rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-39422 ZDI-CAN-24090: New Vulnerability Report - Use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Acrobat Reader
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
availabilityRequirement: NOT_DEFINED
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7.8
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: HIGH
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.8
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-14T15:07:31.068Z
CVE-2024-39423 ZDI-CAN-24182: New Vulnerability Report - Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: Acrobat Reader
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
availabilityRequirement: NOT_DEFINED
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7.8
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: HIGH
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.8
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-14T15:07:29.540Z
CVE-2024-39424 ZDI-CAN-24309: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Acrobat Reader
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
availabilityRequirement: NOT_DEFINED
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7.8
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: HIGH
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.8
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-14T15:07:26.473Z
CVE-2024-39425 Security vulnerability in AdobeARMHelper
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high.
Problem types: cwe_id: CWE-367
description: Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected products: vendor: Adobe
product: Acrobat Reader
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
availabilityRequirement: NOT_DEFINED
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: HIGH
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: HIGH
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedPrivilegesRequired: LOW
modifiedScope: NOT_DEFINED
modifiedUserInteraction: NONE
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-14T15:07:23.644Z
CVE-2024-39426 ZDI-CAN-24312: Adobe Acrobat Reader DC Annotation Memory Corruption Remote Code Execution Vulnerability
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: Acrobat Reader
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
availabilityRequirement: NOT_DEFINED
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7.8
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: HIGH
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.8
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-14T15:07:32.157Z
CVE-2024-39427 
In trusty service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Problem types: description: cwe-787 Out-of-bounds Write
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2024-07-01T08:40:56.972Z
CVE-2024-39428 
In trusty service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Problem types: description: cwe-787 Out-of-bounds Write
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Published: 2024-07-01T08:40:57.909Z
CVE-2024-39429 
In faceid servive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Problem types: description: cwe-787 Out-of-bounds Write
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2024-07-01T08:40:58.938Z
CVE-2024-39430 
In faceid servive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Problem types: description: cwe-787 Out-of-bounds Write
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2024-07-01T08:40:59.852Z
CVE-2024-39431 
In UMTS RLC driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed.
Problem types: description: cwe-121 Stack-based Buffer Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.3
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2024-09-27T07:37:40.908Z
CVE-2024-39432 
In UMTS RLC driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed.
Problem types: description: cwe-121 Stack-based Buffer Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.3
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2024-09-27T07:37:41.899Z
CVE-2024-39433 
In drm service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Problem types: description: cwe-787 Out-of-bounds Write
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.2
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2024-09-27T07:37:42.872Z
CVE-2024-39434 
In drm service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Problem types: description: cwe-125 Out-of-bounds Read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.2
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2024-09-27T07:37:43.831Z
CVE-2024-39435 
In Logmanager service, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed.
Problem types: description: cwe-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Published: 2024-09-27T07:37:44.941Z
CVE-2024-39436 
In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
Problem types: description: cwe-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Published: 2024-10-09T06:43:27.037Z
CVE-2024-39437 
In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
Problem types: description: cwe-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Published: 2024-10-09T06:43:28.078Z
CVE-2024-39438 
In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
Problem types: description: cwe-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Published: 2024-10-09T06:43:29.015Z
CVE-2024-39439 
In DRM service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Problem types: description: cwe-787 Out-of-bounds Write
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.2
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2024-10-09T06:43:29.967Z
CVE-2024-39440 
In DRM service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with System execution privileges needed.
Problem types: description: cwe-476 NULL Pointer Dereference
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: T606/T612/T616/T610/T618/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.2
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2024-10-09T06:43:30.948Z
CVE-2024-39441 
In wifi display, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed.
Problem types: description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published: 2025-02-26T05:45:36.102Z
CVE-2024-39442 
In sprd ssense service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Problem types: description: cwe-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.2
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2025-05-06T01:07:27.196Z
CVE-2024-39457 
Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user’s web browser.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2024-07-19T08:36:27.786Z
CVE-2024-39458 
When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secrets passed as step parameters, potentially resulting in accidental exposure of secrets through the default system log.
Affected products: vendor: Jenkins Project
product: Jenkins Structs Plugin
default_status: unaffected
Published: 2024-06-26T17:06:26.399Z
CVE-2024-39459 
In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).
Affected products: vendor: Jenkins Project
product: Jenkins Plain Credentials Plugin
default_status: unaffected
Published: 2024-06-26T17:06:27.043Z
CVE-2024-39460 
Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.
Affected products: vendor: Jenkins Project
product: Jenkins Bitbucket Branch Source Plugin
default_status: unaffected
Published: 2024-06-26T17:06:27.695Z
CVE-2024-39461 clk: bcm: rpi: Assign ->num before accessing ->hws
In the Linux kernel, the following vulnerability has been resolved:

