rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Integer overflow in the oom_badness function in mm/oom_kill.c in the Linux kernel before 3.1.8 on 64-bit platforms allows local users to cause a denial of service (memory consumption or process termination) by using a certain large amount of memory.
Vulnerability ID: CVE-2011-4097
CWE: CWE-190
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-05-17
File: mm/oom_kill.c
Commit message: oom: fix integer overflow of points in oom_badness

commit ff05b6f7ae762b6eb464183eec994b28ea09f6dd upstream.

An integer overflow will happen on 64bit archs if task's sum of rss,
swapents and nr_ptes exceeds (2^31)/1000 value.  This was introduced by
commit

f755a04 oom: use pte pages in OOM score

where the oom score computation was divided into several steps and it's no
longer computed as one expression in unsigned long(rss, swapents, nr_pte
are unsigned long), where the result value assigned to points(int) is in
range(1..1000).  So there could be an int overflow while computing

176          points *= 1000;

and points may have negative value. Meaning the oom score for a mem hog task
will be one.

196          if (points <= 0)
197                  return 1;

For example:
[ 3366]     0  3366 35390480 24303939   5       0             0 oom01
Out of memory: Kill process 3366 (oom01) score 1 or sacrifice child

Here the oom1 process consumes more than 24303939(rss)*4096~=92GB physical
memory, but it's oom score is one.

In this situation the mem hog task is skipped and oom killer kills another and
most probably innocent task with oom score greater than one.

The points variable should be of type long instead of int to prevent the
int overflow.

Signed-off-by: Frantisek Hrbata <fhrbata@redhat.com>
Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Commit author: Frantisek Hrbata

Vulnerable version (before fix):
 static bool oom_unkillable_task(struct task_struct *p, unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem, 		      const nodemask_t *nodemask, unsigned long totalpages) { 	int points;  	if (oom_unkillable_task(p, mem, nodemask)) 		return 0;

Fixed version (after fix):
 static bool oom_unkillable_task(struct task_struct *p, unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem, 		      const nodemask_t *nodemask, unsigned long totalpages) { 	long points;  	if (oom_unkillable_task(p, mem, nodemask)) 		return 0;

Patch:
patch: @@ -162,7 +162,7 @@ static bool oom_unkillable_task(struct task_struct *p,
 unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
 		      const nodemask_t *nodemask, unsigned long totalpages)
 {
-	int points;
+	long points;
 
 	if (oom_unkillable_task(p, mem, nodemask))
 		return 0;
path: mm/oom_kill.c
Vulnerability: The udp6_ufo_fragment function in net/ipv6/udp.c in the Linux kernel before 2.6.39, when a certain UDP Fragmentation Offload (UFO) configuration is enabled, allows remote attackers to cause a denial of service (system crash) by sending fragmented IPv6 UDP packets to a bridge device.
Vulnerability ID: CVE-2011-4326
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-05-17
File: net/ipv6/udp.c
Commit message: ipv6: udp: fix the wrong headroom check

At this point, skb->data points to skb_transport_header.
So, headroom check is wrong.

For some case:bridge(UFO is on) + eth device(UFO is off),
there is no enough headroom for IPv6 frag head.
But headroom check is always false.

This will bring about data be moved to there prior to skb->head,
when adding IPv6 frag header to skb.

Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Shan Wei

Vulnerable version (before fix):
 static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features) 	skb->ip_summed = CHECKSUM_NONE;  	/* Check if there is enough headroom to insert fragment header. */ 	if ((skb_headroom(skb) < frag_hdr_sz) && 	    pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC)) 		goto out; 

Fixed version (after fix):
 static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features) 	skb->ip_summed = CHECKSUM_NONE;  	/* Check if there is enough headroom to insert fragment header. */ 	if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) && 	    pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC)) 		goto out; 

Patch:
patch: @@ -1335,7 +1335,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
 	skb->ip_summed = CHECKSUM_NONE;
 
 	/* Check if there is enough headroom to insert fragment header. */
-	if ((skb_headroom(skb) < frag_hdr_sz) &&
+	if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
 	    pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
 		goto out;
path: net/ipv6/udp.c
Vulnerability: Race condition in the sctp_rcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of service (system hang) via SCTP packets.  NOTE: in some environments, this issue exists because of an incomplete fix for CVE-2011-2482.
Vulnerability ID: CVE-2011-4348
CWE: CWE-362
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-06-08
File: net/sctp/input.c
Commit message: sctp: Fix another socket race during accept/peeloff

There is a race between sctp_rcv() and sctp_accept() where we
have moved the association from the listening socket to the
accepted socket, but sctp_rcv() processing cached the old
socket and continues to use it.

