huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-52676: kernel: bpf: Guard stack limits against 32bit overflow
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Guard stack limits against 32bit overflow

The Linux kernel CVE team has assigned CVE-2023-52676 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051749-CVE-2023-52676-e224@gregkh/T


Affected upstream versions: 5.10.33 < 5.11, 5.11.17 < 5.12, 5.12
Fixed upstream versions: 0, 5.11, 5.12, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ad140fc856f0b1d5e2215bcb6d0cc247a86805a2
CVE-2023-52679: kernel: of: Fix double free in of_parse_phandle_with_args_map
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

of: Fix double free in of_parse_phandle_with_args_map

The Linux kernel CVE team has assigned CVE-2023-52679 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051750-CVE-2023-52679-948f@gregkh/T


Affected upstream versions: 4.17
Fixed upstream versions: 0, 4.19.306, 5.10.209, 5.15.148, 5.4.268, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 26b4d702c44f9e5cf3c5c001ae619a4a001889db
CVE-2023-52680: kernel: ALSA: scarlett2: Add missing error checks to *_ctl_get()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: scarlett2: Add missing error checks to *_ctl_get()

The Linux kernel CVE team has assigned CVE-2023-52680 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051750-CVE-2023-52680-1f4a@gregkh/T


Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3a09488f4f67f7ade59b8ac62a6c7fb29439cf51
CVE-2023-52683: kernel: ACPI: LPIT: Avoid u32 multiplication overflow
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ACPI: LPIT: Avoid u32 multiplication overflow

The Linux kernel CVE team has assigned CVE-2023-52683 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051751-CVE-2023-52683-f280@gregkh/T


Affected upstream versions: 4.15
Fixed upstream versions: 0, 4.19.306, 5.10.209, 5.15.148, 5.4.268, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 647d1d50c31e60ef9ccb9756a8fdf863329f7aee
CVE-2023-52686: kernel: powerpc/powernv: Add a null pointer check in opal_event_init()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

powerpc/powernv: Add a null pointer check in opal_event_init()

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.


Affected upstream versions: 4.11
Fixed upstream versions: 0, 4.19.306, 5.10.209, 5.15.148, 5.4.268, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8422d179cf46889c15ceff9ede48c5bfa4e7f0b4
CVE-2023-52689: kernel: ALSA: scarlett2: Add missing mutex lock around get meter levels
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: scarlett2: Add missing mutex lock around get meter levels

The Linux kernel CVE team has assigned CVE-2023-52689 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051753-CVE-2023-52689-f657@gregkh/T


Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 74e3de7cdcc31ce75ab42350ae0946eff62a2da2
CVE-2023-52690: kernel: powerpc/powernv: Add a null pointer check to scom_debug_init_one()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

powerpc/powernv: Add a null pointer check to scom_debug_init_one()

The Linux kernel CVE team has assigned CVE-2023-52690 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051753-CVE-2023-52690-f225@gregkh/T


Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.10.209, 5.15.148, 5.4.268, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f84c1446daa552e9699da8d1f8375eac0f65edc7
CVE-2023-52696: kernel: powerpc/powernv: Add a null pointer check in opal_powercap_init()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

powerpc/powernv: Add a null pointer check in opal_powercap_init()

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.209, 5.15.148, 5.4.268, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9da4a56dd3772570512ca58aa8832b052ae910dc
CVE-2023-52697: kernel: ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx-&gt;headset_codec_dev = NULL
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx-&gt;headset_codec_dev = NULL

The Linux kernel CVE team has assigned CVE-2023-52697 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051755-CVE-2023-52697-1b7f@gregkh/T


Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a410d58117d6da4b7d41f3c91365f191d006bc3d
CVE-2023-52698: kernel: calipso: fix memory leak in netlbl_calipso_add_pass()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

calipso: fix memory leak in netlbl_calipso_add_pass()

The Linux kernel CVE team has assigned CVE-2023-52698 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051756-CVE-2023-52698-bbc2@gregkh/T


Affected upstream versions: 4.8
Fixed upstream versions: 0, 4.19.306, 5.10.209, 5.15.148, 5.4.268, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9a8f811a146aa2a0230f8edb2e9f4b6609aab8da
CVE-2023-52700: kernel: tipc: fix kernel warning when sending SYN message
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix kernel warning when sending SYN message

