rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e.
Vulnerability ID: CVE-2019-19075
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/ieee802154/ca8210.c
Commit message: ieee802154: ca8210: prevent memory leak

In ca8210_probe the allocated pdata needs to be assigned to
spi_device->dev.platform_data before calling ca8210_get_platform_data.
Othrwise when ca8210_get_platform_data fails pdata cannot be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20190917224713.26371-1-navid.emamdoost@gmail.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int ca8210_probe(struct spi_device *spi_device) 		goto error; 	}  	ret = ca8210_get_platform_data(priv->spi, pdata); 	if (ret) { 		dev_crit(&spi_device->dev, "ca8210_get_platform_data failed\n"); 		goto error; 	} 	priv->spi->dev.platform_data = pdata;  	ret = ca8210_dev_com_init(priv); 	if (ret) {

Fixed version (after fix):
 static int ca8210_probe(struct spi_device *spi_device) 		goto error; 	}  	priv->spi->dev.platform_data = pdata; 	ret = ca8210_get_platform_data(priv->spi, pdata); 	if (ret) { 		dev_crit(&spi_device->dev, "ca8210_get_platform_data failed\n"); 		goto error; 	}  	ret = ca8210_dev_com_init(priv); 	if (ret) {

Patch:
patch: @@ -3152,12 +3152,12 @@ static int ca8210_probe(struct spi_device *spi_device)
 		goto error;
 	}
 
+	priv->spi->dev.platform_data = pdata;
 	ret = ca8210_get_platform_data(priv->spi, pdata);
 	if (ret) {
 		dev_crit(&spi_device->dev, "ca8210_get_platform_data failed\n");
 		goto error;
 	}
-	priv->spi->dev.platform_data = pdata;
 
 	ret = ca8210_dev_com_init(priv);
 	if (ret) {
path: drivers/net/ieee802154/ca8210.c
Vulnerability: A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy to udata failures, aka CID-4a9d46a9fe14.
Vulnerability ID: CVE-2019-19077
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/infiniband/hw/bnxt_re/ib_verbs.c
Commit message: RDMA: Fix goto target to release the allocated memory

In bnxt_re_create_srq(), when ib_copy_to_udata() fails allocated memory
should be released by goto fail.

Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters")
Link: https://lore.kernel.org/r/20190910222120.16517-1-navid.emamdoost@gmail.com
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 int bnxt_re_create_srq(struct ib_srq *ib_srq, 			dev_err(rdev_to_dev(rdev), "SRQ copy to udata failed!"); 			bnxt_qplib_destroy_srq(&rdev->qplib_res, 					       &srq->qplib_srq); 			goto exit; 		} 	} 	if (nq)

Fixed version (after fix):
 int bnxt_re_create_srq(struct ib_srq *ib_srq, 			dev_err(rdev_to_dev(rdev), "SRQ copy to udata failed!"); 			bnxt_qplib_destroy_srq(&rdev->qplib_res, 					       &srq->qplib_srq); 			goto fail; 		} 	} 	if (nq)

Patch:
patch: @@ -1398,7 +1398,7 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq,
 			dev_err(rdev_to_dev(rdev), "SRQ copy to udata failed!");
 			bnxt_qplib_destroy_srq(&rdev->qplib_res,
 					       &srq->qplib_srq);
-			goto exit;
+			goto fail;
 		}
 	}
 	if (nq)
path: drivers/infiniband/hw/bnxt_re/ib_verbs.c
Vulnerability: A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2.
Vulnerability ID: CVE-2019-19078
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wireless/ath/ath10k/usb.c
Commit message: ath10k: fix memory leak

In ath10k_usb_hif_tx_sg the allocated urb should be released if
usb_submit_urb fails.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id, 			ath10k_dbg(ar, ATH10K_DBG_USB_BULK, 				   "usb bulk transmit failed: %d\n", ret); 			usb_unanchor_urb(urb); 			ret = -EINVAL; 			goto err_free_urb_to_pipe; 		}

Fixed version (after fix):
 static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id, 			ath10k_dbg(ar, ATH10K_DBG_USB_BULK, 				   "usb bulk transmit failed: %d\n", ret); 			usb_unanchor_urb(urb); 			usb_free_urb(urb); 			ret = -EINVAL; 			goto err_free_urb_to_pipe; 		}

