rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application crash) via a crafted tga file.
Vulnerability ID: CVE-2015-8894
CWE: CWE-415
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-03-15
File: coders/tga.c
Commit message: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1490362
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadTGAImage(const ImageInfo *image_info,       /*         Read TGA raster colormap.       */       if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");       for (i=0; i < (ssize_t) tga_info.colormap_index; i++)

Fixed version (after fix):
 static Image *ReadTGAImage(const ImageInfo *image_info,       /*         Read TGA raster colormap.       */       if (image->colors < tga_info.colormap_index)         image->colors=tga_info.colormap_index;       if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");       for (i=0; i < (ssize_t) tga_info.colormap_index; i++)

Patch:
patch: @@ -315,6 +315,8 @@ static Image *ReadTGAImage(const ImageInfo *image_info,
       /*
         Read TGA raster colormap.
       */
+      if (image->colors < tga_info.colormap_index)
+        image->colors=tga_info.colormap_index;
       if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       for (i=0; i < (ssize_t) tga_info.colormap_index; i++)
path: coders/tga.c
Vulnerability: The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.
Vulnerability ID: CVE-2015-8898
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-03-15
File: MagickCore/constitute.c
Commit message: https://github.com/ImageMagick/ImageMagick/pull/34
Commit author: Cristy

Vulnerable version (before fix):
 MagickExport MagickBooleanType WriteImages(const ImageInfo *image_info,     (void) CopyMagickString(write_info->magick,images->magick,MagickPathExtent);   p=images;   for ( ; GetNextImageInList(p) != (Image *) NULL; p=GetNextImageInList(p))     if (p->scene >= GetNextImageInList(p)->scene)       {         register ssize_t           i; MagickExport MagickBooleanType WriteImages(const ImageInfo *image_info,           p->scene=(size_t) i++;         break;       }   /*     Write images.   */

Fixed version (after fix):
 MagickExport MagickBooleanType WriteImages(const ImageInfo *image_info,     (void) CopyMagickString(write_info->magick,images->magick,MagickPathExtent);   p=images;   for ( ; GetNextImageInList(p) != (Image *) NULL; p=GetNextImageInList(p))   {     register Image       *next;          next=GetNextImageInList(p);     if (next == (Image *) NULL)       break;     if (p->scene >= next->scene)       {         register ssize_t           i; MagickExport MagickBooleanType WriteImages(const ImageInfo *image_info,           p->scene=(size_t) i++;         break;       }   }   /*     Write images.   */

Patch:
patch: @@ -1272,7 +1272,14 @@ MagickExport MagickBooleanType WriteImages(const ImageInfo *image_info,
     (void) CopyMagickString(write_info->magick,images->magick,MagickPathExtent);
   p=images;
   for ( ; GetNextImageInList(p) != (Image *) NULL; p=GetNextImageInList(p))
-    if (p->scene >= GetNextImageInList(p)->scene)
+  {
+    register Image
+      *next;
+    
+    next=GetNextImageInList(p);
+    if (next == (Image *) NULL)
+      break;
+    if (p->scene >= next->scene)
       {
         register ssize_t
           i;
@@ -1285,6 +1292,7 @@ MagickExport MagickBooleanType WriteImages(const ImageInfo *image_info,
           p->scene=(size_t) i++;
         break;
       }
+  }
   /*
     Write images.
   */
path: MagickCore/constitute.c
Vulnerability: Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
Vulnerability ID: CVE-2015-8949
CWE: CWE-416
Severity score: 10
Project: https://github.com/perl5-dbi/DBD-mysql
Published: 2016-08-19
File: dbdimp.c
Commit message: Merge pull request #45 from hannob/master

