xamxte/cve-to-cwe huggingface dataset:
CVE-2024-50096: In the Linux kernel, the following vulnerability has been resolved:  nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error  The `nouveau_dmem_copy_one` function ensures that the copy push command is sent to the device firmware but does not track whether it was executed successfully.  In the case of a copy error (e.g., firmware or hardware failure), the copy push command will be sent via the firmware channel, and `nouveau_dmem_copy_one` will likely report success, leading to the `migrate_to_ram` function returning a dirty HIGH_USER page to the user.  This can result in a security vulnerability, as a HIGH_USER page that may contain sensitive or corrupted data could be returned to the user.  To prevent this vulnerability, we allocate a zero page. Thus, in case of an error, a non-dirty (zero) page will be returned to the user.
CVE-2024-50097: In the Linux kernel, the following vulnerability has been resolved:  net: fec: don't save PTP state if PTP is unsupported  Some platforms (such as i.MX25 and i.MX27) do not support PTP, so on these platforms fec_ptp_init() is not called and the related members in fep are not initialized. However, fec_ptp_save_state() is called unconditionally, which causes the kernel to panic. Therefore, add a condition so that fec_ptp_save_state() is not called if PTP is not supported.
CVE-2024-50120: In the Linux kernel, the following vulnerability has been resolved:  smb: client: Handle kstrdup failures for passwords  In smb3_reconfigure(), after duplicating ctx->password and ctx->password2 with kstrdup(), we need to check for allocation failures.  If ses->password allocation fails, return -ENOMEM. If ses->password2 allocation fails, free ses->password, set it to NULL, and return -ENOMEM.
CVE-2024-50137: In the Linux kernel, the following vulnerability has been resolved:  reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC  data->asserted will be NULL on JH7110 SoC since commit 82327b127d41 ("reset: starfive: Add StarFive JH7110 reset driver") was added. Add the judgment condition to avoid errors when calling reset_control_status on JH7110 SoC.
CVE-2024-50138: In the Linux kernel, the following vulnerability has been resolved:  bpf: Use raw_spinlock_t in ringbuf  The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is illustrated in the example below:  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556208, name: test_progs preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 1 INFO: lockdep is turned off. Preemption disabled at: [<ffffd33a5c88ea44>] migrate_enable+0xc0/0x39c CPU: 7 PID: 556208 Comm: test_progs Tainted: G Hardware name: Qualcomm SA8775P Ride (DT) Call trace:  dump_backtrace+0xac/0x130  show_stack+0x1c/0x30  dump_stack_lvl+0xac/0xe8  dump_stack+0x18/0x30  __might_resched+0x3bc/0x4fc  rt_spin_lock+0x8c/0x1a4  __bpf_ringbuf_reserve+0xc4/0x254  bpf_ringbuf_reserve_dynptr+0x5c/0xdc  bpf_prog_ac3d15160d62622a_test_read_write+0x104/0x238  trace_call_bpf+0x238/0x774  perf_call_bpf_enter.isra.0+0x104/0x194  perf_syscall_enter+0x2f8/0x510  trace_sys_enter+0x39c/0x564  syscall_trace_enter+0x220/0x3c0  do_el0_svc+0x138/0x1dc  el0_svc+0x54/0x130  el0t_64_sync_handler+0x134/0x150  el0t_64_sync+0x17c/0x180  Switch the spinlock to raw_spinlock_t to avoid this error.
CVE-2024-34673: Improper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local attackers to cause Denial-of-Service.
CVE-2024-34674: Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles.
CVE-2024-34675: Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen.
CVE-2024-34681: Improper input validation in BluetoothAdapter prior to SMR Nov-2024 Release 1 allows local attackers to cause local permanent denial of service on Galaxy Watch.
CVE-2024-34682: Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi password in Maintenance Mode.
CVE-2024-49401: Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities.
CVE-2024-49402: Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles.
CVE-2024-49403: Improper access control in Samsung Voice Recorder prior to version 21.5.40.37 allows physical attackers to access recording files on the lock screen.
CVE-2024-49404: Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows physical attackers to access video file of other users.
CVE-2024-49405: Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific scenario.
CVE-2024-49407: Improper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to access data across multiple user profiles.
