huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-35960: kernel: net/mlx5: Properly link new fs rules into the tree
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

CVE-2024-35960 is a vulnerability in the Linux kernel's Mellanox MLX5 driver that affects flow steering rule handling. When identical rules are created and referenced multiple times, they can fail to properly link into the rule tree, leaving them uninitialized. This can cause system crashes during rule deletion due to invalid references. The issue has been fixed by ensuring all newly created rules are properly initialized and linked. Updating to a patched kernel version resolves the problem and ensures system stability.


Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.19.313, 5.10.216, 5.15.156, 5.4.275, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: de0139719cdda82806a47580ca0df06fc85e0bd2
CVE-2024-35962: kernel: netfilter: complete validation of user input
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

A denial of service vulnerability exists in the Linux kernel such that @optlen validation is not called before the function xt_alloc_table_info(), an attacker could craft a payload that results in a crash resulting in loss of availability.


Affected upstream versions: 5.10.215 < 5.10.216, 5.15.154 < 5.15.156, 6.1.85 < 6.1.87, 6.6.26 < 6.6.28, 6.8.5 < 6.8.7
Fixed upstream versions: 5.10.216, 5.15.156, 6.1.87, 6.6.28, 6.8.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cf4bc359b76144a3dd55d7c09464ef4c5f2b2b05
CVE-2024-35963: kernel: Bluetooth: hci_sock: Fix not validating setsockopt user input
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

A denial of service vulnerability was found in the Linux kernel. No input validation is performed in the  Bluetooth hci_sock function. This vulnerability could lead to a crash, resulting in the loss of system availability.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.113, 6.6.55, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 781f3a97a38a338bc893b6db7f9f9670bf1a9e37
CVE-2024-35964: kernel: Bluetooth: ISO: Fix not validating setsockopt user input
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

CVE-2024-35964 is a vulnerability in the Linux kernel’s Bluetooth ISO implementation. It occurs because the setsockopt function does not properly validate the size of user-provided data before copying it into kernel memory. This flaw can lead to buffer overflows, potentially resulting in crashes or code execution.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.119, 6.6.55, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cec736e60dc18d91b88af28d96664bff284b02d1
CVE-2024-35965: kernel: Bluetooth: L2CAP: Fix not validating setsockopt user input
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

CVE-2024-35965 is a vulnerability in the Linux kernel's Bluetooth L2CAP implementation, caused by inadequate input length validation in the setsockopt function. This flaw allows overly large user-provided data to be copied into kernel memory, potentially leading to buffer overflows, system instability, or privilege escalation. The issue has been fixed by adding proper checks to ensure data size is within acceptable limits. Users should update their Linux kernel to the patched version to mitigate this risk.


Affected upstream versions: 2.6.39
Fixed upstream versions: 0, 5.10.227, 6.1.87, 6.6.55, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f13b04cf65a86507ff15a9bbf37969d25be3e2a0
CVE-2024-35966: kernel: Bluetooth: RFCOMM: Fix not validating setsockopt user input
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

This is a vulnerability in the Linux kernel's Bluetooth RFCOMM protocol. It occurs because the rfcomm_sock_setsockopt_old() function fails to properly validate the length of user-supplied data, leading to out-of-bounds memory reads. This flaw could result in system instability or crashes.


Affected upstream versions: 2.6.30
Fixed upstream versions: 0, 5.10.234, 5.15.178, 6.1.107, 6.6.47, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d072ea24748189cd8f4a9c3f585ca9af073a0838
CVE-2024-35967: kernel: Bluetooth: SCO: Fix not validating setsockopt user input
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

This CVE pertains to a vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the SCO (Synchronous Connection-Oriented) protocol. The issue arises from the sco_sock_setsockopt() function, which copies data without properly validating the length of user input. This oversight can lead to a slab-out-of-bounds read, potentially causing system instability or crashes.