Fix use after free error.
Commit author: Michiel Beijen

Vulnerable version (before fix):
 static int my_login(pTHX_ SV* dbh, imp_dbh_t *imp_dbh)   }   result = mysql_dr_connect(dbh, imp_dbh->pmysql, mysql_socket, host, port, user, 			  password, dbname, imp_dbh) ? TRUE : FALSE;   if (fresh && !result) {       /* Prevent leaks, but do not free in case of a reconnect. See #97625 */       Safefree(imp_dbh->pmysql);   }   return result; }  int dbd_db_login(SV* dbh, imp_dbh_t* imp_dbh, char* dbname, char* user,    if (!my_login(aTHX_ dbh, imp_dbh))   {     if(imp_dbh->pmysql)         do_error(dbh, mysql_errno(imp_dbh->pmysql),                 mysql_error(imp_dbh->pmysql) ,mysql_sqlstate(imp_dbh->pmysql));     return FALSE;   } 

Fixed version (after fix):
 static int my_login(pTHX_ SV* dbh, imp_dbh_t *imp_dbh)   }   result = mysql_dr_connect(dbh, imp_dbh->pmysql, mysql_socket, host, port, user, 			  password, dbname, imp_dbh) ? TRUE : FALSE;   return result; }  int dbd_db_login(SV* dbh, imp_dbh_t* imp_dbh, char* dbname, char* user,    if (!my_login(aTHX_ dbh, imp_dbh))   {     if(imp_dbh->pmysql) {         do_error(dbh, mysql_errno(imp_dbh->pmysql),                 mysql_error(imp_dbh->pmysql) ,mysql_sqlstate(imp_dbh->pmysql));         Safefree(imp_dbh->pmysql);      }     return FALSE;   } 

Patch:
patch: @@ -2085,10 +2085,6 @@ static int my_login(pTHX_ SV* dbh, imp_dbh_t *imp_dbh)
   }
   result = mysql_dr_connect(dbh, imp_dbh->pmysql, mysql_socket, host, port, user,
 			  password, dbname, imp_dbh) ? TRUE : FALSE;
-  if (fresh && !result) {
-      /* Prevent leaks, but do not free in case of a reconnect. See #97625 */
-      Safefree(imp_dbh->pmysql);
-  }
   return result;
 }
 
@@ -2142,9 +2138,12 @@ int dbd_db_login(SV* dbh, imp_dbh_t* imp_dbh, char* dbname, char* user,
 
   if (!my_login(aTHX_ dbh, imp_dbh))
   {
-    if(imp_dbh->pmysql)
+    if(imp_dbh->pmysql) {
         do_error(dbh, mysql_errno(imp_dbh->pmysql),
                 mysql_error(imp_dbh->pmysql) ,mysql_sqlstate(imp_dbh->pmysql));
+        Safefree(imp_dbh->pmysql);
+
+    }
     return FALSE;
   }
path: dbdimp.c
Vulnerability: arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call.
Vulnerability ID: CVE-2015-8950
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-10-10
File: arch/arm64/mm/dma-mapping.c
Commit message: arm64: dma-mapping: always clear allocated buffers

Buffers allocated by dma_alloc_coherent() are always zeroed on Alpha,
ARM (32bit), MIPS, PowerPC, x86/x86_64 and probably other architectures.
It turned out that some drivers rely on this 'feature'. Allocated buffer
might be also exposed to userspace with dma_mmap() call, so clearing it
is desired from security point of view to avoid exposing random memory
to userspace. This patch unifies dma_alloc_coherent() behavior on ARM64
architecture with other implementations by unconditionally zeroing
allocated buffer.

Cc: <stable@vger.kernel.org> # v3.14+
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Commit author: Marek Szyprowski

Vulnerable version (before fix):
 static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)  		*ret_page = phys_to_page(phys); 		ptr = (void *)val; 		if (flags & __GFP_ZERO) 			memset(ptr, 0, size); 	}  	return ptr; static void *__dma_alloc_coherent(struct device *dev, size_t size,  		*dma_handle = phys_to_dma(dev, page_to_phys(page)); 		addr = page_address(page); 		if (flags & __GFP_ZERO) 			memset(addr, 0, size); 		return addr; 	} else { 		return swiotlb_alloc_coherent(dev, size, dma_handle, flags);