When sending a SYN message, this kernel stack trace is observed:

...
[   13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550
...
[   13.398494] Call Trace:
[   13.398630]  <TASK>
[   13.398630]  ? __alloc_skb+0xed/0x1a0
[   13.398630]  tipc_msg_build+0x12c/0x670 [tipc]
[   13.398630]  ? shmem_add_to_page_cache.isra.71+0x151/0x290
[   13.398630]  __tipc_sendmsg+0x2d1/0x710 [tipc]
[   13.398630]  ? tipc_connect+0x1d9/0x230 [tipc]
[   13.398630]  ? __local_bh_enable_ip+0x37/0x80
[   13.398630]  tipc_connect+0x1d9/0x230 [tipc]
[   13.398630]  ? __sys_connect+0x9f/0xd0
[   13.398630]  __sys_connect+0x9f/0xd0
[   13.398630]  ? preempt_count_add+0x4d/0xa0
[   13.398630]  ? fpregs_assert_state_consistent+0x22/0x50
[   13.398630]  __x64_sys_connect+0x16/0x20
[   13.398630]  do_syscall_64+0x42/0x90
[   13.398630]  entry_SYSCALL_64_after_hwframe+0x63/0xcd

It is because commit a41dad905e5a ("iov_iter: saner checks for attempt
to copy to/from iterator") has introduced sanity check for copying
from/to iov iterator. Lacking of copy direction from the iterator
viewpoint would lead to kernel stack trace like above.

This commit fixes this issue by initializing the iov iterator with
the correct copy direction when sending SYN or ACK without data.


Affected upstream versions: 4.0
Fixed upstream versions: 0, 6.1.13, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 54b6082aec178f16ad6d193b4ecdc9c4823d9a32
CVE-2023-52703: kernel: net/usb: kalmia: Don&#39;t pass act_len in usb_bulk_msg error path
Component: kernel
Severity: Low
CWE: CWE-15 (External Control of System or Configuration Setting)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path

syzbot reported that act_len in kalmia_send_init_packet() is
uninitialized when passing it to the first usb_bulk_msg error path. Jiri
Pirko noted that it's pointless to pass it in the error path, and that
the value that would be printed in the second error path would be the
value of act_len from the first call to usb_bulk_msg.[1]

With this in mind, let's just not pass act_len to the usb_bulk_msg error
paths.

1: https://lore.kernel.org/lkml/Y9pY61y1nwTuzMOa@nanopsycho/


Affected upstream versions: 3.0
Fixed upstream versions: 0, 4.14.306, 4.19.273, 5.10.169, 5.15.95, 5.4.232, 6.1.13, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1b5de7d44890b78519acbcc80d8d1f23ff2872e5
CVE-2023-52730: kernel: mmc: sdio: fix possible resource leaks in some error paths
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mmc: sdio: fix possible resource leaks in some error paths

If sdio_add_func() or sdio_init_func() fails, sdio_remove_func() can
not release the resources, because the sdio function is not presented
in these two cases, it won't call of_node_put() or put_device().

To fix these leaks, make sdio_func_present() only control whether
device_del() needs to be called or not, then always call of_node_put()
and put_device().

In error case in sdio_init_func(), the reference of 'card->dev' is
not get, to avoid redundant put in sdio_free_func_cis(), move the
get_device() to sdio_alloc_func() and put_device() to sdio_release_func(),
it can keep the get/put function be balanced.

Without this patch, while doing fault inject test, it can get the
following leak reports, after this fix, the leak is gone.

unreferenced object 0xffff888112514000 (size 2048):
  comm "kworker/3:2", pid 65, jiffies 4294741614 (age 124.774s)
  hex dump (first 32 bytes):
    00 e0 6f 12 81 88 ff ff 60 58 8d 06 81 88 ff ff  ..o.....`X......
    10 40 51 12 81 88 ff ff 10 40 51 12 81 88 ff ff  .@Q......@Q.....
  backtrace:
    [<000000009e5931da>] kmalloc_trace+0x21/0x110
    [<000000002f839ccb>] mmc_alloc_card+0x38/0xb0 [mmc_core]
    [<0000000004adcbf6>] mmc_sdio_init_card+0xde/0x170 [mmc_core]
    [<000000007538fea0>] mmc_attach_sdio+0xcb/0x1b0 [mmc_core]
    [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core]

