starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-20856 (published 2019-07-26T05:15Z)

An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: xiao jin
author_date: 2018-07-30 14:11:12+08:00
msg: block: blk_init_allocated_queue() set q->fq as NULL in the fail case

We find the memory use-after-free issue in __blk_drain_queue()
on the kernel 4.14. After read the latest kernel 4.18-rc6 we
think it has the same problem.

Memory is allocated for q->fq in the blk_init_allocated_queue().
If the elevator init function called with error return, it will
run into the fail case to free the q->fq.

Then the __blk_drain_queue() uses the same memory after the free
of the q->fq, it will lead to the unpredictable event.

The patch is to set q->fq as NULL in the fail case of
blk_init_allocated_queue().

Fixes: commit 7c94e1c157a2 ("block: introduce blk_flush_queue to drive flush machinery")
Cc: <stable@vger.kernel.org>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: xiao jin <jin.xiao@intel.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: blk-core.c
change_type: ModificationType.MODIFY
diff: @@ -1184,6 +1184,7 @@ int blk_init_allocated_queue(struct request_queue *q)
 		q->exit_rq_fn(q, q->fq->flush_rq);
 out_free_flush_queue:
 	blk_free_flush_queue(q->fq);
+	q->fq = NULL;
 	return -ENOMEM;
 }
 EXPORT_SYMBOL(blk_init_allocated_queue);

programming_language: C
CVE-2023-29416 (published 2023-04-06T05:15Z)

An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A bz3_decode_block out-of-bounds write can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/kspalaiologos/bzip3
commit_details: repo_url: https://github.com/kspalaiologos/bzip3
author: Kamila Szewczyk
author_date: 2023-03-26 08:02:46+02:00
msg: tentative libsais safety patches
repository: repo_url: https://github.com/kspalaiologos/bzip3
repo_name: kspalaiologos/bzip3
description: A better and stronger spiritual successor to BZip2.
repo_language: C
owner: kspalaiologos
file_changes: filename: common.h
change_type: ModificationType.MODIFY
diff: @@ -22,6 +22,7 @@
 
 #define KiB(x) ((x)*1024)
 #define MiB(x) ((x)*1024 * 1024)
+#define BWT_BOUND(x) ((x) + 128)
 
 #include <inttypes.h>
 #include <stdint.h>

programming_language: Haskell
filename: libbz3.c
change_type: ModificationType.MODIFY
diff: @@ -502,8 +502,8 @@ BZIP3_API struct bz3_state * bz3_new(s32 block_size) {
     bz3_state->cm_state = malloc(sizeof(state));
 
     bz3_state->swap_buffer = malloc(bz3_bound(block_size));
-    bz3_state->sais_array = malloc((block_size + 128) * sizeof(s32));
-    memset(bz3_state->sais_array, 0, sizeof(s32) * (block_size + 128));
+    bz3_state->sais_array = malloc(BWT_BOUND(block_size) * sizeof(s32));
+    memset(bz3_state->sais_array, 0, sizeof(s32) * BWT_BOUND(block_size));
 
     bz3_state->lzp_lut = calloc(1 << LZP_DICTIONARY, sizeof(s32));
 
@@ -682,6 +682,8 @@ BZIP3_API s32 bz3_decode_block(struct bz3_state * state, u8 * buffer, s32 data_s
     }
 
     // Undo BWT
+    memset(state->sais_array, 0, sizeof(s32) * BWT_BOUND(state->block_size));
+    memset(b2, 0, size_src);
     if (libsais_unbwt(b1, b2, state->sais_array, size_src, NULL, bwt_idx) < 0) {
         state->last_error = BZ3_ERR_BWT;
         return -1;

programming_language: C
CVE-2018-15862 (published 2018-08-25T21:29Z)

Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/xkbcommon/libxkbcommon
commit_details: repo_url: https://github.com/xkbcommon/libxkbcommon
author: Daniel Stone
author_date: 2017-06-26 17:18:16+01:00
msg: xkbcomp: Don't explode on invalid virtual modifiers

testcase: 'virtualModifiers=LevelThreC'

