starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-2138 (published 2023-04-18T01:15Z)

Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-798
cwe_name: Use of Hard-coded Credentials
description: The product contains hard-coded credentials, such as a password or cryptographic key.
extended_description: 
		   There are two main variations:
		   
			 Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect.
			 Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.
		   
         
         

Fix information:
repo_url: https://github.com/nuxtlabs/github-module
commit_details: repo_url: https://github.com/nuxtlabs/github-module
author: Daniel Roe
author_date: 2023-04-11 11:12:12+01:00
msg: fix: do not expose token in public runtime config (#41)

* fix: do not expose token in public runtime config

* fix: remove formatting change

* refactor: avoid setting token in first place
repository: repo_url: https://github.com/nuxtlabs/github-module
repo_name: nuxtlabs/github-module
description: GitHub integration for Nuxt.
repo_language: TypeScript
owner: nuxtlabs
file_changes: filename: module.ts
change_type: ModificationType.MODIFY
diff: @@ -69,7 +69,6 @@ export default defineNuxtModule<ModuleOptions>({
       owner: options.owner || process.env.GITHUB_OWNER,
       branch: options.branch || process.env.GITHUB_BRANCH,
       repo: options.repo || process.env.GITHUB_REPO,
-      token: options.token || process.env.GITHUB_TOKEN,
       disableCache: options.disableCache,
       parseContents: options.parseContents,
       maxContributors: options.maxContributors
@@ -79,7 +78,9 @@ export default defineNuxtModule<ModuleOptions>({
     // @ts-ignore
     nuxt.options.runtimeConfig.public.github = defu(nuxt.options.runtimeConfig.public.github, config)
     // @ts-ignore
-    nuxt.options.runtimeConfig.github = defu(nuxt.options.runtimeConfig.github, config)
+    nuxt.options.runtimeConfig.github = defu(nuxt.options.runtimeConfig.github, {
+      token: options.token || process.env.GITHUB_TOKEN
+    }, config)
 
     // Autolink issue/PR/commit links using `remark-github` plugin
     if (options.remarkPlugin) {

programming_language: JavaScript
CVE-2023-38504 (published 2023-07-27T19:15Z)

Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js` client.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/balderdashy/sails
commit_details: repo_url: https://github.com/balderdashy/sails
author: Mike McNeil
author_date: 2023-07-21 16:23:38-05:00
msg: Improve virtual request parsing (#7287)

* Improve virtual request parsing

Relevant for socket.io usage, and usage from tests.  (`sails.request()`)

* Update req.js

---------

Co-authored-by: Eric <eashaw@sailsjs.com>
repository: repo_url: https://github.com/balderdashy/sails
repo_name: balderdashy/sails
description: Realtime MVC Framework for Node.js
repo_language: JavaScript
owner: balderdashy
file_changes: filename: req.js
change_type: ModificationType.MODIFY
diff: @@ -46,22 +46,27 @@ module.exports = function buildRequest (_req) {
   }
   else {
 
-    // TODO: send a PR to mock-req with a fix for this
     if (_req.headers && typeof _req.headers === 'object') {
-      // Strip undefined headers
-      _.each(_req.headers, function (headerVal, headerKey) {
-        if (_.isUndefined(headerVal)){
+      for (let headerKey of Object.keys(_req.headers)) {
+        // Strip undefined headers
+        if (undefined === _req.headers[headerKey]) {
           delete _req.headers[headerKey];
         }
-      });
-      // Make sure all remaining headers are strings
-      _req.headers = _.mapValues(_req.headers, function (headerVal /*, headerKey*/) {
-        if (typeof headerVal !== 'string') {
-          headerVal = ''+headerVal+'';
+        // Make sure all remaining headers are strings
+        if (typeof _req.headers[headerKey] !== 'string') {
+          try {
+            _req.headers[headerKey] = ''+_req.headers[headerKey];
+            // FUTURE: This behavior is likely being relied upon by apps, so we can't just change it.
+            // But in retrospect, it would probably be better to straight-up reject this here if it's not
+            // a string, since HTTP header values are always supposed to be strings; or at least primitives.
+            // So maybe reject non-primitives, reject `null`, and then accept primitives, but be smart about
+            // this, especially in the context of what the client is doing.
+          } catch (unusedErr) {
+            delete _req.headers[headerKey];
+          }
         }
-        return headerVal;
-      });
-    }
+      }//∞
+    }//ﬁ
 