Affected upstream versions: 3.8
Fixed upstream versions: 0, 5.10.216, 5.15.178, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b0e30c37695b614bee69187f86eaf250e36606ce
CVE-2024-35969: kernel: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

This CVE addresses a race condition in the Linux kernel's IPv6 subsystem, specifically between the ipv6_get_ifaddr and ipv6_del_addr functions. This race condition can lead to use-after-free scenarios, potentially causing system instability or crashes.


Affected upstream versions: 2.6.35
Fixed upstream versions: 0, 4.19.313, 5.10.216, 5.15.156, 5.4.275, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1
CVE-2024-35973: kernel: geneve: fix header validation in geneve[6]_xmit_skb
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

geneve: fix header validation in geneve[6]_xmit_skb

The Linux kernel CVE team has assigned CVE-2024-35973 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024052024-CVE-2024-35973-1b5b@gregkh/T


Affected upstream versions: 4.19.191 < 4.19.313, 5.4.119 < 5.4.275, 5.10.37 < 5.10.216, 5.11.21 < 5.12, 5.12.4 < 5.13, 5.13
Fixed upstream versions: 0, 4.19.313, 5.10.216, 5.12, 5.13, 5.15.156, 5.4.275, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 43be590456e1f3566054ce78ae2dbb68cbe1a536
CVE-2024-35976: kernel: xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING

The Linux kernel CVE team has assigned CVE-2024-35976 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024052024-CVE-2024-35976-339b@gregkh/T


Affected upstream versions: 4.18
Fixed upstream versions: 0, 4.19.317, 5.10.216, 5.15.156, 5.4.278, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: beb99266830520e15fbc6ca8cc5a5240d76851fd
CVE-2024-35978: kernel: Bluetooth: Fix memory leak in hci_req_sync_complete()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

This CVE identifies a memory leak in the Linux kernel's Bluetooth subsystem, specifically within the hci_req_sync_complete() function. The issue arises because the function fails to release the previous synchronization request state before assigning a new one, leading to increased memory usage over time. This flaw can degrade system performance and potentially cause a denial of service.


Affected upstream versions: 4.1
Fixed upstream versions: 0, 4.19.313, 5.10.216, 5.15.156, 5.4.275, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 89a32741f4217856066c198a4a7267bcdd1edd67
CVE-2024-35979: kernel: raid1: fix use-after-free for original bio in raid1_write_request()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

raid1: fix use-after-free for original bio in raid1_write_request()

The Linux kernel CVE team has assigned CVE-2024-35979 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024052025-CVE-2024-35979-2618@gregkh/T


Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3f28d49a328fe20926995d5fbdc92da665596268
CVE-2024-35983: kernel: bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

A vulnerability was found in the Linux kernel related to the improper handling of power-of-two values for `CONFIG_NR_CPUS`. The `bits_per()` function incorrectly rounds up to the next power of two when given a power of two, causing crashes on certain systems.


Affected upstream versions: 6.7.12 < 6.8, 5.4.274 < 5.4.275, 5.10.215 < 5.10.216, 5.15.154 < 5.15.158, 6.1.84 < 6.1.90, 6.6.24 < 6.6.30, 6.8.3 < 6.8.9
Fixed upstream versions: 5.10.216, 5.15.158, 5.4.275, 6.1.90, 6.6.30, 6.8, 6.8.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d34a516f2635090d36a306f84573e8de3d7374ce
CVE-2024-35989: kernel: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

This is a vulnerability in the Linux kernel's Data Movement Accelerator (DMA) engine, specifically affecting the Intel Data Streaming Accelerator (IDXD) driver. The issue arises during the removal (rmmod) of the idxd driver on systems with only one active CPU. In such scenarios, the driver's cleanup process attempts to migrate performance monitoring unit (PMU) contexts to another CPU. However, with no other CPUs available, this leads to a kernel oops—a serious error causing the system to crash.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.158, 6.1.90, 6.6.30, 6.8.9, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9edd3aa34d50f27b97be30b2ba4a6af0945ff56b
CVE-2024-35991: kernel: dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue

