versions: 2.6.36
Fixed upstream versions: 0, 4.19.321, 5.10.225, 5.15.166, 5.4.283, 6.1.107, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 49934861514d36d0995be8e81bb3312a499d8d9a
CVE-2024-44958: kernel: sched/smt: Fix unbalance sched_smt_present dec/inc
Component: kernel
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sched/smt: Fix unbalance sched_smt_present dec/inc

I got the following warn report while doing stress test:

jump label: negative count!
WARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 static_key_slow_try_dec+0x9d/0xb0
Call Trace:
 <TASK>
 __static_key_slow_dec_cpuslocked+0x16/0x70
 sched_cpu_deactivate+0x26e/0x2a0
 cpuhp_invoke_callback+0x3ad/0x10d0
 cpuhp_thread_fun+0x3f5/0x680
 smpboot_thread_fn+0x56d/0x8d0
 kthread+0x309/0x400
 ret_from_fork+0x41/0x70
 ret_from_fork_asm+0x1b/0x30
 </TASK>

Because when cpuset_cpu_inactive() fails in sched_cpu_deactivate(),
the cpu offline failed, but sched_smt_present is decremented before
calling sched_cpu_deactivate(), it leads to unbalanced dec/inc, so
fix it by incrementing sched_smt_present in the error path.


Affected upstream versions: 4.14.86 < 4.15, 4.19.7 < 4.20, 4.20
Fixed upstream versions: 0, 4.15, 4.20, 5.15.165, 6.1.105, 6.10.5, 6.11, 6.6.46
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2a3548c7ef2e135aee40e7e5e44e7d11b893e7c4
CVE-2024-44960: kernel: usb: gadget: core: Check for unset descriptor
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: core: Check for unset descriptor

Make sure the descriptor has been set before looking at maxpacket.
This fixes a null pointer panic in this case.

This may happen if the gadget doesn't properly set up the endpoint
for the current speed, or the gadget descriptors are malformed and
the descriptor for the speed/endpoint are not found.

No current gadget driver is known to have this problem, but this
may cause a hard-to-find bug during development of new gadgets.


Affected upstream versions: 4.19.82 < 4.19.320, 3.16.80 < 3.17, 4.4.199 < 4.5, 4.9.199 < 4.10, 4.14.152 < 4.15, 5.3.9 < 5.4, 5.4
Fixed upstream versions: 0, 3.17, 4.10, 4.15, 4.19.320, 4.5, 5.10.224, 5.15.165, 5.4, 5.4.282, 6.1.105, 6.10.5, 6.11, 6.6.46
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ba15815dd24cc5ec0d23e2170dc58c7db1e03b4a
CVE-2024-44964: kernel: idpf: fix memory leaks and crashes while performing a soft reset
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix memory leaks and crashes while performing a soft reset

The second tagged commit introduced a UAF, as it removed restoring
q_vector->vport pointers after reinitializating the structures.
This is due to that all queue allocation functions are performed here
with the new temporary vport structure and those functions rewrite
the backpointers to the vport. Then, this new struct is freed and
the pointers start leading to nowhere.

But generally speaking, the current logic is very fragile. It claims
to be more reliable when the system is low on memory, but in fact, it
consumes two times more memory as at the moment of running this
function, there are two vports allocated with their queues and vectors.
Moreover, it claims to prevent the driver from running into "bad state",
but in fact, any error during the rebuild leaves the old vport in the
partially allocated state.
Finally, if the interface is down when the function is called, it always
allocates a new queue set, but when the user decides to enable the
interface later on, vport_open() allocates them once again, IOW there's
a clear memory leak here.

Just don't allocate a new queue set when performing a reset, that solves
crashes and memory leaks. Readd the old queue number and reopen the
interface on rollback - that solves limbo states when the device is left
disabled and/or without HW queues enabled.


Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.10.5, 6.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6b289f8d91537ec1e4f9c7b38b31b90d93b1419b
CVE-2024-44965: kernel: x86/mm: Fix pti_clone_pgtable() alignment assumption
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Fix pti_clone_pgtable() alignment assumption

Guenter reported dodgy crashes on an i386-nosmp build using GCC-11
that had the form of endless traps until entry stack exhaust and then
#DF from the stack guard.

It turned out that pti_clone_pgtable() had alignment assumptions on
the start address, notably it hard assumes start is PMD aligned. This
is true on x86_64, but very much not true on i386.

These assumptions can cause the end condition to malfunction, leading
to a 'short' clone. Guess what happens when the user mapping has a
short copy of the entry text?

Use the correct increment form for addr to avoid alignment
assumptions.


Affected upstream versions: 4.19
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.105, 6.10.5, 6.11, 6.6.46
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 18da1b27ce16a14a9b636af9232acb4fb24f4c9e
CVE-2024-44970: kernel: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2024-09-04T00:00:00+00:00

In Linux kernel net/mlx5e, for SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.105, 6.10.5, 6.11, 6.6.46
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7b379353e9144e1f7460ff15f39862012c9d0d78
CVE-2024-44984: kernel: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
Component: kernel
Severity: Moderate
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-04T00:00:00+00:00

A flaw was found in the bnxt_en module in the Linux kernel. A double DMA unmapping can trigger a kernel warning and cause a denial of service.