Fixed version (after fix):
 static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)  		*ret_page = phys_to_page(phys); 		ptr = (void *)val; 		memset(ptr, 0, size); 	}  	return ptr; static void *__dma_alloc_coherent(struct device *dev, size_t size,  		*dma_handle = phys_to_dma(dev, page_to_phys(page)); 		addr = page_address(page); 		memset(addr, 0, size); 		return addr; 	} else { 		return swiotlb_alloc_coherent(dev, size, dma_handle, flags);

Patch:
patch: @@ -67,8 +67,7 @@ static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
 
 		*ret_page = phys_to_page(phys);
 		ptr = (void *)val;
-		if (flags & __GFP_ZERO)
-			memset(ptr, 0, size);
+		memset(ptr, 0, size);
 	}
 
 	return ptr;
@@ -113,8 +112,7 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
 
 		*dma_handle = phys_to_dma(dev, page_to_phys(page));
 		addr = page_address(page);
-		if (flags & __GFP_ZERO)
-			memset(addr, 0, size);
+		memset(addr, 0, size);
 		return addr;
 	} else {
 		return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
path: arch/arm64/mm/dma-mapping.c
Vulnerability: fs/overlayfs/copy_up.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path, which allows local users to cause a denial of service (dentry reference leak) via filesystem operations on a large file in a lower overlayfs layer.
Vulnerability ID: CVE-2015-8953
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2016-10-16
File: fs/overlayfs/copy_up.c
Commit message: ovl: fix dentry reference leak

In ovl_copy_up_locked(), newdentry is leaked if the function exits through
out_cleanup as this just to out after calling ovl_cleanup() - which doesn't
actually release the ref on newdentry.

The out_cleanup segment should instead exit through out2 as certainly
newdentry leaks - and possibly upper does also, though this isn't caught
given the catch of newdentry.

Without this fix, something like the following is seen:

	BUG: Dentry ffff880023e9eb20{i=f861,n=#ffff880023e82d90} still in use (1) [unmount of tmpfs tmpfs]
	BUG: Dentry ffff880023ece640{i=0,n=bigfile}  still in use (1) [unmount of tmpfs tmpfs]

when unmounting the upper layer after an error occurred in copyup.

An error can be induced by creating a big file in a lower layer with
something like:

	dd if=/dev/zero of=/lower/a/bigfile bs=65536 count=1 seek=$((0xf000))

to create a large file (4.1G).  Overlay an upper layer that is too small
(on tmpfs might do) and then induce a copy up by opening it writably.

Reported-by: Ulrich Obergfell <uobergfe@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Cc: <stable@vger.kernel.org> # v3.18+
Commit author: David Howells

Vulnerable version (before fix):
 static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,  out_cleanup: 	ovl_cleanup(wdir, newdentry); 	goto out; }  /*

Fixed version (after fix):
 static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,  out_cleanup: 	ovl_cleanup(wdir, newdentry); 	goto out2; }  /*

Patch:
patch: @@ -267,7 +267,7 @@ static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,
 
 out_cleanup:
 	ovl_cleanup(wdir, newdentry);
-	goto out;
+	goto out2;
 }
 
 /*
path: fs/overlayfs/copy_up.c
Vulnerability: The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.
Vulnerability ID: CVE-2015-8961
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-11-16
File: fs/ext4/ext4_jbd2.c
Commit message: ext4: fix potential use after free in __ext4_journal_stop

There is a use-after-free possibility in __ext4_journal_stop() in the
case that we free the handle in the first jbd2_journal_stop() because
we're referencing handle->h_err afterwards. This was introduced in
9705acd63b125dee8b15c705216d7186daea4625 and it is wrong. Fix it by
storing the handle->h_err value beforehand and avoid referencing
potentially freed handle.

