yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-52519: In the Linux kernel, the following vulnerability has been resolved:HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bitThe EHL (Elkhart Lake) based platforms provide a OOB (Out of band)service, which allows to wakup device when the system is in S5 (Soft-Offstate). This OOB service can be enabled/disabled from BIOS settings. Whenenabled, the ISH device gets PME wake capability. To enable PME wakeup,driver also needs to enable ACPI GPE bit.On resume, BIOS will clear the wakeup bit. So driver need to re-enable itin resume function to keep the next wakeup capability. But this BIOSclearing of wakeup bit doesn't decrement internal OS GPE reference count,so this reenabling on every resume will cause reference count to overflow.So first disable and reenable ACPI GPE bit using acpi_disable_gpe().
Key phrases: wakup device when the system is in S5
CVE-2023-5252: The FareHarbor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-52520: In the Linux kernel, the following vulnerability has been resolved:platform/x86: think-lmi: Fix reference leakIf a duplicate attribute is found using kset_find_obj(), a referenceto that attribute is returned which needs to be disposed accordinglyusing kobject_put(). Move the setting name validation into a separatefunction to allow for this change without having to duplicate thecleanup code for this setting.As a side note, a very similar bug was fixed incommit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"),so it seems that the bug was copied from that driver.Compile-tested only.
Key phrases: duplicate thecleanup code for this setting, reference leakif
CVE-2023-52522: In the Linux kernel, the following vulnerability has been resolved:net: fix possible store tearing in neigh_periodic_work()While looking at a related syzbot report involving neigh_periodic_work(),I found that I forgot to add an annotation when deleting anRCU protected item from a list.Readers use rcu_deference(*np), we need to use eitherrcu_assign_pointer() or WRITE_ONCE() on writer sideto prevent store tearing.I use rcu_assign_pointer() to have lockdep support,this was the choice made in neigh_flush_dev().
Key phrases: store tearing
CVE-2023-52523: In the Linux kernel, the following vulnerability has been resolved:bpf, sockmap: Reject sk_msg egress redirects to non-TCP socketsWith a SOCKMAP/SOCKHASH map and an sk_msg program user can steer messagessent from one TCP socket (s1) to actually egress from another TCPsocket (s2):tcp_bpf_sendmsg(s1)		// = sk_prot->sendmsg  tcp_bpf_send_verdict(s1)	// __SK_REDIRECT case    tcp_bpf_sendmsg_redir(s2)      tcp_bpf_push_locked(s2)	tcp_bpf_push(s2)	  tcp_rate_check_app_limited(s2) // expects tcp_sock	  tcp_sendmsg_locked(s2)	 // dittoThere is a hard-coded assumption in the call-chain, that the egresssocket (s2) is a TCP socket.However in commit 122e6c79efe1 ("sock_map: Update sock type checks forUDP") we have enabled redirects to non-TCP sockets. This was done for thesake of BPF sk_skb programs. There was no indention to support sk_msgsend-to-egress use case.As a result, attempts to send-to-egress through a non-TCP socket lead to acrash due to invalid downcast from sock to tcp_sock: BUG: kernel NULL pointer dereference, address: 000000000000002f ... Call Trace:  <TASK>  ? show_regs+0x60/0x70  ? __die+0x1f/0x70  ? page_fault_oops+0x80/0x160  ? do_user_addr_fault+0x2d7/0x800  ? rcu_is_watching+0x11/0x50  ? exc_page_fault+0x70/0x1c0  ? asm_exc_page_fault+0x27/0x30  ? tcp_tso_segs+0x14/0xa0  tcp_write_xmit+0x67/0xce0  __tcp_push_pending_frames+0x32/0xf0  tcp_push+0x107/0x140  tcp_sendmsg_locked+0x99f/0xbb0  tcp_bpf_push+0x19d/0x3a0  tcp_bpf_sendmsg_redir+0x55/0xd0  tcp_bpf_send_verdict+0x407/0x550  tcp_bpf_sendmsg+0x1a1/0x390  inet_sendmsg+0x6a/0x70  sock_sendmsg+0x9d/0xc0  ? sockfd_lookup_light+0x12/0x80  __sys_sendto+0x10e/0x160  ? syscall_enter_from_user_mode+0x20/0x60  ? __this_cpu_preempt_check+0x13/0x20  ? lockdep_hardirqs_on+0x82/0x110  __x64_sys_sendto+0x1f/0x30  do_syscall_64+0x38/0x90  entry_SYSCALL_64_after_hwframe+0x63/0xcdReject selecting a non-TCP sockets as redirect target from a BPF sk_msgprogram to prevent the crash. When attempted, user will receive an EACCESerror from send/sendto/sendmsg() syscall.