The easy solution is to check for the socket mismatch once we've
grabed the socket lock.  If we hit a mis-match, that means
that were are currently holding the lock on the listening socket,
but the association is refrencing a newly accepted socket.  We need
to drop the lock on the old socket and grab the lock on the new one.

A more proper solution might be to create accepted sockets when
the new association is established, similar to TCP.  That would
eliminate the race for 1-to-1 style sockets, but it would still
existing for 1-to-many sockets where a user wished to peeloff an
association.  For now, we'll live with this easy solution as
it addresses the problem.

Reported-by: Michal Hocko <mhocko@suse.cz>
Reported-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Vlad Yasevich

Vulnerable version (before fix):
 int sctp_rcv(struct sk_buff *skb) 	 */ 	sctp_bh_lock_sock(sk);  	if (sock_owned_by_user(sk)) { 		SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG); 		sctp_add_backlog(sk, skb);

Fixed version (after fix):
 int sctp_rcv(struct sk_buff *skb) 	 */ 	sctp_bh_lock_sock(sk);  	if (sk != rcvr->sk) { 		/* Our cached sk is different from the rcvr->sk.  This is 		 * because migrate()/accept() may have moved the association 		 * to a new socket and released all the sockets.  So now we 		 * are holding a lock on the old socket while the user may 		 * be doing something with the new socket.  Switch our veiw 		 * of the current sk. 		 */ 		sctp_bh_unlock_sock(sk); 		sk = rcvr->sk; 		sctp_bh_lock_sock(sk); 	}  	if (sock_owned_by_user(sk)) { 		SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG); 		sctp_add_backlog(sk, skb);

Patch:
patch: @@ -249,6 +249,19 @@ int sctp_rcv(struct sk_buff *skb)
 	 */
 	sctp_bh_lock_sock(sk);
 
+	if (sk != rcvr->sk) {
+		/* Our cached sk is different from the rcvr->sk.  This is
+		 * because migrate()/accept() may have moved the association
+		 * to a new socket and released all the sockets.  So now we
+		 * are holding a lock on the old socket while the user may
+		 * be doing something with the new socket.  Switch our veiw
+		 * of the current sk.
+		 */
+		sctp_bh_unlock_sock(sk);
+		sk = rcvr->sk;
+		sctp_bh_lock_sock(sk);
+	}
+
 	if (sock_owned_by_user(sk)) {
 		SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG);
 		sctp_add_backlog(sk, skb);
path: net/sctp/input.c
Vulnerability: The bat_socket_read function in net/batman-adv/icmp_socket.c in the Linux kernel before 3.3 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted batman-adv ICMP packet.
Vulnerability ID: CVE-2011-4604
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2013-06-07
File: net/batman-adv/icmp_socket.c
Commit message: batman-adv: Only write requested number of byte to user buffer

Don't write more than the requested number of bytes of an batman-adv icmp
packet to the userspace buffer. Otherwise unrelated userspace memory might get
overridden by the kernel.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Commit author: Sven Eckelmann

Vulnerable version (before fix):
 static ssize_t bat_socket_read(struct file *file, char __user *buf,  	spin_unlock_bh(&socket_client->lock);  	error = copy_to_user(buf, &socket_packet->icmp_packet, 			     socket_packet->icmp_len);  	packet_len = socket_packet->icmp_len; 	kfree(socket_packet);  	if (error)

Fixed version (after fix):
 static ssize_t bat_socket_read(struct file *file, char __user *buf,  	spin_unlock_bh(&socket_client->lock);  	packet_len = min(count, socket_packet->icmp_len); 	error = copy_to_user(buf, &socket_packet->icmp_packet, packet_len);  	kfree(socket_packet);  	if (error)

Patch:
patch: @@ -136,10 +136,9 @@ static ssize_t bat_socket_read(struct file *file, char __user *buf,
 
 	spin_unlock_bh(&socket_client->lock);
 