Patch:
patch: @@ -435,6 +435,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
 			ath10k_dbg(ar, ATH10K_DBG_USB_BULK,
 				   "usb bulk transmit failed: %d\n", ret);
 			usb_unanchor_urb(urb);
+			usb_free_urb(urb);
 			ret = -EINVAL;
 			goto err_free_urb_to_pipe;
 		}
path: drivers/net/wireless/ath/ath10k/usb.c
Vulnerability: A memory leak in the qrtr_tun_write_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3 allows attackers to cause a denial of service (memory consumption), aka CID-a21b7f0cff19.
Vulnerability ID: CVE-2019-19079
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: net/qrtr/tun.c
Commit message: net: qrtr: fix memort leak in qrtr_tun_write_iter

In qrtr_tun_write_iter the allocated kbuf should be release in case of
error or success return.

v2 Update: Thanks to David Miller for pointing out the release on success
path as well.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from) 	if (!kbuf) 		return -ENOMEM;  	if (!copy_from_iter_full(kbuf, len, from)) 		return -EFAULT;  	ret = qrtr_endpoint_post(&tun->ep, kbuf, len);  	return ret < 0 ? ret : len; } 

Fixed version (after fix):
 static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from) 	if (!kbuf) 		return -ENOMEM;  	if (!copy_from_iter_full(kbuf, len, from)) { 		kfree(kbuf); 		return -EFAULT; 	}  	ret = qrtr_endpoint_post(&tun->ep, kbuf, len);  	kfree(kbuf); 	return ret < 0 ? ret : len; } 

Patch:
patch: @@ -84,11 +84,14 @@ static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from)
 	if (!kbuf)
 		return -ENOMEM;
 
-	if (!copy_from_iter_full(kbuf, len, from))
+	if (!copy_from_iter_full(kbuf, len, from)) {
+		kfree(kbuf);
 		return -EFAULT;
+	}
 
 	ret = qrtr_endpoint_post(&tun->ep, kbuf, len);
 
+	kfree(kbuf);
 	return ret < 0 ? ret : len;
 }
path: net/qrtr/tun.c
Vulnerability: A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.
Vulnerability ID: CVE-2019-19081
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/ethernet/netronome/nfp/flower/main.c
Commit message: nfp: flower: fix memory leak in nfp_flower_spawn_vnic_reprs

In nfp_flower_spawn_vnic_reprs in the loop if initialization or the
allocations fail memory is leaked. Appropriate releases are added.

Fixes: b94524529741 ("nfp: flower: add per repr private data for LAG offload")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 nfp_flower_spawn_vnic_reprs(struct nfp_app *app, 		repr_priv = kzalloc(sizeof(*repr_priv), GFP_KERNEL); 		if (!repr_priv) { 			err = -ENOMEM; 			goto err_reprs_clean; 		}  nfp_flower_spawn_vnic_reprs(struct nfp_app *app, 		port = nfp_port_alloc(app, port_type, repr); 		if (IS_ERR(port)) { 			err = PTR_ERR(port); 			nfp_repr_free(repr); 			goto err_reprs_clean; 		} nfp_flower_spawn_vnic_reprs(struct nfp_app *app, 		err = nfp_repr_init(app, repr, 				    port_id, port, priv->nn->dp.netdev); 		if (err) { 			nfp_port_free(port); 			nfp_repr_free(repr); 			goto err_reprs_clean;

Fixed version (after fix):
 nfp_flower_spawn_vnic_reprs(struct nfp_app *app, 		repr_priv = kzalloc(sizeof(*repr_priv), GFP_KERNEL); 		if (!repr_priv) { 			err = -ENOMEM; 			nfp_repr_free(repr); 			goto err_reprs_clean; 		}  nfp_flower_spawn_vnic_reprs(struct nfp_app *app, 		port = nfp_port_alloc(app, port_type, repr); 		if (IS_ERR(port)) { 			err = PTR_ERR(port); 			kfree(repr_priv); 			nfp_repr_free(repr); 			goto err_reprs_clean; 		} nfp_flower_spawn_vnic_reprs(struct nfp_app *app, 		err = nfp_repr_init(app, repr, 				    port_id, port, priv->nn->dp.netdev); 		if (err) { 			kfree(repr_priv); 			nfp_port_free(port); 			nfp_repr_free(repr); 			goto err_reprs_clean;

Patch:
patch: @@ -400,6 +400,7 @@ nfp_flower_spawn_vnic_reprs(struct nfp_app *app,
 		repr_priv = kzalloc(sizeof(*repr_priv), GFP_KERNEL);
 		if (!repr_priv) {
 			err = -ENOMEM;
+			nfp_repr_free(repr);
 			goto err_reprs_clean;
 		}
 