Key phrases: crash
CVE-2023-52524: In the Linux kernel, the following vulnerability has been resolved:net: nfc: llcp: Add lock when modifying device listThe device list needs its associated lock held when modifying it, or thelist could become corrupted, as syzbot discovered.
Key phrases: corrupted
CVE-2023-52525: In the Linux kernel, the following vulnerability has been resolved:wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packetOnly skip the code path trying to access the rfc1042 headers when thebuffer is too small, so the driver can still process packets withoutrfc1042 headers.
Key phrases: oob check condition
CVE-2023-52526: In the Linux kernel, the following vulnerability has been resolved:erofs: fix memory leak of LZMA global compressed deduplicationWhen stressing microLZMA EROFS images with the new global compresseddeduplication feature enabled (`-Ededupe`), I found some short-livedtemporary pages weren't properly released, which could slowly causeunexpected OOMs hours later.Let's fix it now (LZ4 and DEFLATE don't have this issue.)
Key phrases: memory leak, ooms
CVE-2023-52527: In the Linux kernel, the following vulnerability has been resolved:ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()Including the transhdrlen in length is a problem when the packet ispartially filled (e.g. something like send(MSG_MORE) happened previously)when appending to an IPv4 or IPv6 packet as we don't want to repeat thetransport header or account for it twice.  This can happen under somecircumstances, such as splicing into an L2TP socket.The symptom observed is a warning in __ip6_append_data():    WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800 __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800that occurs when MSG_SPLICE_PAGES is used to append more data to an alreadypartially occupied skbuff.  The warning occurs when 'copy' is larger thanthe amount of data in the message iterator.  This is because the requestedlength includes the transport header length when it shouldn't.  This can betriggered by, for example:        sfd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP);        bind(sfd, ...); // ::1        connect(sfd, ...); // ::1 port 7        send(sfd, buffer, 4100, MSG_MORE);        sendfile(sfd, dfd, NULL, 1024);Fix this by only adding transhdrlen into the length if the write queue isempty in l2tp_ip6_sendmsg(), analogously to how UDP does things.l2tp_ip_sendmsg() looks like it won't suffer from this problem as it buildsthe UDP packet itself.
CVE-2023-52529: In the Linux kernel, the following vulnerability has been resolved:HID: sony: Fix a potential memory leak in sony_probe()If an error occurs after a successful usb_alloc_urb() call, usb_free_urb()should be called.
Key phrases: memory leak
CVE-2023-5253: A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication.Malicious unauthenticated users with knowledge on the underlying system may be able to extract asset information.
Key phrases: obtain assets data, obtain assets data without authentication, authentication check, missing authentication
CVE-2023-52530: In the Linux kernel, the following vulnerability has been resolved:wifi: mac80211: fix potential key use-after-freeWhen ieee80211_key_link() is called by ieee80211_gtk_rekey_add()but returns 0 due to KRACK protection (identical key reinstall),ieee80211_gtk_rekey_add() will still return a pointer into thekey, in a potential use-after-free. This normally doesn't happensince it's only called by iwlwifi in case of WoWLAN rekey offloadwhich has its own KRACK protection, but still better to fix, dothat by returning an error code and converting that to success onthe cfg80211 boundary only, leaving the error for bad callers ofieee80211_gtk_rekey_add().
Key phrases: key use-after-freewhen, use after free
CVE-2023-52531: In the Linux kernel, the following vulnerability has been resolved:wifi: iwlwifi: mvm: Fix a memory corruption issueA few lines above, space is kzalloc()'ed for:	sizeof(struct iwl_nvm_data) +	sizeof(struct ieee80211_channel) +	sizeof(struct ieee80211_rate)'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine.At the end of this structure, there is the 'channels' flex array.Each element is of type 'struct ieee80211_channel'.So only 1 element is allocated in this array.When doing:  mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels;We point at the first element of the 'channels' flex array.So this is fine.However, when doing:  mvm->nvm_data->bands[0].bitrates =			(void *)((u8 *)mvm->nvm_data->channels + 1);because of the "(u8 *)" cast, we add only 1 to the address of the beginningof the flex array.It is likely that we want point at the 'struct ieee80211_rate' allocatedjust after.Remove the spurious casting so that the pointer arithmetic works asexpected.
Key phrases: memory corruption issuea
CVE-2023-52532: In the Linux kernel, the following vulnerability has been resolved:net: mana: Fix TX CQE error handlingFor an unknown TX CQE error type (probably from a newer hardware),still free the SKB, update the queue tail, etc., otherwise theaccounting will be wrong.Also, TX errors can be triggered by injecting corrupted packets, soreplace the WARN_ONCE to ratelimited error logging.
Key phrases: corrupted packets
CVE-2023-5254: The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chatbot_check_user function. This can allow unauthenticated attackers to extract sensitive data including confirmation as to whether a user name exists on the site as well as order information for existing users.