unreferenced object 0xffff888112511000 (size 2048):
  comm "kworker/3:2", pid 65, jiffies 4294741623 (age 124.766s)
  hex dump (first 32 bytes):
    00 40 51 12 81 88 ff ff e0 58 8d 06 81 88 ff ff  .@Q......X......
    10 10 51 12 81 88 ff ff 10 10 51 12 81 88 ff ff  ..Q.......Q.....
  backtrace:
    [<000000009e5931da>] kmalloc_trace+0x21/0x110
    [<00000000fcbe706c>] sdio_alloc_func+0x35/0x100 [mmc_core]
    [<00000000c68f4b50>] mmc_attach_sdio.cold.18+0xb1/0x395 [mmc_core]
    [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core]


Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 4.14.306, 4.19.273, 5.10.169, 5.15.95, 5.4.232, 6.1.13, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 92ff03c2563c9b57a027c744750f3b7d2f261c58
CVE-2023-52731: kernel: fbdev: Fix invalid page access after closing deferred I/O devices
Component: kernel
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fbdev: Fix invalid page access after closing deferred I/O devices

When a fbdev with deferred I/O is once opened and closed, the dirty
pages still remain queued in the pageref list, and eventually later
those may be processed in the delayed work.  This may lead to a
corruption of pages, hitting an Oops.

This patch makes sure to cancel the delayed work and clean up the
pageref list at closing the device for addressing the bug.  A part of
the cleanup code is factored out as a new helper function that is
called from the common fb_release().


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.13, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 87b9802ca824fcee7915e717e9a60471af62e8e9
CVE-2023-52735: kernel: bpf, sockmap: Don&#39;t let sock_map_{close,destroy,unhash} call itself
Component: kernel
Severity: Low
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself

sock_map proto callbacks should never call themselves by design. Protect
against bugs like [1] and break out of the recursive loop to avoid a stack
overflow in favor of a resource leak.

[1] https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/

Statement: Redhat has rated this vulnerability as Low severity as by default in RHEL system the BPF sockmap feature is disabled by default which is needed for this vulnerability to be exploitable, on top of that local access and higher privileges are required to exploit this vulnerability and a successful exploitation will only result in a denial of service vulnerability.

Affected upstream versions: 5.15.3 < 5.15.95, 5.14.19 < 5.15, 5.16
Fixed upstream versions: 0, 5.15, 5.15.95, 6.1.13, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f312367f5246e04df564d341044286e9e37a97ba
CVE-2023-52740: kernel: powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch
Component: kernel
Severity: Low
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch

The RFI and STF security mitigation options can flip the
interrupt_exit_not_reentrant static branch condition concurrently with
the interrupt exit code which tests that branch.

Interrupt exit tests this condition to set MSR[EE|RI] for exit, then
again in the case a soft-masked interrupt is found pending, to recover
the MSR so the interrupt can be replayed before attempting to exit
again. If the condition changes between these two tests, the MSR and irq
soft-mask state will become corrupted, leading to warnings and possible
crashes. For example, if the branch is initially true then false,
MSR[EE] will be 0 but PACA_IRQ_HARD_DIS clear and EE may not get
enabled, leading to warnings in irq_64.c.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.94, 6.1.12, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 86f7e423933608d536015a0f2eb9e0338c1227e0
CVE-2023-52749: kernel: spi: Fix null dereference on suspend
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

spi: Fix null dereference on suspend

A race condition exists where a synchronous (noqueue) transfer can be
active during a system suspend. This can cause a null pointer
dereference exception to occur when the system resumes.

Example order of events leading to the exception:
1. spi_sync() calls __spi_transfer_message_noqueue() which sets
   ctlr->cur_msg
2. Spi transfer begins via spi_transfer_one_message()
3. System is suspended interrupting the transfer context
4. System is resumed
6. spi_controller_resume() calls spi_start_queue() which resets cur_msg
   to NULL
7. Spi transfer context resumes and spi_finalize_current_message() is
   called which dereferences cur_msg (which is now NULL)

Wait for synchronous transfers to complete before suspending by
acquiring the bus mutex and setting/checking a suspend flag.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.66, 6.6.3, 6.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4ec4508db97502a12daee88c74782e8d35ced068
CVE-2023-52757: kernel: smb: client: fix potential deadlock when releasing mids
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential deadlock when releasing mids

All release_mid() callers seem to hold a reference of @mid so there is
no need to call kref_put(&mid->refcount, __release_mid) under
@server->mid_lock spinlock.  If they don't, then an use-after-free bug
would have occurred anyways.