Signed-off-by: Daniel Stone <daniels@collabora.com>
repository: repo_url: https://github.com/xkbcommon/libxkbcommon
repo_name: xkbcommon/libxkbcommon
description: keymap handling library for toolkits and window systems
repo_language: C
owner: xkbcommon
file_changes: filename: expr.c
change_type: ModificationType.MODIFY
diff: @@ -101,6 +101,8 @@ LookupModMask(struct xkb_context *ctx, const void *priv, xkb_atom_t field,
         return false;
 
     str = xkb_atom_text(ctx, field);
+    if (!str)
+        return false;
 
     if (istreq(str, "all")) {
         *val_rtrn  = MOD_REAL_MASK_ALL;

programming_language: C
CVE-2015-10068 (published 2023-01-18T08:15Z)

A vulnerability classified as critical was found in danynab movify-j. This vulnerability affects the function getByMovieId of the file app/business/impl/ReviewServiceImpl.java. The manipulation of the argument movieId/username leads to sql injection. The name of the patch is c3085e01936a4d7eff1eda3093f25d56cc4d2ec5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218476.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/danynab/movify-j
commit_details: repo_url: https://github.com/danynab/movify-j
author: Dani Meana
author_date: 2015-03-14 18:09:36+01:00
msg: Avoid SQL Injection
repository: repo_url: https://github.com/danynab/movify-j
repo_name: danynab/movify-j
repo_language: Java
owner: danynab
file_changes: filename: ReviewServiceImpl.java
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 package business.impl;
 
 import business.ReviewService;
+import com.avaje.ebean.Expr;
 import models.Review;
 import play.db.ebean.Model;
 
@@ -22,7 +23,7 @@ public class ReviewServiceImpl implements ReviewService {
 
     @Override
     public Review getByMovieIdAndUsername(int movieId, String username) {
-        return find.where("movieId = " + movieId + " and username = '" + username + "'").findUnique();
+        return find.where().and(Expr.eq("movieId", movieId), Expr.eq("username", username)).findUnique();
     }
 
     @Override

programming_language: Java
filename: WebplayerController.java
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 package controllers;
 
 import filters.LoginRequiredAction;
+import filters.SubscriptionRequiredAction;
 import infrastructure.Factories;
 import models.Genre;
 import models.Movie;
@@ -19,8 +20,7 @@ import java.util.List;
 /**
  * Created by Dani on 14/3/15.
  */
-@With(LoginRequiredAction.class)
-//@With({LoginRequiredAction.class, SubscriptionRequiredAction.class})
+@With({LoginRequiredAction.class, SubscriptionRequiredAction.class})
 public class WebplayerController extends Controller {
 
     public static Result showWebplayer() {

programming_language: Java
CVE-2023-0817 (published 2023-02-13T22:15Z)

Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: Aurelien David
author_date: 2023-02-13 15:42:23+01:00
msg: mhas: check idx not oob (#2398)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: reframe_mhas.c
change_type: ModificationType.MODIFY
diff: @@ -198,12 +198,11 @@ static void mhas_dmx_check_dur(GF_Filter *filter, GF_MHASDmxCtx *ctx)
 			if (!mhas_last_cfg) mhas_sap = 0;
 		//config
 		} else if (mhas_type==1) {
-			u32 sr = 0;
 			/*u32 pl = */gf_bs_read_u8(bs);
 			u32 idx = gf_bs_read_int(bs, 5);
 			if (idx==0x1f)
 				duration.den = gf_bs_read_int(bs, 24);
-			else if (sr < nb_usac_sr) {
+			else if (idx < nb_usac_sr) {
 				duration.den = USACSampleRates[idx];
 			}
 			idx = gf_bs_read_int(bs, 3);
@@ -621,7 +620,7 @@ GF_Err mhas_dmx_process(GF_Filter *filter)
 			u32 idx = gf_bs_read_int(ctx->bs, 5);
 			if (idx==0x1f)
 				sr = gf_bs_read_int(ctx->bs, 24);
-			else if (sr < nb_usac_sr) {
+			else if (idx < nb_usac_sr) {
 				sr = USACSampleRates[idx];
 			}
 			ctx->nb_unknown_pck = 0;

programming_language: C
CVE-2023-33975 (published 2023-05-30T18:15Z)