CVE-2024-50139: In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: Fix shift-out-of-bounds bug  Fix a shift-out-of-bounds bug reported by UBSAN when running VM with MTE enabled host kernel.  UBSAN: shift-out-of-bounds in arch/arm64/kvm/sys_regs.c:1988:14 shift exponent 33 is too large for 32-bit type 'int' CPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm Not tainted 6.12.0-rc2 #34 Hardware name: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 10/14/2024 Call trace:  dump_backtrace+0xa0/0x128  show_stack+0x20/0x38  dump_stack_lvl+0x74/0x90  dump_stack+0x18/0x28  __ubsan_handle_shift_out_of_bounds+0xf8/0x1e0  reset_clidr+0x10c/0x1c8  kvm_reset_sys_regs+0x50/0x1c8  kvm_reset_vcpu+0xec/0x2b0  __kvm_vcpu_set_target+0x84/0x158  kvm_vcpu_set_target+0x138/0x168  kvm_arch_vcpu_ioctl_vcpu_init+0x40/0x2b0  kvm_arch_vcpu_ioctl+0x28c/0x4b8  kvm_vcpu_ioctl+0x4bc/0x7a8  __arm64_sys_ioctl+0xb4/0x100  invoke_syscall+0x70/0x100  el0_svc_common.constprop.0+0x48/0xf0  do_el0_svc+0x24/0x38  el0_svc+0x3c/0x158  el0t_64_sync_handler+0x120/0x130  el0t_64_sync+0x194/0x198
CVE-2024-50142: In the Linux kernel, the following vulnerability has been resolved:  xfrm: validate new SA's prefixlen using SA family when sel.family is unset  This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.")  syzbot created an SA with     usersa.sel.family = AF_UNSPEC     usersa.sel.prefixlen_s = 128     usersa.family = AF_INET  Because of the AF_UNSPEC selector, verify_newsa_info doesn't put limits on prefixlen_{s,d}. But then copy_from_user_state sets x->sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that's how prefixlen is going to be used later on.
CVE-2024-50144: In the Linux kernel, the following vulnerability has been resolved:  drm/xe: fix unbalanced rpm put() with fence_fini()  Currently we can call fence_fini() twice if something goes wrong when sending the GuC CT for the tlb request, since we signal the fence and return an error, leading to the caller also calling fini() on the error path in the case of stack version of the flow, which leads to an extra rpm put() which might later cause device to enter suspend when it shouldn't. It looks like we can just drop the fini() call since the fence signaller side will already call this for us.  There are known mysterious splats with device going to sleep even with an rpm ref, and this could be one candidate.  v2 (Matt B):   - Prefer warning if we detect double fini()  (cherry picked from commit cfcbc0520d5055825f0647ab922b655688605183)
CVE-2024-50157: In the Linux kernel, the following vulnerability has been resolved:  RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop  Driver waits indefinitely for the fifo occupancy to go below a threshold as soon as the pacing interrupt is received. This can cause soft lockup on one of the processors, if the rate of DB is very high.  Add a loop count for FPGA and exit the __wait_for_fifo_occupancy_below_th if the loop is taking more time. Pacing will be continuing until the occupancy is below the threshold. This is ensured by the checks in bnxt_re_pacing_timer_exp and further scheduling the work for pacing based on the fifo occupancy.
CVE-2024-50166: In the Linux kernel, the following vulnerability has been resolved:  fsl/fman: Fix refcount handling of fman-related devices  In mac_probe() there are multiple calls to of_find_device_by_node(), fman_bind() and fman_port_bind() which takes references to of_dev->dev. Not all references taken by these calls are released later on error path in mac_probe() and in mac_remove() which lead to reference leaks.  Add references release.
CVE-2024-9926: The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
CVE-2024-50187: In the Linux kernel, the following vulnerability has been resolved:  drm/vc4: Stop the active perfmon before being destroyed  Upon closing the file descriptor, the active performance monitor is not stopped. Although all perfmons are destroyed in `vc4_perfmon_close_file()`, the active performance monitor's pointer (`vc4->active_perfmon`) is still retained.  If we open a new file descriptor and submit a few jobs with performance monitors, the driver will attempt to stop the active performance monitor using the stale pointer in `vc4->active_perfmon`. However, this pointer is no longer valid because the previous process has already terminated, and all performance monitors associated with it have been destroyed and freed.  To fix this, when the active performance monitor belongs to a given process, explicitly stop it before destroying and freeing it.
CVE-2024-50188: In the Linux kernel, the following vulnerability has been resolved:  net: phy: dp83869: fix memory corruption when enabling fiber  When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure.  Since the advertising flags are updated from supported at the end of the function the incorrect line isn't needed at all and can be removed.
CVE-2024-50192: In the Linux kernel, the following vulnerability has been resolved:  irqchip/gic-v4: Don't allow a VMOVP on a dying VPE  Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has already been unmapped, but the corresponding doorbell interrupt still visible in /proc/irq/.  Plug the race by checking the value of vmapp_count, which tracks whether the VPE is mapped ot not, and returning an error in this case.  This involves making vmapp_count common to both GICv4.1 and its v4.0 ancestor.
CVE-2024-50209: In the Linux kernel, the following vulnerability has been resolved:  RDMA/bnxt_re: Add a check for memory allocation  __alloc_pbl() can return error when memory allocation fails. Driver is not checking the status on one of the instances.