-	error = copy_to_user(buf, &socket_packet->icmp_packet,
-			     socket_packet->icmp_len);
+	packet_len = min(count, socket_packet->icmp_len);
+	error = copy_to_user(buf, &socket_packet->icmp_packet, packet_len);
 
-	packet_len = socket_packet->icmp_len;
 	kfree(socket_packet);
 
 	if (error)
path: net/batman-adv/icmp_socket.c
Vulnerability: SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Vulnerability ID: CVE-2011-4960
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/silverstripe/sapphire
Published: 2012-09-17
File: filesystem/Folder.php
Commit message: BUGFIX Fixed SQL injection in Folder::findOrMake()  parameter. Exploitable through Upload::, although unlikely to be set via user input.
Commit author: Ingo Schommer

Vulnerable version (before fix):
 static function findOrMake($folderPath) { 		$item = null; 		foreach($parts as $part) { 			if(!$part) continue; // happens for paths with a trailing slash 			$item = DataObject::get_one("Folder", "\"Name\" = '$part' AND \"ParentID\" = $parentID"); 			if(!$item) { 				$item = new Folder(); 				$item->ParentID = $parentID;

Fixed version (after fix):
 static function findOrMake($folderPath) { 		$item = null; 		foreach($parts as $part) { 			if(!$part) continue; // happens for paths with a trailing slash 			$item = DataObject::get_one( 				"Folder",  				sprintf( 					"\"Name\" = '%s' AND \"ParentID\" = %d", 					Convert::raw2sql($part),  					(int)$parentID 				) 			); 			if(!$item) { 				$item = new Folder(); 				$item->ParentID = $parentID;

Patch:
patch: @@ -42,7 +42,14 @@ static function findOrMake($folderPath) {
 		$item = null;
 		foreach($parts as $part) {
 			if(!$part) continue; // happens for paths with a trailing slash
-			$item = DataObject::get_one("Folder", "\"Name\" = '$part' AND \"ParentID\" = $parentID");
+			$item = DataObject::get_one(
+				"Folder", 
+				sprintf(
+					"\"Name\" = '%s' AND \"ParentID\" = %d",
+					Convert::raw2sql($part), 
+					(int)$parentID
+				)
+			);
 			if(!$item) {
 				$item = new Folder();
 				$item->ParentID = $parentID;
path: filesystem/Folder.php
Vulnerability: Koala Framework before 2011-11-21 has XSS via the request_uri parameter.
Vulnerability ID: CVE-2011-5018
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/koala-framework/koala-framework
Published: 2020-01-08
File: Kwf/Exception/Abstract.php
Commit message: fix XSS security issue: escape request_uri in 404 pages
Commit author: Niko Sams

Vulnerable version (before fix):
 public function render($ignoreCli = false)         $view->exception = $this->getException();         $view->message = $this->getException()->getMessage();         $view->requestUri = isset($_SERVER['REQUEST_URI']) ?             $_SERVER['REQUEST_URI'] : '' ;         $view->debug = Kwf_Exception::isDebug();         $header = $this->getHeader();         $template = $this->getTemplate();

Fixed version (after fix):
 public function render($ignoreCli = false)         $view->exception = $this->getException();         $view->message = $this->getException()->getMessage();         $view->requestUri = isset($_SERVER['REQUEST_URI']) ?             htmlspecialchars($_SERVER['REQUEST_URI']) : '' ;         $view->debug = Kwf_Exception::isDebug();         $header = $this->getHeader();         $template = $this->getTemplate();

Patch:
patch: @@ -74,7 +74,7 @@ public function render($ignoreCli = false)
         $view->exception = $this->getException();
         $view->message = $this->getException()->getMessage();
         $view->requestUri = isset($_SERVER['REQUEST_URI']) ?
-            $_SERVER['REQUEST_URI'] : '' ;
+            htmlspecialchars($_SERVER['REQUEST_URI']) : '' ;
         $view->debug = Kwf_Exception::isDebug();
         $header = $this->getHeader();
         $template = $this->getTemplate();
path: Kwf/Exception/Abstract.php
Vulnerability: chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.
Vulnerability ID: CVE-2011-5098
CWE: CWE-264
Severity score: 6.4
Project: https://github.com/opscode/chef
Published: 2012-08-08
File: chef-server-api/app/controllers/clients.rb
Commit message: CHEF-2649: Only allow admin clients to create admins (not validators)
Commit author: Bryan McLellan