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. This issue is fixed in pull request 19680. As a workaround, disable support for fragmented IP datagrams.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/RIOT-OS/RIOT
commit_details: repo_url: https://github.com/RIOT-OS/RIOT
author: Martine Lenders
author_date: 2023-05-30 14:39:00+02:00
msg: gnrc_sixlowpan_frag_rb: fix OOB write in _rbuf_add
repository: repo_url: https://github.com/RIOT-OS/RIOT
repo_name: RIOT-OS/RIOT
description: RIOT -  The friendly OS for IoT
repo_language: C
owner: RIOT-OS
file_changes: filename: gnrc_sixlowpan_frag_rb.c
change_type: ModificationType.MODIFY
diff: @@ -461,6 +461,19 @@ static int _rbuf_add(gnrc_netif_hdr_t *netif_hdr, gnrc_pktsnip_t *pkt,
                 else if (IS_USED(MODULE_GNRC_SIXLOWPAN_FRAG_SFR) &&
                          sixlowpan_sfr_rfrag_is(pkt->data)) {
                     entry.super->datagram_size--;
+                    /* Check, if fragment is still small enough to fit datagram size.
+                     * `offset` is 0, as this is the first fragment so it does not have to be added
+                     * here. */
+                    if (frag_size > entry.super->datagram_size) {
+                        DEBUG_PUTS(
+                           "6lo rfrag: fragment too big for resulting datagram, "
+                           "discarding datagram\n"
+                        );
+                        gnrc_pktbuf_release(entry.rbuf->pkt);
+                        gnrc_pktbuf_release(pkt);
+                        gnrc_sixlowpan_frag_rb_remove(entry.rbuf);
+                        return RBUF_ADD_ERROR;
+                    }
                 }
             }
         }

programming_language: C
CVE-2016-7133 (published 2016-09-12T01:59Z)

Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/php/php-src
commit_details: repo_url: https://github.com/php/php-src
author: Stanislav Malyshev
author_date: 2016-08-14 19:07:15-07:00
msg: Fix bug #72742 - memory allocator fails to realloc small block to large one
repository: repo_url: https://github.com/php/php-src
repo_name: php/php-src
description: The PHP Interpreter
repo_language: C
owner: php
file_changes: filename: zend_alloc.c
change_type: ModificationType.MODIFY
diff: @@ -1548,21 +1548,21 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 
 		ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
 		if (info & ZEND_MM_IS_SRUN) {
-			int old_bin_num, bin_num;
-
-			old_bin_num = ZEND_MM_SRUN_BIN_NUM(info);
+			int old_bin_num = ZEND_MM_SRUN_BIN_NUM(info);
 			old_size = bin_data_size[old_bin_num];
-			bin_num = ZEND_MM_SMALL_SIZE_TO_BIN(size);
-			if (old_bin_num == bin_num) {
+			if (size <= ZEND_MM_MAX_SMALL_SIZE) {
+				int bin_num = ZEND_MM_SMALL_SIZE_TO_BIN(size);
+				if (old_bin_num == bin_num) {
 #if ZEND_DEBUG
-				dbg = zend_mm_get_debug_info(heap, ptr);
-				dbg->size = real_size;
-				dbg->filename = __zend_filename;
-				dbg->orig_filename = __zend_orig_filename;
-				dbg->lineno = __zend_lineno;
-				dbg->orig_lineno = __zend_orig_lineno;
+					dbg = zend_mm_get_debug_info(heap, ptr);
+					dbg->size = real_size;
+					dbg->filename = __zend_filename;
+					dbg->orig_filename = __zend_orig_filename;
+					dbg->lineno = __zend_lineno;
+					dbg->orig_lineno = __zend_orig_lineno;
 #endif
-				return ptr;
+					return ptr;
+				}
 			}
 		} else /* if (info & ZEND_MM_IS_LARGE_RUN) */ {
 			ZEND_MM_CHECK(ZEND_MM_ALIGNED_OFFSET(page_offset, ZEND_MM_PAGE_SIZE) == 0, "zend_mm_heap corrupted");

programming_language: C
CVE-2015-7837 (published 2017-09-19T16:29Z)

The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended securelevel/secureboot restrictions by leveraging improper handling of secure_boot flag across kexec reboot.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-254
cwe_name: 7PK - Security Features
description: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Fix information:
repo_url: https://github.com/mjg59/linux
commit_details: repo_url: https://github.com/mjg59/linux
author: Dave Young
author_date: 2015-10-06 13:31:31+01:00
msg: kexec/uefi: copy secure_boot flag in boot params across kexec reboot

Kexec reboot in case secure boot being enabled does not keep the secure
boot mode in new kernel, so later one can load unsigned kernel via legacy
kexec_load.  In this state, the system is missing the protections provided
by secure boot. Adding a patch to fix this by retain the secure_boot flag
in original kernel.

secure_boot flag in boot_params is set in EFI stub, but kexec bypasses the
stub. Fixing this issue by copying secure_boot flag across kexec reboot.