The Linux kernel CVE team has assigned CVE-2024-35991 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024052020-CVE-2024-35991-5f06@gregkh/T


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.6.30, 6.8.9, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 758071a35d9f3ffd84ff12169d081412a2f5f098
CVE-2024-35995: kernel: ACPI: CPPC: Use access_width over bit_width for system memory accesses
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

A vulnerability was found in the ACPI subsystem's CPPC driver in the Linux kernel. This issue occurs due to the mishandling of memory access bit width during performance capability calculations, which can lead to misaligned memory accesses and cause kernel panics on affected platforms.


Affected upstream versions: 4.9
Fixed upstream versions: 0, 6.1.90, 6.6.30, 6.8.9, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 01fc53be672acae37e611c80cc0b4f3939584de3
CVE-2024-36000: kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

CVE-2024-36000 addresses a synchronization issue in the Linux kernel's management of huge pages. The problem arises when multiple threads modify the reservation map concurrently without proper locking, leading to potential inconsistencies and system instability.


Affected upstream versions: 5.9.7 < 5.10, 5.10
Fixed upstream versions: 0, 5.10, 6.1.91, 6.6.30, 6.8.9, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4c806333efea1000a2a9620926f560ad2e1ca7cc
CVE-2024-36002: kernel: dpll: fix dpll_pin_on_pin_register() for multiple parent pins
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix dpll_pin_on_pin_register() for multiple parent pins

In scenario where pin is registered with multiple parent pins via
dpll_pin_on_pin_register(..), all belonging to the same dpll device.
A second call to dpll_pin_on_pin_unregister(..) would cause a call trace,
as it tries to use already released registration resources (due to fix
introduced in b446631f355e). In this scenario pin was registered twice,
so resources are not yet expected to be release until each registered
pin/pin pair is unregistered.

Currently, the following crash/call trace is produced when ice driver is
removed on the system with installed E810T NIC which includes dpll device:

WARNING: CPU: 51 PID: 9155 at drivers/dpll/dpll_core.c:809 dpll_pin_ops+0x20/0x30
RIP: 0010:dpll_pin_ops+0x20/0x30
Call Trace:
 ? __warn+0x7f/0x130
 ? dpll_pin_ops+0x20/0x30
 dpll_msg_add_pin_freq+0x37/0x1d0
 dpll_cmd_pin_get_one+0x1c0/0x400
 ? __nlmsg_put+0x63/0x80
 dpll_pin_event_send+0x93/0x140
 dpll_pin_on_pin_unregister+0x3f/0x100
 ice_dpll_deinit_pins+0xa1/0x230 [ice]
 ice_remove+0xf1/0x210 [ice]

Fix by adding a parent pointer as a cookie when creating a registration,
also when searching for it. For the regular pins pass NULL, this allows to
create separated registration for each parent the pin is registered with.


Affected upstream versions: 6.7.11 < 6.8, 6.8.2 < 6.8.9
Fixed upstream versions: 6.8, 6.8.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f3e1cf62d18220a3aa97e084e7a3552debece9fc
CVE-2024-36003: kernel: ice: fix LAG and VF lock dependency in ice_reset_vf()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

CVE-2024-36003 pertains to a deadlock vulnerability in the Linux kernel's ICE driver, which manages Intel Ethernet controllers. The issue arises from improper lock acquisition order between the Link Aggregation (LAG) mutex and the Virtual Function (VF) configuration lock within the ice_reset_vf() function. This misordering can lead to a circular dependency, causing the system to hang.