Fixes: 9705acd63b125dee8b15c705216d7186daea4625
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Cc: stable@vger.kernel.org
Commit author: Lukas Czerner

Vulnerable version (before fix):
 int __ext4_journal_stop(const char *where, unsigned int line, handle_t *handle) 		return 0; 	}  	if (!handle->h_transaction) { 		err = jbd2_journal_stop(handle); 		return handle->h_err ? handle->h_err : err; 	}  	sb = handle->h_transaction->t_journal->j_private; 	err = handle->h_err; 	rc = jbd2_journal_stop(handle);  	if (!err)

Fixed version (after fix):
 int __ext4_journal_stop(const char *where, unsigned int line, handle_t *handle) 		return 0; 	}  	err = handle->h_err; 	if (!handle->h_transaction) { 		rc = jbd2_journal_stop(handle); 		return err ? err : rc; 	}  	sb = handle->h_transaction->t_journal->j_private; 	rc = jbd2_journal_stop(handle);  	if (!err)

Patch:
patch: @@ -88,13 +88,13 @@ int __ext4_journal_stop(const char *where, unsigned int line, handle_t *handle)
 		return 0;
 	}
 
+	err = handle->h_err;
 	if (!handle->h_transaction) {
-		err = jbd2_journal_stop(handle);
-		return handle->h_err ? handle->h_err : err;
+		rc = jbd2_journal_stop(handle);
+		return err ? err : rc;
 	}
 
 	sb = handle->h_transaction->t_journal->j_private;
-	err = handle->h_err;
 	rc = jbd2_journal_stop(handle);
 
 	if (!err)
path: fs/ext4/ext4_jbd2.c
Vulnerability: arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.
Vulnerability ID: CVE-2015-8967
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-12-08
File: arch/arm64/kernel/sys.c
Commit message: arm64: make sys_call_table const

As with x86, mark the sys_call_table const such that it will be placed
in the .rodata section. This will cause attempts to modify the table
(accidental or deliberate) to fail when strict page permissions are in
place. In the absence of strict page permissions, there should be no
functional change.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Commit author: Mark Rutland

Vulnerable version (before fix):
 asmlinkage long sys_rt_sigreturn_wrapper(void);  * The sys_call_table array must be 4K aligned to be accessible from  * kernel/entry.S.  */ void *sys_call_table[__NR_syscalls] __aligned(4096) = { 	[0 ... __NR_syscalls - 1] = sys_ni_syscall, #include <asm/unistd.h> };

Fixed version (after fix):
 asmlinkage long sys_rt_sigreturn_wrapper(void);  * The sys_call_table array must be 4K aligned to be accessible from  * kernel/entry.S.  */ void * const sys_call_table[__NR_syscalls] __aligned(4096) = { 	[0 ... __NR_syscalls - 1] = sys_ni_syscall, #include <asm/unistd.h> };

Patch:
patch: @@ -49,7 +49,7 @@ asmlinkage long sys_rt_sigreturn_wrapper(void);
  * The sys_call_table array must be 4K aligned to be accessible from
  * kernel/entry.S.
  */
-void *sys_call_table[__NR_syscalls] __aligned(4096) = {
+void * const sys_call_table[__NR_syscalls] __aligned(4096) = {
 	[0 ... __NR_syscalls - 1] = sys_ni_syscall,
 #include <asm/unistd.h>
 };
path: arch/arm64/kernel/sys.c
Vulnerability: In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.
Vulnerability ID: CVE-2015-9289
CWE: CWE-125
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-07-27
File: drivers/media/dvb-frontends/cx24116.c
Commit message: [media] cx24116: fix a buffer overflow when checking userspace params

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
	drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Commit author: Mauro Carvalho Chehab

Vulnerable version (before fix):
 static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, 	struct cx24116_state *state = fe->demodulator_priv; 	int i, ret;  	/* Dump DiSEqC message */ 	if (debug) { 		printk(KERN_INFO "cx24116: %s(", __func__); static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, 		printk(") toneburst=%d\n", toneburst); 	}  	/* Validate length */ 	if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS)) 		return -EINVAL;  	/* DiSEqC message */ 	for (i = 0; i < d->msg_len; i++) 		state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];

Fixed version (after fix):
 static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, 	struct cx24116_state *state = fe->demodulator_priv; 	int i, ret;  	/* Validate length */ 	if (d->msg_len > sizeof(d->msg))                 return -EINVAL;  	/* Dump DiSEqC message */ 	if (debug) { 		printk(KERN_INFO "cx24116: %s(", __func__); static int cx24116_send_diseqc_msg(struct dvb_frontend *fe, 		printk(") toneburst=%d\n", toneburst); 	}  	/* DiSEqC message */ 	for (i = 0; i < d->msg_len; i++) 		state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];