Signed-off-by: Dave Young <dyoung@redhat.com>
repository: repo_url: https://github.com/mjg59/linux
repo_name: mjg59/linux
description: Linux kernel source tree
repo_language: C
owner: mjg59
file_changes: filename: kexec-bzimage64.c
change_type: ModificationType.MODIFY
diff: @@ -180,6 +180,7 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
 	if (efi_enabled(EFI_OLD_MEMMAP))
 		return 0;
 
+	params->secure_boot = boot_params.secure_boot;
 	ei->efi_loader_signature = current_ei->efi_loader_signature;
 	ei->efi_systab = current_ei->efi_systab;
 	ei->efi_systab_hi = current_ei->efi_systab_hi;

programming_language: C
CVE-2022-2650 (published 2022-11-24T17:15Z)

Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-307
cwe_name: Improper Restriction of Excessive Authentication Attempts
description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/wger-project/wger
commit_details: repo_url: https://github.com/wger-project/wger
author: Roland Geider
author_date: 2022-10-13 16:24:29+02:00
msg: Merge branch 'master' into add-django-axes
repository: repo_url: https://github.com/wger-project/wger
repo_name: wger-project/wger
description: Self hosted FLOSS fitness/workout, nutrition and weight tracker
repo_language: Python
owner: wger-project
CVE-2021-28117 (published 2021-03-20T21:15Z)

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/KDE/discover
commit_details: repo_url: https://github.com/KDE/discover
author: Aleix Pol
author_date: 2021-03-10 21:48:53+01:00
msg: Only turn http[s] links into clickable links

CVE-2021-28117

(cherry picked from commit d375031ff0262cedac7d6ee2b26d6a164ddebb67)
repository: repo_url: https://github.com/KDE/discover
repo_name: KDE/discover
description: KDE and Plasma resources management GUI
repo_language: C++
owner: KDE
file_changes: filename: KNSResource.cpp
change_type: ModificationType.MODIFY
diff: @@ -101,7 +101,7 @@ QString KNSResource::longDescription()
     ret.remove(QRegularExpression(QStringLiteral("\\[\\/?[a-z]*\\]")));
     // Find anything that looks like a link (but which also is not some html
     // tag value or another already) and make it a link
-    static const QRegularExpression urlRegExp(QStringLiteral("(^|\\s)([-a-zA-Z0-9@:%_\\+.~#?&//=]{2,256}\\.[a-z]{2,4}\\b(\\/[-a-zA-Z0-9@:;%_\\+.~#?&//=]*)?)"), QRegularExpression::CaseInsensitiveOption);
+    static const QRegularExpression urlRegExp(QStringLiteral("(^|\\s)(http[-a-zA-Z0-9@:%_\\+.~#?&//=]{2,256}\\.[a-z]{2,4}\\b(\\/[-a-zA-Z0-9@:;%_\\+.~#?&//=]*)?)"), QRegularExpression::CaseInsensitiveOption);
     ret.replace(urlRegExp, QStringLiteral("<a href=\"\\2\">\\2</a>"));
     return ret;
 }

programming_language: C++
CVE-2023-3159 (published 2023-06-12T21:15Z)

A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.

CVSS v3 base score: 6.7, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Chengfeng Ye
author_date: 2022-04-09 13:12:41+09:00
msg: firewire: fix potential uaf in outbound_phy_packet_callback()

&e->event and e point to the same address, and &e->event could
be freed in queue_event. So there is a potential uaf issue if
we dereference e after calling queue_event(). Fix this by adding
a temporary variable to maintain e->client in advance, this can
avoid the potential uaf issue.

Cc: <stable@vger.kernel.org>
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220409041243.603210-2-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: core-cdev.c
change_type: ModificationType.MODIFY
diff: @@ -1500,6 +1500,7 @@ static void outbound_phy_packet_callback(struct fw_packet *packet,
 {
 	struct outbound_phy_packet_event *e =
 		container_of(packet, struct outbound_phy_packet_event, p);
+	struct client *e_client;
 
 	switch (status) {
 	/* expected: */
@@ -1516,9 +1517,10 @@ static void outbound_phy_packet_callback(struct fw_packet *packet,
 	}
 	e->phy_packet.data[0] = packet->timestamp;
 
+	e_client = e->client;
 	queue_event(e->client, &e->event, &e->phy_packet,
 		    sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
-	client_put(e->client);
+	client_put(e_client);
 }
 
 static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *arg)

programming_language: C