Affected upstream versions: 6.6.5 < 6.6.30, 6.7
Fixed upstream versions: 0, 6.6.30, 6.8.9, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 740717774dc37338404d10726967d582414f638c
CVE-2024-36005: kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: honor table dormant flag from netdev release event path

The Linux kernel CVE team has assigned CVE-2024-36005 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024052024-CVE-2024-36005-2336@gregkh/T


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.216, 5.15.158, 6.1.90, 6.6.30, 6.8.9, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e4bb6da24de336a7899033a65490ed2d892efa5b
CVE-2024-36006: kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_acl_tcam: Fix incorrect list API usage

The Linux kernel CVE team has assigned CVE-2024-36006 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024052025-CVE-2024-36006-c032@gregkh/T


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.216, 5.15.158, 5.4.275, 6.1.90, 6.6.30, 6.8.9, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0b2c13b670b168e324e1cf109e67056a20fd610a
CVE-2024-36007: kernel: mlxsw: spectrum_acl_tcam: Fix warning during rehash
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_acl_tcam: Fix warning during rehash

As previously explained, the rehash delayed work migrates filters from
one region to another. This is done by iterating over all chunks (all
the filters with the same priority) in the region and in each chunk
iterating over all the filters.

When the work runs out of credits it stores the current chunk and entry
as markers in the per-work context so that it would know where to resume
the migration from the next time the work is scheduled.

Upon error, the chunk marker is reset to NULL, but without resetting the
entry markers despite being relative to it. This can result in migration
being resumed from an entry that does not belong to the chunk being
migrated. In turn, this will eventually lead to a chunk being iterated
over as if it is an entry. Because of how the two structures happen to
be defined, this does not lead to KASAN splats, but to warnings such as
[1].

Fix by creating a helper that resets all the markers and call it from
all the places the currently only reset the chunk marker. For good
measures also call it when starting a completely new rehash. Add a
warning to avoid future cases.

[1]
WARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0
Modules linked in:
CPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G        W          6.9.0-rc3-custom-00880-g29e61d91b77b #29
Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019
Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work
RIP: 0010:mlxsw_afk_encode+0x242/0x2f0
[...]
Call Trace:
 <TASK>
 mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0
 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0
 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290
 mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470
 process_one_work+0x151/0x370
 worker_thread+0x2cb/0x3e0
 kthread+0xd0/0x100
 ret_from_fork+0x34/0x50
 </TASK>


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.216, 5.15.158, 5.4.275, 6.1.90, 6.6.30, 6.8.9, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0b88631855026b55cad901ac28d081e0f358e596
CVE-2024-36010: kernel: igb: Fix string truncation warnings in igb_set_fw_version
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

igb: Fix string truncation warnings in igb_set_fw_version

Commit 1978d3ead82c ("intel: fix string truncation warnings")
fixes '-Wformat-truncation=' warnings in igb_main.c by using kasprintf.

drivers/net/ethernet/intel/igb/igb_main.c:3092:53: warning：‘%d’ directive output may be truncated writing between 1 and 5 bytes into a region of size between 1 and 13 [-Wformat-truncation=]
 3092 |                                  "%d.%d, 0x%08x, %d.%d.%d",
      |                                                     ^~
drivers/net/ethernet/intel/igb/igb_main.c:3092:34: note：directive argument in the range [0, 65535]
 3092 |                                  "%d.%d, 0x%08x, %d.%d.%d",
      |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/intel/igb/igb_main.c:3092:34: note：directive argument in the range [0, 65535]
drivers/net/ethernet/intel/igb/igb_main.c:3090:25: note：‘snprintf’ output between 23 and 43 bytes into a destination of size 32

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.

Fix this warning by using a larger space for adapter->fw_version,
and then fall back and continue to use snprintf.


Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c56d055893cbe97848611855d1c97d0ab171eccc
CVE-2024-36011: kernel: Bluetooth: HCI: Fix potential null-ptr-deref
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HCI: Fix potential null-ptr-deref

Fix potential null-ptr-deref in hci_le_big_sync_established_evt().


Affected upstream versions: 6.4.16 < 6.5, 6.5.3 < 6.6, 6.6
Fixed upstream versions: 0, 6.5, 6.6, 6.6.31, 6.8.10, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1f7ebb69c1d65732bcac2fda9d15421f76f01e81