@@ -413,6 +414,7 @@ nfp_flower_spawn_vnic_reprs(struct nfp_app *app,
 		port = nfp_port_alloc(app, port_type, repr);
 		if (IS_ERR(port)) {
 			err = PTR_ERR(port);
+			kfree(repr_priv);
 			nfp_repr_free(repr);
 			goto err_reprs_clean;
 		}
@@ -433,6 +435,7 @@ nfp_flower_spawn_vnic_reprs(struct nfp_app *app,
 		err = nfp_repr_init(app, repr,
 				    port_id, port, priv->nn->dp.netdev);
 		if (err) {
+			kfree(repr_priv);
 			nfp_port_free(port);
 			nfp_repr_free(repr);
 			goto err_reprs_clean;
path: drivers/net/ethernet/netronome/nfp/flower/main.c
Vulnerability: Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.
Vulnerability ID: CVE-2019-19246
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/kkos/oniguruma
Published: 2019-11-25
File: src/regexec.c
Commit message: fix heap-buffer-overflow
Commit author: K.Kosako

Vulnerable version (before fix):
 str_lower_case_match(OnigEncoding enc, int case_fold_flag,     lowlen = ONIGENC_MBC_CASE_FOLD(enc, case_fold_flag, &p, end, lowbuf);     q = lowbuf;     while (lowlen > 0) {       if (*t++ != *q++) return 0;       lowlen--;     }

Fixed version (after fix):
 str_lower_case_match(OnigEncoding enc, int case_fold_flag,     lowlen = ONIGENC_MBC_CASE_FOLD(enc, case_fold_flag, &p, end, lowbuf);     q = lowbuf;     while (lowlen > 0) {       if (t >= tend)    return 0;       if (*t++ != *q++) return 0;       lowlen--;     }

Patch:
patch: @@ -4196,6 +4196,7 @@ str_lower_case_match(OnigEncoding enc, int case_fold_flag,
     lowlen = ONIGENC_MBC_CASE_FOLD(enc, case_fold_flag, &p, end, lowbuf);
     q = lowbuf;
     while (lowlen > 0) {
+      if (t >= tend)    return 0;
       if (*t++ != *q++) return 0;
       lowlen--;
     }
path: src/regexec.c
Vulnerability: In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.
Vulnerability ID: CVE-2019-19334
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/CESNET/libyang
Published: 2019-12-06
File: src/parser.c
Commit message: parser BUGFIX long identityref default value buffer overflow

STRING_OVERFLOW (CWE-120)
Commit author: Michal Vasko

Vulnerable version (before fix):
 make_canonical(struct ly_ctx *ctx, int type, const char **value, void *data1, vo         module_name = (const char *)data1;         /* identity must always have a prefix */         if (!strchr(*value, ':')) {             sprintf(buf, "%s:%s", module_name, *value);         } else {             strcpy(buf, *value);         }         break;

Fixed version (after fix):
 make_canonical(struct ly_ctx *ctx, int type, const char **value, void *data1, vo         module_name = (const char *)data1;         /* identity must always have a prefix */         if (!strchr(*value, ':')) {             LY_CHECK_ERR_RETURN(strlen(module_name) + 1 + strlen(*value) > buf_len, LOGBUF(*value), -1);             sprintf(buf, "%s:%s", module_name, *value);         } else {             LY_CHECK_ERR_RETURN(strlen(*value) > buf_len, LOGBUF(*value), -1);             strcpy(buf, *value);         }         break;

Patch:
patch: @@ -1021,8 +1021,10 @@ make_canonical(struct ly_ctx *ctx, int type, const char **value, void *data1, vo
         module_name = (const char *)data1;
         /* identity must always have a prefix */
         if (!strchr(*value, ':')) {
+            LY_CHECK_ERR_RETURN(strlen(module_name) + 1 + strlen(*value) > buf_len, LOGBUF(*value), -1);
             sprintf(buf, "%s:%s", module_name, *value);
         } else {
+            LY_CHECK_ERR_RETURN(strlen(*value) > buf_len, LOGBUF(*value), -1);
             strcpy(buf, *value);
         }
         break;
path: src/parser.c
Vulnerability: A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
Vulnerability ID: CVE-2019-19366
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-11-27
File: app/xml_cdr/xml_cdr_search.php
Commit message: Update xml_cdr_search.php
Commit author: Nate

Vulnerable version (before fix):
 	echo "</script>";  //start the html form 	if (strlen(check_str($_GET['redirect'])) > 0) { 		echo "<form method='get' action='" . $_GET['redirect'] . ".php'>\n"; 	} 	else { 		echo "<form method='get' action='xml_cdr.php'>\n"; //include footer 	require_once "resources/footer.php";  ?>\ No newline at end of file