By getting rid of such spinlock also fixes a potential deadlock as
shown below

CPU 0                                CPU 1
------------------------------------------------------------------
cifs_demultiplex_thread()            cifs_debug_data_proc_show()
 release_mid()
  spin_lock(&server->mid_lock);
                                     spin_lock(&cifs_tcp_ses_lock)
				      spin_lock(&server->mid_lock)
  __release_mid()
   smb2_find_smb_tcon()
    spin_lock(&cifs_tcp_ses_lock) *deadlock*


Affected upstream versions: 5.4.6 < 5.5, 5.5
Fixed upstream versions: 0, 5.10.237, 5.15.181, 5.5, 6.1.64, 6.5.13, 6.6.3, 6.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 99f476e27aad5964ab13777d84fda67d1356dec1
CVE-2023-52762: kernel: virtio-blk: fix implicit overflow on virtio_max_dma_size
Component: kernel
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

virtio-blk: fix implicit overflow on virtio_max_dma_size

The following codes have an implicit conversion from size_t to u32:
(u32)max_size = (size_t)virtio_max_dma_size(vdev);

This may lead overflow, Ex (size_t)4G -> (u32)0. Once
virtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX
instead.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.15.140, 6.1.64, 6.5.13, 6.6.3, 6.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 72775cad7f572bb2501f9ea609e1d20e68f0b38b
CVE-2023-52764: kernel: media: gspca: cpia1: shift-out-of-bounds in set_flicker
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: gspca: cpia1: shift-out-of-bounds in set_flicker

Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'

When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.


Affected upstream versions: 2.6.34
Fixed upstream versions: 0, 4.14.331, 4.19.300, 5.10.202, 5.15.140, 5.4.262, 6.1.64, 6.5.13, 6.6.3, 6.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 69bba62600bd91d6b7c1e8ca181faf8ac64f7060
CVE-2023-52771: kernel: cxl/port: Fix delete_endpoint() vs parent unregistration race
Component: kernel
Severity: Low
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cxl/port: Fix delete_endpoint() vs parent unregistration race

The CXL subsystem, at cxl_mem ->probe() time, establishes a lineage of
ports (struct cxl_port objects) between an endpoint and the root of a
CXL topology. Each port including the endpoint port is attached to the
cxl_port driver.

Given that setup, it follows that when either any port in that lineage
goes through a cxl_port ->remove() event, or the memdev goes through a
cxl_mem ->remove() event. The hierarchy below the removed port, or the
entire hierarchy if the memdev is removed needs to come down.

The delete_endpoint() callback is careful to check whether it is being
called to tear down the hierarchy, or if it is only being called to
teardown the memdev because an ancestor port is going through
->remove().

That care needs to take the device_lock() of the endpoint's parent.
Which requires 2 bugs to be fixed:

1/ A reference on the parent is needed to prevent use-after-free
   scenarios like this signature:

    BUG: spinlock bad magic on CPU#0, kworker/u56:0/11
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc38 05/24/2023
    Workqueue: cxl_port detach_memdev [cxl_core]
    RIP: 0010:spin_bug+0x65/0xa0
    Call Trace:
      do_raw_spin_lock+0x69/0xa0
     __mutex_lock+0x695/0xb80
     delete_endpoint+0xad/0x150 [cxl_core]
     devres_release_all+0xb8/0x110
     device_unbind_cleanup+0xe/0x70
     device_release_driver_internal+0x1d2/0x210
     detach_memdev+0x15/0x20 [cxl_core]
     process_one_work+0x1e3/0x4c0
     worker_thread+0x1dd/0x3d0

2/ In the case of RCH topologies, the parent device that needs to be
   locked is not always @port->dev as returned by cxl_mem_find_port(), use
   endpoint->dev.parent instead.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.5.13, 6.6.3, 6.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 37179fcc916bce8c3cc7b36d67ef814cce55142b