clk: bcm: rpi: Assign ->num before accessing ->hws

Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
__counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
with __counted_by, which informs the bounds sanitizer about the number
of elements in hws, so that it can warn when hws is accessed out of
bounds. As noted in that change, the __counted_by member must be
initialized with the number of elements before the first array access
happens, otherwise there will be a warning from each access prior to the
initialization because the number of elements is zero. This occurs in
raspberrypi_discover_clocks() due to ->num being assigned after ->hws
has been accessed:

  UBSAN: array-index-out-of-bounds in drivers/clk/bcm/clk-raspberrypi.c:374:4
  index 3 is out of range for type 'struct clk_hw *[] __counted_by(num)' (aka 'struct clk_hw *[]')

Move the ->num initialization to before the first access of ->hws, which
clears up the warning.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-06-25T14:25:01.453Z
CVE-2024-39462 clk: bcm: dvp: Assign ->num before accessing ->hws
In the Linux kernel, the following vulnerability has been resolved:

clk: bcm: dvp: Assign ->num before accessing ->hws

Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
__counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
with __counted_by, which informs the bounds sanitizer about the number
of elements in hws, so that it can warn when hws is accessed out of
bounds. As noted in that change, the __counted_by member must be
initialized with the number of elements before the first array access
happens, otherwise there will be a warning from each access prior to the
initialization because the number of elements is zero. This occurs in
clk_dvp_probe() due to ->num being assigned after ->hws has been
accessed:

  UBSAN: array-index-out-of-bounds in drivers/clk/bcm/clk-bcm2711-dvp.c:59:2
  index 0 is out of range for type 'struct clk_hw *[] __counted_by(num)' (aka 'struct clk_hw *[]')

Move the ->num initialization to before the first access of ->hws, which
clears up the warning.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-06-25T14:25:02.196Z
CVE-2024-39463 9p: add missing locking around taking dentry fid list
In the Linux kernel, the following vulnerability has been resolved:

9p: add missing locking around taking dentry fid list

Fix a use-after-free on dentry's d_fsdata fid list when a thread
looks up a fid through dentry while another thread unlinks it:

UAF thread:
refcount_t: addition on 0; use-after-free.
 p9_fid_get linux/./include/net/9p/client.h:262
 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129
 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181
 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314
 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400
 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248

Freed by:
 p9_fid_destroy (inlined)
 p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456
 p9_fid_put linux/./include/net/9p/client.h:278
 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55
 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518
 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335

The problem is that d_fsdata was not accessed under d_lock, because
d_release() normally is only called once the dentry is otherwise no
longer accessible but since we also call it explicitly in v9fs_remove
that lock is required:
move the hlist out of the dentry under lock then unref its fids once
they are no longer accessible.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-06-25T14:25:02.887Z
CVE-2024-39464 media: v4l: async: Fix notifier list entry init
In the Linux kernel, the following vulnerability has been resolved:

media: v4l: async: Fix notifier list entry init

struct v4l2_async_notifier has several list_head members, but only
waiting_list and done_list are initialized. notifier_entry was kept
'zeroed' leading to an uninitialized list_head.
This results in a NULL-pointer dereference if csi2_async_register() fails,
e.g. node for remote endpoint is disabled, and returns -ENOTCONN.
The following calls to v4l2_async_nf_unregister() results in a NULL
pointer dereference.
Add the missing list head initializer.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-06-25T14:25:03.578Z
CVE-2024-39465 media: mgb4: Fix double debugfs remove
In the Linux kernel, the following vulnerability has been resolved:

media: mgb4: Fix double debugfs remove

Fixes an error where debugfs_remove_recursive() is called first on a parent
directory and then again on a child which causes a kernel panic.

[hverkuil: added Fixes/Cc tags]
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-06-25T14:25:04.237Z