CVE-2024-40239: An incorrect access control issue in Life: Personal Diary, Journal android app 17.5.0 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function.
CVE-2024-50249: In the Linux kernel, the following vulnerability has been resolved:  ACPI: CPPC: Make rmw_lock a raw_spin_lock  The following BUG was triggered:  ============================= [ BUG: Invalid wait context ] 6.12.0-rc2-XXX #406 Not tainted ----------------------------- kworker/1:1/62 is trying to lock: ffffff8801593030 (&cpc_ptr->rmw_lock){+.+.}-{3:3}, at: cpc_write+0xcc/0x370 other info that might help us debug this: context-{5:5} 2 locks held by kworker/1:1/62:   #0: ffffff897ef5ec98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x50   #1: ffffff880154e238 (&sg_policy->update_lock){....}-{2:2}, at: sugov_update_shared+0x3c/0x280 stack backtrace: CPU: 1 UID: 0 PID: 62 Comm: kworker/1:1 Not tainted 6.12.0-rc2-g9654bd3e8806 #406 Workqueue:  0x0 (events) Call trace:   dump_backtrace+0xa4/0x130   show_stack+0x20/0x38   dump_stack_lvl+0x90/0xd0   dump_stack+0x18/0x28   __lock_acquire+0x480/0x1ad8   lock_acquire+0x114/0x310   _raw_spin_lock+0x50/0x70   cpc_write+0xcc/0x370   cppc_set_perf+0xa0/0x3a8   cppc_cpufreq_fast_switch+0x40/0xc0   cpufreq_driver_fast_switch+0x4c/0x218   sugov_update_shared+0x234/0x280   update_load_avg+0x6ec/0x7b8   dequeue_entities+0x108/0x830   dequeue_task_fair+0x58/0x408   __schedule+0x4f0/0x1070   schedule+0x54/0x130   worker_thread+0xc0/0x2e8   kthread+0x130/0x148   ret_from_fork+0x10/0x20  sugov_update_shared() locks a raw_spinlock while cpc_write() locks a spinlock.  To have a correct wait-type order, update rmw_lock to a raw spinlock and ensure that interrupts will be disabled on the CPU holding it.  [ rjw: Changelog edits ]
CVE-2024-50251: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_payload: sanitize offset and length before calling skb_checksum()  If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON().  skb_checksum() internally subtracts the length parameter while iterating over skbuff, BUG_ON(len) at the end of it checks that the expected length to be included in the checksum calculation is fully consumed.
CVE-2024-50253: In the Linux kernel, the following vulnerability has been resolved:  bpf: Check the validity of nr_words in bpf_iter_bits_new()  Check the validity of nr_words in bpf_iter_bits_new(). Without this check, when multiplication overflow occurs for nr_bits (e.g., when nr_words = 0x0400-0001, nr_bits becomes 64), stack corruption may occur due to bpf_probe_read_kernel_common(..., nr_bytes = 0x2000-0008).  Fix it by limiting the maximum value of nr_words to 511. The value is derived from the current implementation of BPF memory allocator. To ensure compatibility if the BPF memory allocator's size limitation changes in the future, use the helper bpf_mem_alloc_check_size() to check whether nr_bytes is too larger. And return -E2BIG instead of -ENOMEM for oversized nr_bytes.
CVE-2023-35686: In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-31337: In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-40407: A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vectors.
CVE-2023-34049: The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.
CVE-2024-50968: A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker can exploit a flaw in the application's total price calculation logic. This vulnerability causes the total price to be reduced to zero, allowing the attacker to add items to the cart and proceed to checkout.
CVE-2024-9529: The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
CVE-2024-52872: In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions.