Statement: The bnxt_en module in the Linux kernel as shipped in Red Hat Enterprise Linux 8 is not affected by this vulnerability because the vulnerable code was introduced in a newer version of the Linux kernel.

Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fa4e6ae38574d0fc5596272bee64727d8ab7052b
CVE-2024-44987: kernel: ipv6: prevent UAF in ip6_send_skb()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-09-04T00:00:00+00:00

A possible use-after-free was found in the Linux kernel in net/ipv6/ip6_output.c.


Affected upstream versions: 2.6.32
Fixed upstream versions: 0, 4.19.321, 5.10.225, 5.15.166, 5.4.283, 6.1.107, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 571567e0277008459750f0728f246086b2659429
CVE-2024-44990: kernel: bonding: fix null pointer deref in bond_ipsec_offload_ok
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix null pointer deref in bond_ipsec_offload_ok

We must check if there is an active slave before dereferencing the pointer.


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.225, 5.15.166, 6.1.107, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 81216b9352be43f8958092d379f6dec85443c309
CVE-2024-44994: kernel: iommu: Restore lost return in iommu_report_device_fault()
Component: kernel
Severity: Moderate
CWE: CWE-703 (Improper Check or Handling of Exceptional Conditions)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu: Restore lost return in iommu_report_device_fault()

When iommu_report_device_fault gets called with a partial fault it is
supposed to collect the fault into the group and then return.

Instead the return was accidently deleted which results in trying to
process the fault and an eventual crash.

Deleting the return was a typo, put it back.


Affected upstream versions: 6.9
Fixed upstream versions: 0, 6.10.7, 6.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cc6bc2ab1663ec9353636416af22452b078510e9
CVE-2024-45000: kernel: fs/netfs/fscache_cookie: add missing "n_accesses" check
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-04T00:00:00+00:00

A race condition vulnerability was found in the Linux kernel. A race condition in the `fscache_cookie` subsystem leads to a NULL pointer dereference. The issue occurred when multiple processes accessed a cached file while it was being withdrawn, causing the cache's metadata to clear prematurely.

Statement: This issue is classified as Moderate severity rather than Important because, while it leads to a NULL pointer dereference and a subsequent kernel crash, it requires specific conditions to trigger. The vulnerability depends on a race condition between multiple processes accessing the same cached file, which is not easily exploitable in most environments. Additionally, it does not directly enable privilege escalation, remote code execution, or data corruption.

Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.107, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b8a50877f68efdcc0be3fcc5116e00c31b90e45b
CVE-2024-45005: kernel: KVM: s390: fix validity interception issue when gisa is switched off
Component: kernel
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-04T00:00:00+00:00

Fix validity interception issue when gisa is switched off. If gisa has been disabled either via using kernel parameter "kvm.use_gisa=0" or by setting the related sysfs attribute to N (echo N >/sys/module/kvm/parameters/use_gisa). The validity is caused by an invalid value in the SIE control block's gisa designation. That happens because we pass the uninitialized gisa origin to virt_to_phys() before writing it to the gisa designation.

To fix this we return 0 in kvm_s390_get_gisa_desc() if the origin is 0. kvm_s390_get_gisa_desc() is used to determine which gisa designation to set in the SIE control block. A value of 0 in the gisa designation disables gisa usage. The issue surfaces in the host kernel with the following kernel message as soon a new kvm guest start is attempted.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 051c0a558154174cfcea301a386e4c91ade83ce1
CVE-2024-45009: kernel: mptcp: pm: only decrement add_addr_accepted for MPJ req
Component: kernel
Severity: Moderate
CWE: CWE-664 (Improper Control of a Resource Through its Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: only decrement add_addr_accepted for MPJ req

Adding the following warning ...

  WARN_ON_ONCE(msk->pm.add_addr_accepted == 0)

... before decrementing the add_addr_accepted counter helped to find a
bug when running the "remove single subflow" subtest from the
mptcp_join.sh selftest.

Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the
subflow closure. Before this patch, and upon the reception of the
RM_ADDR, the other peer will then try to decrement this
add_addr_accepted. That's not correct because the attached subflows have
not been created upon the reception of an ADD_ADDR.

A way to solve that is to decrement the counter only if the attached
subflow was an MP_JOIN to a remote id that was not 0, and initiated by
the host receiving the RM_ADDR.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.15.167, 6.1.107, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 35b31f5549ede4070566b949781e83495906b43d
CVE-2024-45010: kernel: mptcp: pm: only mark 'subflow' endp as available
Component: kernel
Severity: Moderate
CWE: CWE-691 (Insufficient Control Flow Management)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: only mark 'subflow' endp as available

Adding the following warning ...

  WARN_ON_ONCE(msk->pm.local_addr_used == 0)

... before decrementing the local_addr_used counter helped to find a bug
when running the "remove single address" subtest from the mptcp_join.sh
selftests.