Fixed version (after fix):
 	echo "</script>";  //start the html form 	if ($_GET['redirect'] == 'xml_cdr_statistics') { 		echo "<form method='get' action='xml_cdr_statistics.php'>\n"; 	} 	else { 		echo "<form method='get' action='xml_cdr.php'>\n"; //include footer 	require_once "resources/footer.php"; \ No newline at end of file ?>

Patch:
patch: @@ -59,8 +59,8 @@
 	echo "</script>";
 
 //start the html form
-	if (strlen(check_str($_GET['redirect'])) > 0) {
-		echo "<form method='get' action='" . $_GET['redirect'] . ".php'>\n";
+	if ($_GET['redirect'] == 'xml_cdr_statistics') {
+		echo "<form method='get' action='xml_cdr_statistics.php'>\n";
 	}
 	else {
 		echo "<form method='get' action='xml_cdr.php'>\n";
@@ -297,4 +297,4 @@
 //include footer
 	require_once "resources/footer.php";
 
-?>
\ No newline at end of file
+?>
path: app/xml_cdr/xml_cdr_search.php
Vulnerability: A cross-site scripting (XSS) vulnerability in app/fifo_list/fifo_interactive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the c parameter.
Vulnerability ID: CVE-2019-19387
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-11-29
File: app/fifo_list/fifo_interactive.php
Commit message: Update fifo_interactive.php
Commit author: FusionPBX

Vulnerable version (before fix):
 function loadXmlHttp(url, id) { }  var requestTime = function() { 	var url = 'fifo_interactive_inc.php?c=<?php echo trim($_REQUEST["c"]); ?>'; 	new loadXmlHttp(url, 'ajax_reponse'); 	setInterval(function(){new loadXmlHttp(url, 'ajax_reponse');}, 1222); }

Fixed version (after fix):
 function loadXmlHttp(url, id) { }  var requestTime = function() { 	var url = 'fifo_interactive_inc.php?c=<?php echo trim($fifo_name); ?>'; 	new loadXmlHttp(url, 'ajax_reponse'); 	setInterval(function(){new loadXmlHttp(url, 'ajax_reponse');}, 1222); }

Patch:
patch: @@ -99,7 +99,7 @@ function loadXmlHttp(url, id) {
 }
 
 var requestTime = function() {
-	var url = 'fifo_interactive_inc.php?c=<?php echo trim($_REQUEST["c"]); ?>';
+	var url = 'fifo_interactive_inc.php?c=<?php echo trim($fifo_name); ?>';
 	new loadXmlHttp(url, 'ajax_reponse');
 	setInterval(function(){new loadXmlHttp(url, 'ajax_reponse');}, 1222);
 }
path: app/fifo_list/fifo_interactive.php
Vulnerability: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.
Vulnerability ID: CVE-2019-19479
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/OpenSC/OpenSC
Published: 2019-12-01
File: src/libopensc/card-setcos.c
Commit message: fixed  UNKNOWN READ

Reported by OSS-Fuzz
https://oss-fuzz.com/testcase-detail/5681169970757632
Commit author: Frank Morgner

Vulnerable version (before fix):
 static void parse_sec_attr_44(sc_file_t *file, const u8 *buf, size_t len) 			}  			/* Encryption key present ? */ 			iPinCount = iACLen - 1;		  			if (buf[iOffset] & 0x20) { 				int iSC;

Fixed version (after fix):
 static void parse_sec_attr_44(sc_file_t *file, const u8 *buf, size_t len) 			}  			/* Encryption key present ? */ 			iPinCount = iACLen > 0 ? iACLen - 1 : 0;  			if (buf[iOffset] & 0x20) { 				int iSC;

Patch:
patch: @@ -868,7 +868,7 @@ static void parse_sec_attr_44(sc_file_t *file, const u8 *buf, size_t len)
 			}
 
 			/* Encryption key present ? */
-			iPinCount = iACLen - 1;		
+			iPinCount = iACLen > 0 ? iACLen - 1 : 0;
 
 			if (buf[iOffset] & 0x20) {
 				int iSC;
path: src/libopensc/card-setcos.c
Vulnerability: Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack.
Vulnerability ID: CVE-2019-20172
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/SerenityOS/serenity
Published: 2019-12-31
File: Kernel/VM/MemoryManager.cpp
Commit message: Kernel: User pointer validation should reject kernel-only addresses

We were happily allowing syscalls with pointers into kernel-only
regions (virtual address >= 0xc0000000).