CVE-2024-50275: In the Linux kernel, the following vulnerability has been resolved:  arm64/sve: Discard stale CPU state when handling SVE traps  The logic for handling SVE traps manipulates saved FPSIMD/SVE state incorrectly, and a race with preemption can result in a task having TIF_SVE set and TIF_FOREIGN_FPSTATE clear even though the live CPU state is stale (e.g. with SVE traps enabled). This has been observed to result in warnings from do_sve_acc() where SVE traps are not expected while TIF_SVE is set:  |         if (test_and_set_thread_flag(TIF_SVE)) |                 WARN_ON(1); /* SVE access shouldn't have trapped */  Warnings of this form have been reported intermittently, e.g.    https://lore.kernel.org/linux-arm-kernel/CA+G9fYtEGe_DhY2Ms7+L7NKsLYUomGsgqpdBj+QwDLeSg=JhGg@mail.gmail.com/   https://lore.kernel.org/linux-arm-kernel/000000000000511e9a060ce5a45c@google.com/  The race can occur when the SVE trap handler is preempted before and after manipulating the saved FPSIMD/SVE state, starting and ending on the same CPU, e.g.  | void do_sve_acc(unsigned long esr, struct pt_regs *regs) | { |         // Trap on CPU 0 with TIF_SVE clear, SVE traps enabled |         // task->fpsimd_cpu is 0. |         // per_cpu_ptr(&fpsimd_last_state, 0) is task. | |         ... | |         // Preempted; migrated from CPU 0 to CPU 1. |         // TIF_FOREIGN_FPSTATE is set. | |         get_cpu_fpsimd_context(); | |         if (test_and_set_thread_flag(TIF_SVE)) |                 WARN_ON(1); /* SVE access shouldn't have trapped */ | |         sve_init_regs() { |                 if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) { |                         ... |                 } else { |                         fpsimd_to_sve(current); |                         current->thread.fp_type = FP_STATE_SVE; |                 } |         } | |         put_cpu_fpsimd_context(); | |         // Preempted; migrated from CPU 1 to CPU 0. |         // task->fpsimd_cpu is still 0 |         // If per_cpu_ptr(&fpsimd_last_state, 0) is still task then: |         // - Stale HW state is reused (with SVE traps enabled) |         // - TIF_FOREIGN_FPSTATE is cleared |         // - A return to userspace skips HW state restore | }  Fix the case where the state is not live and TIF_FOREIGN_FPSTATE is set by calling fpsimd_flush_task_state() to detach from the saved CPU state. This ensures that a subsequent context switch will not reuse the stale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the new state to be reloaded from memory prior to a return to userspace.
CVE-2024-53051: In the Linux kernel, the following vulnerability has been resolved:  drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability  Sometimes during hotplug scenario or suspend/resume scenario encoder is not always initialized when intel_hdcp_get_capability add a check to avoid kernel null pointer dereference.
CVE-2024-53078: In the Linux kernel, the following vulnerability has been resolved:  drm/tegra: Fix NULL vs IS_ERR() check in probe()  The iommu_paging_domain_alloc() function doesn't  return NULL pointers, it returns error pointers.  Update the check to match.
CVE-2018-9440: In parse of M3UParser.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2024-45691: A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values.
CVE-2018-9468: In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass. This could lead to local information disclosure and file rewriting with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-49203: Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.
CVE-2024-53091: In the Linux kernel, the following vulnerability has been resolved:  bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx  As the introduction of the support for vsock and unix sockets in sockmap, tls_sw_has_ctx_tx/rx cannot presume the socket passed in must be IS_ICSK. vsock and af_unix sockets have vsock_sock and unix_sock instead of inet_connection_sock. For these sockets, tls_get_ctx may return an invalid pointer and cause page fault in function tls_sw_ctx_rx.  BUG: unable to handle page fault for address: 0000000000040030 Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:sk_psock_strp_data_ready+0x23/0x60 Call Trace:  ? __die+0x81/0xc3  ? no_context+0x194/0x350  ? do_page_fault+0x30/0x110  ? async_page_fault+0x3e/0x50  ? sk_psock_strp_data_ready+0x23/0x60  virtio_transport_recv_pkt+0x750/0x800  ? update_load_avg+0x7e/0x620  vsock_loopback_work+0xd0/0x100  process_one_work+0x1a7/0x360  worker_thread+0x30/0x390  ? create_worker+0x1a0/0x1a0  kthread+0x112/0x130  ? __kthread_cancel_work+0x40/0x40  ret_from_fork+0x1f/0x40  v2:   - Add IS_ICSK check v3:   - Update the commits in Fixes
CVE-2024-9422: The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.
CVE-2024-53975: Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appear secure. This vulnerability affects Firefox for iOS < 133.
CVE-2024-52781: DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/system/tool/traceroute.php.
CVE-2024-53109: In the Linux kernel, the following vulnerability has been resolved:  nommu: pass NULL argument to vma_iter_prealloc()  When deleting a vma entry from a maple tree, it has to pass NULL to vma_iter_prealloc() in order to calculate internal state of the tree, but it passed a wrong argument.  As a result, nommu kernels crashed upon accessing a vma iterator, such as acct_collect() reading the size of vma entries after do_munmap().  This commit fixes this issue by passing a right argument to the preallocation call.
CVE-2024-53110: In the Linux kernel, the following vulnerability has been resolved:  vp_vdpa: fix id_table array not null terminated error  Allocate one extra virtio_device_id as null terminator, otherwise vdpa_mgmtdev_get_classes() may iterate multiple times and visit undefined memory.
CVE-2024-49412: Improper input validation in Settings prior to SMR Dec-2024 Release 1 allows local attackers to broadcast signal for discovering Bluetooth on Galaxy Watch.
CVE-2024-49419: Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers to load an arbitrary URL in its webview.
CVE-2024-55560: MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installation.