Removing a 'signal' endpoint will trigger the removal of all subflows
linked to this endpoint via mptcp_pm_nl_rm_addr_or_subflow() with
rm_type == MPTCP_MIB_RMSUBFLOW. This will decrement the local_addr_used
counter, which is wrong in this case because this counter is linked to
'subflow' endpoints, and here it is a 'signal' endpoint that is being
removed.

Now, the counter is decremented, only if the ID is being used outside
of mptcp_pm_nl_rm_addr_or_subflow(), only for 'subflow' endpoints, and
if the ID is not 0 -- local_addr_used is not taking into account these
ones. This marking of the ID as being available, and the decrement is
done no matter if a subflow using this ID is currently available,
because the subflow could have been closed before.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 6.1.108, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7fdc870d08960961408a44c569f20f50940e7d4f
CVE-2024-45016: kernel: netem: fix return value if duplicate enqueue fails
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-09-11T00:00:00+00:00

A flaw use after free in the Linux kernel Network emulator (NETEM) functionality was found. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

Statement: Red Hat Enterprise Linux starting from 8.10 versions are affected.

Affected upstream versions: 3.16.66 < 3.17, 4.9.163 < 4.10, 4.14.106 < 4.15, 4.19.28 < 4.20, 4.20.15 < 4.21, 5.0
Fixed upstream versions: 0, 3.17, 4.10, 4.15, 4.20, 4.21, 5.10.225, 5.15.166, 5.4.283, 6.1.107, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 759e3e8c4a6a6b4e52ebc4547123a457f0ce90d4
CVE-2024-45018: kernel: netfilter: flowtable: initialise extack before use
Component: kernel
Severity: Moderate
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: initialise extack before use

Fix missing initialisation of extack in flow offload.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.225, 5.15.166, 6.1.107, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e5ceff2196dc633c995afb080f6f44a72cff6e1d
CVE-2024-45020: kernel: bpf: Fix a kernel verifier crash in stacksafe()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix a kernel verifier crash in stacksafe()

Daniel Hodges reported a kernel verifier crash when playing with sched-ext.
Further investigation shows that the crash is due to invalid memory access
in stacksafe(). More specifically, it is the following code:

    if (exact != NOT_EXACT &&
        old->stack[spi].slot_type[i % BPF_REG_SIZE] !=
        cur->stack[spi].slot_type[i % BPF_REG_SIZE])
            return false;

The 'i' iterates old->allocated_stack.
If cur->allocated_stack < old->allocated_stack the out-of-bound
access will happen.

To fix the issue add 'i >= cur->allocated_stack' check such that if
the condition is true, stacksafe() should fail. Otherwise,
cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.


Affected upstream versions: 6.6.15 < 6.6.48, 6.7
Fixed upstream versions: 0, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7cad3174cc79519bf5f6c4441780264416822c08
CVE-2024-45022: kernel: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-11T00:00:00+00:00

Incorrect mappings in __vmap_pages_range_noflush() in the Linux kernel, may lead to memory corruption.


Affected upstream versions: 6.1.95 < 6.1.107, 6.3
Fixed upstream versions: 0, 6.1.107, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fd1ffbb50ef4da5e1378a46616b6d7407dc795da
CVE-2024-45026: kernel: s390/dasd: fix error recovery leading to data corruption on ESE devices
Component: kernel
Severity: Moderate
CWE: CWE-209 (Generation of Error Message Containing Sensitive Information)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: fix error recovery leading to data corruption on ESE devices

Extent Space Efficient (ESE) or thin provisioned volumes need to be
formatted on demand during usual IO processing.

The dasd_ese_needs_format function checks for error codes that signal
the non existence of a proper track format.

The check for incorrect length is to imprecise since other error cases
leading to transport of insufficient data also have this flag set.
This might lead to data corruption in certain error cases for example
during a storage server warmstart.

Fix by removing the check for incorrect length and replacing by
explicitly checking for invalid track format in transport mode.

Also remove the check for file protected since this is not a valid
ESE handling case.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.225, 5.15.166, 5.4.283, 6.1.107, 6.10.7, 6.11, 6.6.48
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 19f60a55b2fda49bc4f6134a5f6356ef62ee69d8
CVE-2024-45296: path-to-regexp: Backtracking regular expressions cause ReDoS
Component: path-to-regexp
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-09-09T19:15:13.330000+00:00

A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a denial of service (DoS).


Affected upstream versions: < 0.1.10, >= 0.2.0, < 8.0.0
Fixed upstream versions: v0.1.10
Upstream repository: https://github.com/pillarjs/path-to-regexp
Upstream fix commit: 29b96b4a1de52824e1ca0f49a701183cc4ed476f
CVE-2024-45310: runc: runc can be tricked into creating empty files/directories on host
Component: runc
Severity: Low
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 3.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)
Public date: 2024-09-03T11:17:32.277000+00:00

A vulnerability was found in runc. A malicious attacker may create empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with os.MkdirAll. While this can be used to create empty files, existing files will not be truncated.


Affected upstream versions: < 1.1.14, >= 1.2.0-rc-1, < 1.2.0-rc.3
Fixed upstream versions: v1.2.0
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: 63c2908164f3a1daea455bf5bcd8d363d70328c7