This patch fixes that by only considering user regions in the current
process, and also double-checking the Region::is_user_accessible() flag
before approving an access.

Thanks to Fire30 for finding the bug! :^)
Commit author: Andreas Kling

Vulnerable version (before fix):
 bool MemoryManager::validate_user_stack(const Process& process, VirtualAddress v  bool MemoryManager::validate_user_read(const Process& process, VirtualAddress vaddr) const {     auto* region = region_from_vaddr(process, vaddr);     return region && region->is_readable(); }  bool MemoryManager::validate_user_write(const Process& process, VirtualAddress vaddr) const {     auto* region = region_from_vaddr(process, vaddr);     return region && region->is_writable(); }  void MemoryManager::register_vmobject(VMObject& vmobject)

Fixed version (after fix):
 bool MemoryManager::validate_user_stack(const Process& process, VirtualAddress v  bool MemoryManager::validate_user_read(const Process& process, VirtualAddress vaddr) const {     auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);     return region && region->is_user_accessible() && region->is_readable(); }  bool MemoryManager::validate_user_write(const Process& process, VirtualAddress vaddr) const {     auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);     return region && region->is_user_accessible() && region->is_writable(); }  void MemoryManager::register_vmobject(VMObject& vmobject)

Patch:
patch: @@ -592,14 +592,14 @@ bool MemoryManager::validate_user_stack(const Process& process, VirtualAddress v
 
 bool MemoryManager::validate_user_read(const Process& process, VirtualAddress vaddr) const
 {
-    auto* region = region_from_vaddr(process, vaddr);
-    return region && region->is_readable();
+    auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);
+    return region && region->is_user_accessible() && region->is_readable();
 }
 
 bool MemoryManager::validate_user_write(const Process& process, VirtualAddress vaddr) const
 {
-    auto* region = region_from_vaddr(process, vaddr);
-    return region && region->is_writable();
+    auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);
+    return region && region->is_user_accessible() && region->is_writable();
 }
 
 void MemoryManager::register_vmobject(VMObject& vmobject)
path: Kernel/VM/MemoryManager.cpp
Vulnerability: TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491.
Vulnerability ID: CVE-2019-20381
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Published: 2020-01-20
File: index.php
Commit message: fix: 0008808: TestLink v1.9.19.1 - Bypass security fix for XSS at index.php
Commit author: Francisco Mancardi

Vulnerable version (before fix):
 function initEnv() {      // some sanity checks     // strpos ( string $haystack , mixed $needle     if (strpos($args->reqURI,'javascript') !== false) {       $args->reqURI = null;      }   }

Fixed version (after fix):
 function initEnv() {      // some sanity checks     // strpos ( string $haystack , mixed $needle     if (stripos($args->reqURI,'javascript') !== false) {       $args->reqURI = null;      }   }

Patch:
patch: @@ -92,7 +92,7 @@ function initEnv() {
 
     // some sanity checks
     // strpos ( string $haystack , mixed $needle
-    if (strpos($args->reqURI,'javascript') !== false) {
+    if (stripos($args->reqURI,'javascript') !== false) {
       $args->reqURI = null; 
     }
   }
path: index.php
Vulnerability: An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.
Vulnerability ID: CVE-2019-20386
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/systemd/systemd
Published: 2020-01-21
File: src/login/logind-button.c
Commit message: bus_open leak sd_event_source when udevadm trigger。

On my host, when executing the udevadm trigger, I only receive the change event, which causes memleak
Commit author: ven

Vulnerable version (before fix):
 int button_open(Button *b) {         }          (void) button_set_mask(b);          r = sd_event_add_io(b->manager->event, &b->io_event_source, b->fd, EPOLLIN, button_dispatch, b);         if (r < 0) {                 log_error_errno(r, "Failed to add button event: %m");

Fixed version (after fix):
 int button_open(Button *b) {         }          (void) button_set_mask(b);                  b->io_event_source = sd_event_source_unref(b->io_event_source);         r = sd_event_add_io(b->manager->event, &b->io_event_source, b->fd, EPOLLIN, button_dispatch, b);         if (r < 0) {                 log_error_errno(r, "Failed to add button event: %m");

Patch:
patch: @@ -341,7 +341,8 @@ int button_open(Button *b) {
         }
 
         (void) button_set_mask(b);
-
+        
+        b->io_event_source = sd_event_source_unref(b->io_event_source);
         r = sd_event_add_io(b->manager->event, &b->io_event_source, b->fd, EPOLLIN, button_dispatch, b);
         if (r < 0) {
                 log_error_errno(r, "Failed to add button event: %m");
path: src/login/logind-button.c