     // Create a mock IncomingMessage stream.
     req = new MockReq({

programming_language: JavaScript
CVE-2011-5321 (published 2016-05-02T10:59Z)

The tty_open function in drivers/tty/tty_io.c in the Linux kernel before 3.1.1 mishandles a driver-lookup failure, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted access to a device file under the /dev/pts directory.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Jiri Slaby
author_date: 2011-10-12 11:32:42+02:00
msg: TTY: drop driver reference in tty_open fail path

When tty_driver_lookup_tty fails in tty_open, we forget to drop a
reference to the tty driver. This was added by commit 4a2b5fddd5 (Move
tty lookup/reopen to caller).

Fix that by adding tty_driver_kref_put to the fail path.

I will refactor the code later. This is for the ease of backporting to
stable.

Introduced-in: v2.6.28-rc2
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: stable <stable@vger.kernel.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Acked-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: tty_io.c
change_type: ModificationType.MODIFY
diff: @@ -1873,6 +1873,7 @@ static int tty_open(struct inode *inode, struct file *filp)
 		if (IS_ERR(tty)) {
 			tty_unlock();
 			mutex_unlock(&tty_mutex);
+			tty_driver_kref_put(driver);
 			return PTR_ERR(tty);
 		}
 	}

programming_language: C
CVE-2017-13025 (published 2017-09-14T06:29Z)

The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Francois-Xavier Le Bail
author_date: 2017-03-22 17:07:47+01:00
msg: CVE-2017-13025/IPv6 mobility: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: extract.h
change_type: ModificationType.MODIFY
diff: @@ -281,3 +281,6 @@ EXTRACT_64BITS(const void *p)
 
 #define ND_TTEST_64BITS(p) ND_TTEST2(*(p), 8)
 #define ND_TCHECK_64BITS(p) ND_TCHECK2(*(p), 8)
+
+#define ND_TTEST_128BITS(p) ND_TTEST2(*(p), 16)
+#define ND_TCHECK_128BITS(p) ND_TCHECK2(*(p), 16)

programming_language: C
filename: print-mobility.c
change_type: ModificationType.MODIFY
diff: @@ -159,6 +159,7 @@ mobility_opt_print(netdissect_options *ndo,
 				ND_PRINT((ndo, "(altcoa: trunc)"));
 				goto trunc;
 			}
+			ND_TCHECK_128BITS(&bp[i+2]);
 			ND_PRINT((ndo, "(alt-CoA: %s)", ip6addr_string(ndo, &bp[i+2])));
 			break;
 		case IP6MOPT_NONCEID:

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -526,6 +526,7 @@ icmp6_mobileprefix_asan	icmp6_mobileprefix_asan.pcap	icmp6_mobileprefix_asan.out
 ip_printroute_asan	ip_printroute_asan.pcap		ip_printroute_asan.out	-v
 mobility_opt_asan	mobility_opt_asan.pcap		mobility_opt_asan.out	-v
 mobility_opt_asan_2	mobility_opt_asan_2.pcap	mobility_opt_asan_2.out	-v
+mobility_opt_asan_3	mobility_opt_asan_3.pcap	mobility_opt_asan_3.out	-v
 
 # RTP tests
 # fuzzed pcap

programming_language: Shell
filename: mobility_opt_asan_3.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) d400:7fa1:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: CoT nonce id=0x74 Care-of Init Cookie=80570f80:00000004[|MOBILITY]
+IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) ffc3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b2a1: mobility: BU seq#=39837 lifetime=261452[|MOBILITY]

programming_language: Batchfile
CVE-2023-41885 (published 2023-09-12T21:15Z)

Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not also enforce strong passwords, these lists of valid accounts are likely to be used in a password spray attack with the outcome being attempted takeover of user accounts on the platform. The impact of this vulnerability is minor as it requires chaining with other attack vectors in order to gain more then simply a list of valid users on the underlying platform. The likelihood of this vulnerability is possible as it requires minimal skills to pull off, especially given the underlying login functionality for Piccolo based sites is open source. This issue has been patched in version 0.121.0.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-203
cwe_name: Observable Discrepancy
description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
         

Fix information:
repo_url: https://github.com/piccolo-orm/piccolo
commit_details: repo_url: https://github.com/piccolo-orm/piccolo
author: Daniel Townsend
author_date: 2023-09-11 20:41:25+01:00
msg: Merge pull request from GHSA-h7cm-mrvq-wcfr

Co-authored-by: skelmis <ethan@koldfusion.xyz>
repository: repo_url: https://github.com/piccolo-orm/piccolo
repo_name: piccolo-orm/piccolo
description: A fast, user friendly ORM and query builder which supports asyncio.
repo_language: Python
owner: piccolo-orm
file_changes: filename: tables.py
change_type: ModificationType.MODIFY
diff: @@ -212,7 +212,10 @@ class BaseUser(Table, tablename="piccolo_user"):
             .run()
         )
         if not response:
-            # No match found
+            # No match found. We still call hash_password
+            # here to mitigate the ability to enumerate
+            # users via response timings
+            cls.hash_password(password)
             return None
 
         stored_password = response["password"]

programming_language: Python
CVE-2018-25094 (published 2023-12-03T11:15Z)

A vulnerability was found in ???????????????? Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 9d9618422b980335bb30be612ea90f4f56cb992c. It is recommended to upgrade the affected component. The identifier VDB-246641 was assigned to this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/59160781/project
commit_details: repo_url: https://github.com/59160781/project
author: LongCat
author_date: 2018-03-18 22:46:27+07:00
msg: fix a critical security vulnerability

/ckeditor/filemanager/browser/default/image.php?fid=/settings/database.php&id=&w=&h=
/ckeditor/filemanager/browser/default/image.php?fid=../../../etc/passwd&id=&w=&h
repository: repo_url: https://github.com/59160781/project
repo_name: 59160781/project
repo_language: PHP
owner: 59160781
file_changes: filename: image.php
change_type: ModificationType.MODIFY
diff: @@ -1,10 +1,13 @@
 <?php
 // ckeditor/filemanager/browser/default/image.php
-if (isset($_REQUEST['fid']) && isset($_GET['w']) && isset($_GET['h'])) {
+
+if ( isset($_REQUEST['fid']) && isset($_GET['w']) && isset($_GET['h'])) {
   // load Kotchasan
   include '../../../../load.php';
   // Initial Kotchasan Framework
   Kotchasan::createWebApplication('Gcms\Config');
+  // hotfix: these checks need to be changed later
+  if(!Kotchasan\Login::isMember() || strpos($_REQUEST['fid'], '..') === false || strpos($_REQUEST['fid'], '.php') === false) exit();
   // ค่าที่ส่งมา
   $id = ROOT_PATH.$_REQUEST['fid'];
   $idW = $_GET['w'];

programming_language: PHP
CVE-2017-8325 (published 2017-04-29T20:59Z)

The iw_process_cols_to_intermediate function in imagew-main.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/jsummers/imageworsener
commit_details: repo_url: https://github.com/jsummers/imageworsener
author: Jason Summers
author_date: 2017-04-12 10:54:31-04:00
msg: Reduced the max memory use and image size in 64-bit builds

This is a stopgap measure that should prevent some problems with excessive
resource use, and possibly integer overflow.
Related: issue #14
repository: repo_url: https://github.com/jsummers/imageworsener
repo_name: jsummers/imageworsener
description: A utility for processing PNG, JPEG, BMP, and WebP images. Features include resize/resample, dither, grayscale, apply background color, subpixel rendering.
repo_language: C
owner: jsummers
file_changes: filename: imagew-internals.h
change_type: ModificationType.MODIFY
diff: @@ -19,8 +19,8 @@
 typedef double iw_tmpsample;
 