Patch:
patch: @@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
 	struct cx24116_state *state = fe->demodulator_priv;
 	int i, ret;
 
+	/* Validate length */
+	if (d->msg_len > sizeof(d->msg))
+                return -EINVAL;
+
 	/* Dump DiSEqC message */
 	if (debug) {
 		printk(KERN_INFO "cx24116: %s(", __func__);
@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
 		printk(") toneburst=%d\n", toneburst);
 	}
 
-	/* Validate length */
-	if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
-		return -EINVAL;
-
 	/* DiSEqC message */
 	for (i = 0; i < d->msg_len; i++)
 		state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
path: drivers/media/dvb-frontends/cx24116.c
Vulnerability: add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
Vulnerability ID: CVE-2015-9542
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/FreeRADIUS/pam_radius
Published: 2020-02-24
File: src/pam_radius_auth.c
Commit message: Use "length", which has been limited in size
Commit author: Alan T. DeKok

Vulnerable version (before fix):
 static void add_password(AUTH_HDR *request, unsigned char type, CONST char *pass 	}						/* 16*N maps to itself */  	memset(hashed, 0, length); 	memcpy(hashed, password, strlen(password));  	attr = find_attribute(request, PW_PASSWORD); 

Fixed version (after fix):
 static void add_password(AUTH_HDR *request, unsigned char type, CONST char *pass 	}						/* 16*N maps to itself */  	memset(hashed, 0, length); 	memcpy(hashed, password, length);  	attr = find_attribute(request, PW_PASSWORD); 

Patch:
patch: @@ -536,7 +536,7 @@ static void add_password(AUTH_HDR *request, unsigned char type, CONST char *pass
 	}						/* 16*N maps to itself */
 
 	memset(hashed, 0, length);
-	memcpy(hashed, password, strlen(password));
+	memcpy(hashed, password, length);
 
 	attr = find_attribute(request, PW_PASSWORD);
path: src/pam_radius_auth.c
Vulnerability: The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721.
Vulnerability ID: CVE-2016-0823
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-03-12
File: fs/proc/task_mmu.c
Commit message: pagemap: do not leak physical addresses to non-privileged userspace

As pointed by recent post[1] on exploiting DRAM physical imperfection,
/proc/PID/pagemap exposes sensitive information which can be used to do
attacks.

This disallows anybody without CAP_SYS_ADMIN to read the pagemap.

[1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html

[ Eventually we might want to do anything more finegrained, but for now
  this is the simple model.   - Linus ]

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Konstantin Khlebnikov <khlebnikov@openvz.org>
Acked-by: Andy Lutomirski <luto@amacapital.net>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mark Seaborn <mseaborn@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Kirill A. Shutemov

Vulnerable version (before fix):
 static ssize_t pagemap_read(struct file *file, char __user *buf,  static int pagemap_open(struct inode *inode, struct file *file) { 	pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about " 			"to stop being page-shift some time soon. See the " 			"linux/Documentation/vm/pagemap.txt for details.\n");

Fixed version (after fix):
 static ssize_t pagemap_read(struct file *file, char __user *buf,  static int pagemap_open(struct inode *inode, struct file *file) { 	/* do not disclose physical addresses: attack vector */ 	if (!capable(CAP_SYS_ADMIN)) 		return -EPERM; 	pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about " 			"to stop being page-shift some time soon. See the " 			"linux/Documentation/vm/pagemap.txt for details.\n");

Patch:
patch: @@ -1325,6 +1325,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
 
 static int pagemap_open(struct inode *inode, struct file *file)
 {
+	/* do not disclose physical addresses: attack vector */
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
 	pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
 			"to stop being page-shift some time soon. See the "
 			"linux/Documentation/vm/pagemap.txt for details.\n");
path: fs/proc/task_mmu.c