Vulnerable version (before fix):
 def create     exists = true      if params.has_key?(:inflated_object)       params[:name] ||= params[:inflated_object].name       # We can only get here if we're admin or the validator. Only       # allow creating admin clients if we're already an admin.       if @auth_user.admin         params[:admin] ||= params[:inflated_object].admin       else         params[:admin] = false       end     end      begin

Fixed version (after fix):
 def create     exists = true      if params.has_key?(:inflated_object)       params[:name] ||= params[:inflated_object].name       params[:admin] ||= params[:inflated_object].admin     end      # We can only create clients if we're the admin or the validator.     # But only allow creating admin clients if we're already an admin.     if params[:admin] == true && @auth_user.admin != true       raise Forbidden, "You are not allowed to take this action."     end      begin

Patch:
patch: @@ -49,13 +49,13 @@ def create
     exists = true 
     if params.has_key?(:inflated_object)
       params[:name] ||= params[:inflated_object].name
-      # We can only get here if we're admin or the validator. Only
-      # allow creating admin clients if we're already an admin.
-      if @auth_user.admin
-        params[:admin] ||= params[:inflated_object].admin
-      else
-        params[:admin] = false
-      end
+      params[:admin] ||= params[:inflated_object].admin
+    end
+
+    # We can only create clients if we're the admin or the validator.
+    # But only allow creating admin clients if we're already an admin.
+    if params[:admin] == true && @auth_user.admin != true
+      raise Forbidden, "You are not allowed to take this action."
     end
 
     begin
path: chef-server-api/app/controllers/clients.rb
Vulnerability: In the Linux kernel before 3.1, an off by one in the drivers/target/loopback/tcm_loop.c tcm_loop_make_naa_tpg() function could result in at least memory corruption.
Vulnerability ID: CVE-2011-5327
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2019-07-27
File: drivers/target/loopback/tcm_loop.c
Commit message: loopback: off by one in tcm_loop_make_naa_tpg()

This is an off by one 'tgpt' check in tcm_loop_make_naa_tpg() that could result
in memory corruption.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Nicholas A. Bellinger <nab@linux-iscsi.org>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 struct se_portal_group *tcm_loop_make_naa_tpg( 	tpgt_str += 5; /* Skip ahead of "tpgt_" */ 	tpgt = (unsigned short int) simple_strtoul(tpgt_str, &end_ptr, 0);  	if (tpgt > TL_TPGS_PER_HBA) { 		printk(KERN_ERR "Passed tpgt: %hu exceeds TL_TPGS_PER_HBA:" 				" %u\n", tpgt, TL_TPGS_PER_HBA); 		return ERR_PTR(-EINVAL);

Fixed version (after fix):
 struct se_portal_group *tcm_loop_make_naa_tpg( 	tpgt_str += 5; /* Skip ahead of "tpgt_" */ 	tpgt = (unsigned short int) simple_strtoul(tpgt_str, &end_ptr, 0);  	if (tpgt >= TL_TPGS_PER_HBA) { 		printk(KERN_ERR "Passed tpgt: %hu exceeds TL_TPGS_PER_HBA:" 				" %u\n", tpgt, TL_TPGS_PER_HBA); 		return ERR_PTR(-EINVAL);

Patch:
patch: @@ -1205,7 +1205,7 @@ struct se_portal_group *tcm_loop_make_naa_tpg(
 	tpgt_str += 5; /* Skip ahead of "tpgt_" */
 	tpgt = (unsigned short int) simple_strtoul(tpgt_str, &end_ptr, 0);
 
-	if (tpgt > TL_TPGS_PER_HBA) {
+	if (tpgt >= TL_TPGS_PER_HBA) {
 		printk(KERN_ERR "Passed tpgt: %hu exceeds TL_TPGS_PER_HBA:"
 				" %u\n", tpgt, TL_TPGS_PER_HBA);
 		return ERR_PTR(-EINVAL);
path: drivers/target/loopback/tcm_loop.c
Vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.
Vulnerability ID: CVE-2012-1001
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/vito/chyrp
Published: 2019-11-21
File: includes/ajax.php
Commit message: Fixed a potential XSS vulnerability.