 #ifdef IW_64BIT
-#define IW_DEFAULT_MAX_DIMENSION 1000000
-#define IW_DEFAULT_MAX_MALLOC 2000000000000
+#define IW_DEFAULT_MAX_DIMENSION 40000
+#define IW_DEFAULT_MAX_MALLOC 2000000000
 #else
 #define IW_DEFAULT_MAX_DIMENSION 40000 // Must be less than sqrt(2^31).
 #define IW_DEFAULT_MAX_MALLOC 2000000000

programming_language: C
CVE-2020-8938 (published 2020-12-15T15:15Z)

An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to FromkLinuxSockAddr with attacker controlled content and size of klinux_addr which allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/google/asylo
commit_details: repo_url: https://github.com/google/asylo
author: Chong Cai
author_date: 2020-09-25 12:27:44-07:00
msg: Check input length in FromLinuxSockAddr

PiperOrigin-RevId: 333785506
Change-Id: I1d68fb8954665eebc1018d80ff995cbe9e7ed6a9
repository: repo_url: https://github.com/google/asylo
repo_name: google/asylo
description: An open and flexible framework for developing enclave applications
repo_language: C++
owner: google
file_changes: filename: manual_types_functions.cc
change_type: ModificationType.MODIFY
diff: @@ -429,6 +429,10 @@ bool FromkLinuxSockAddr(const struct klinux_sockaddr *input,
 
   int16_t klinux_family = input->klinux_sa_family;
   if (klinux_family == kLinux_AF_UNIX) {
+    if (input_len < sizeof(struct klinux_sockaddr_un)) {
+      return false;
+    }
+
     struct klinux_sockaddr_un *klinux_sockaddr_un_in =
         const_cast<struct klinux_sockaddr_un *>(
             reinterpret_cast<const struct klinux_sockaddr_un *>(input));
@@ -442,6 +446,9 @@ bool FromkLinuxSockAddr(const struct klinux_sockaddr *input,
                  sizeof(klinux_sockaddr_un_in->klinux_sun_path)));
     CopySockaddr(&sockaddr_un_out, sizeof(sockaddr_un_out), output, output_len);
   } else if (klinux_family == kLinux_AF_INET) {
+    if (input_len < sizeof(struct klinux_sockaddr_in)) {
+      return false;
+    }
     struct klinux_sockaddr_in *klinux_sockaddr_in_in =
         const_cast<struct klinux_sockaddr_in *>(
             reinterpret_cast<const struct klinux_sockaddr_in *>(input));
@@ -457,6 +464,10 @@ bool FromkLinuxSockAddr(const struct klinux_sockaddr *input,
                          klinux_sockaddr_in_in->klinux_sin_zero);
     CopySockaddr(&sockaddr_in_out, sizeof(sockaddr_in_out), output, output_len);
   } else if (klinux_family == kLinux_AF_INET6) {
+    if (input_len < sizeof(struct klinux_sockaddr_in6)) {
+      return false;
+    }
+
     struct klinux_sockaddr_in6 *klinux_sockaddr_in6_in =
         const_cast<struct klinux_sockaddr_in6 *>(
             reinterpret_cast<const struct klinux_sockaddr_in6 *>(input));

programming_language: C
CVE-2022-39190 (published 2022-09-02T05:15Z)

An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Pablo Neira Ayuso
author_date: 2022-08-22 11:06:39+02:00
msg: netfilter: nf_tables: disallow binding to already bound chain

Update nft_data_init() to report EINVAL if chain is already bound.

Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Reported-by: Gwangun Jung <exsociety@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: nf_tables_api.c
change_type: ModificationType.MODIFY
diff: @@ -9711,6 +9711,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
 			return PTR_ERR(chain);
 		if (nft_is_base_chain(chain))
 			return -EOPNOTSUPP;
+		if (nft_chain_is_bound(chain))
+			return -EINVAL;
 		if (desc->flags & NFT_DATA_DESC_SETELEM &&
 		    chain->flags & NFT_CHAIN_BINDING)
 			return -EINVAL;

programming_language: C