User input wasn't being sanitized before output. Thanks HTB Security Research Lab for notifying us.
Commit author: Arian Xhezairi

Vulnerable version (before fix):
                              $_POST['feather']);              echo "<h2 class=\"preview-header\">".__("Preview")."</h2>\n".                  "<div class=\"preview-content\">".$_POST['content']."</div>";             break;          case "check_confirm":

Fixed version (after fix):
                              $_POST['feather']);              echo "<h2 class=\"preview-header\">".__("Preview")."</h2>\n".                  "<div class=\"preview-content\">".fix($_POST['content'])."</div>";             break;          case "check_confirm":

Patch:
patch: @@ -87,7 +87,7 @@
                              $_POST['feather']);
 
             echo "<h2 class=\"preview-header\">".__("Preview")."</h2>\n".
-                 "<div class=\"preview-content\">".$_POST['content']."</div>";
+                 "<div class=\"preview-content\">".fix($_POST['content'])."</div>";
             break;
 
         case "check_confirm":
path: includes/ajax.php
Vulnerability: The pkinit_server_return_padata function in plugins/preauth/pkinit/pkinit_srv.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 attempts to find an agility KDF identifier in inappropriate circumstances, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted Draft 9 request.
Vulnerability ID: CVE-2012-1016
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/krb5/krb5
Published: 2013-03-05
File: src/plugins/preauth/pkinit/pkinit_srv.c
Commit message: PKINIT (draft9) null ptr deref [CVE-2012-1016]

Don't check for an agility KDF identifier in the non-draft9 reply
structure when we're building a draft9 reply, because it'll be NULL.

The KDC plugin for PKINIT can dereference a null pointer when handling
a draft9 request, leading to a crash of the KDC process.  An attacker
would need to have a valid PKINIT certificate, or an unauthenticated
attacker could execute the attack if anonymous PKINIT is enabled.

CVSSv2 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:P/RL:O/RC:C

[tlyu@mit.edu: reformat comment and edit log message]

(back ported from commit cd5ff932c9d1439c961b0cf9ccff979356686aff)

ticket: 7527 (new)
version_fixed: 1.10.4
status: resolved
Commit author: Nalin Dahyabhai

Vulnerable version (before fix):
 pkinit_server_return_padata(krb5_context context,          rep9->choice == choice_pa_pk_as_rep_draft9_dhSignedData) ||         (rep != NULL && rep->choice == choice_pa_pk_as_rep_dhInfo)) {          /* If mutually supported KDFs were found, use the alg agility KDF */         if (rep->u.dh_Info.kdfID) {             secret.data = server_key;             secret.length = server_key_len;              retval = pkinit_alg_agility_kdf(context, &secret,

Fixed version (after fix):
 pkinit_server_return_padata(krb5_context context,          rep9->choice == choice_pa_pk_as_rep_draft9_dhSignedData) ||         (rep != NULL && rep->choice == choice_pa_pk_as_rep_dhInfo)) {          /* If we're not doing draft 9, and mutually supported KDFs were found,          * use the algorithm agility KDF. */         if (rep != NULL && rep->u.dh_Info.kdfID) {             secret.data = (char *)server_key;             secret.length = server_key_len;              retval = pkinit_alg_agility_kdf(context, &secret,

Patch:
patch: @@ -1016,9 +1016,10 @@ pkinit_server_return_padata(krb5_context context,
          rep9->choice == choice_pa_pk_as_rep_draft9_dhSignedData) ||
         (rep != NULL && rep->choice == choice_pa_pk_as_rep_dhInfo)) {
 
-        /* If mutually supported KDFs were found, use the alg agility KDF */
-        if (rep->u.dh_Info.kdfID) {
-            secret.data = server_key;
+        /* If we're not doing draft 9, and mutually supported KDFs were found,
+         * use the algorithm agility KDF. */
+        if (rep != NULL && rep->u.dh_Info.kdfID) {
+            secret.data = (char *)server_key;
             secret.length = server_key_len;
 
             retval = pkinit_alg_agility_kdf(context, &secret,
path: src/plugins/preauth/pkinit/pkinit_srv.c