Key phrases: extract sensitive data including confirmation as to whether, sensitive information exposure
CVE-2023-5255: For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. 
Key phrases: revoked
CVE-2023-52555: In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
Key phrases: CSRF, csrf, deletion of a collection
CVE-2023-52556: In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic.
Key phrases: race condition
CVE-2023-52557: In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.
Key phrases: crash
CVE-2023-52558: In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, anetwork buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences.
Key phrases: crash
CVE-2023-52559: In the Linux kernel, the following vulnerability has been resolved:iommu/vt-d: Avoid memory allocation in iommu_suspend()The iommu_suspend() syscore suspend callback is invoked with IRQ disabled.Allocating memory with the GFP_KERNEL flag may re-enable IRQs duringthe suspend callback, which can cause intermittent suspend/hibernationproblems with the following kernel traces:Calling iommu_suspend+0x0/0x1d0------------[ cut here ]------------WARNING: CPU: 0 PID: 15 at kernel/time/timekeeping.c:868 ktime_get+0x9b/0xb0...CPU: 0 PID: 15 Comm: rcu_preempt Tainted: G     U      E      6.3-intel #r1RIP: 0010:ktime_get+0x9b/0xb0...Call Trace: <IRQ> tick_sched_timer+0x22/0x90 ? __pfx_tick_sched_timer+0x10/0x10 __hrtimer_run_queues+0x111/0x2b0 hrtimer_interrupt+0xfa/0x230 __sysvec_apic_timer_interrupt+0x63/0x140 sysvec_apic_timer_interrupt+0x7b/0xa0 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1f/0x30...------------[ cut here ]------------Interrupts enabled after iommu_suspend+0x0/0x1d0WARNING: CPU: 0 PID: 27420 at drivers/base/syscore.c:68 syscore_suspend+0x147/0x270CPU: 0 PID: 27420 Comm: rtcwake Tainted: G     U  W   E      6.3-intel #r1RIP: 0010:syscore_suspend+0x147/0x270...Call Trace: <TASK> hibernation_snapshot+0x25b/0x670 hibernate+0xcd/0x390 state_store+0xcf/0xe0 kobj_attr_store+0x13/0x30 sysfs_kf_write+0x3f/0x50 kernfs_fop_write_iter+0x128/0x200 vfs_write+0x1fd/0x3c0 ksys_write+0x6f/0xf0 __x64_sys_write+0x1d/0x30 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdcGiven that only 4 words memory is needed, avoid the memory allocation iniommu_suspend().
CVE-2023-5256: In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.The core REST and contributed GraphQL modules are not affected.
Key phrases: error backtraces, privilege escalation, sensitive information
CVE-2023-52561: In the Linux kernel, the following vulnerability has been resolved:arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reservedAdding a reserved memory region for the framebuffer memory(the splash memory region set up by the bootloader).It fixes a kernel panic (arm-smmu: Unhandled context faultat this particular memory region) reported on DB845c runningv5.10.y.
CVE-2023-52562: In the Linux kernel, the following vulnerability has been resolved:mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()After the commit in Fixes:, if a module that created a slab cache does notrelease all of its allocated objects before destroying the cache (at rmmodtime), we might end up releasing the kmem_cache object without removing itfrom the slab_caches list thus corrupting the list as kmem_cache_destroy()ignores the return value from shutdown_cache(), which in turn never removesthe kmem_cache object from slabs_list in case __kmem_cache_shutdown() failsto release all of the cache's slabs.This is easily observable on a kernel built with CONFIG_DEBUG_LIST=yas after that ill release the system will immediately trip on list_add,or list_del, assertions similar to the one shown below as soon as anotherkmem_cache gets created, or destroyed:  [ 1041.213632] list_del corruption. next->prev should be ffff89f596fb5768, but was 52f1e5016aeee75d. (next=ffff89f595a1b268)  [ 1041.219165] ------------[ cut here ]------------  [ 1041.221517] kernel BUG at lib/list_debug.c:62!  [ 1041.223452] invalid opcode: 0000 [#1] PREEMPT SMP PTI  [ 1041.225408] CPU: 2 PID: 1852 Comm: rmmod Kdump: loaded Tainted: G    B   W  OE      6.5.0 #15  [ 1041.228244] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc37 05/24/2023  [ 1041.231212] RIP: 0010:__list_del_entry_valid+0xae/0xb0Another quick way to trigger this issue, in a kernel with CONFIG_SLUB=y,is to set slub_debug to poison the released objects and then just runcat /proc/slabinfo after removing the module that leaks slab objects,in which case the kernel will panic:  [   50.954843] general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 [#1] PREEMPT SMP PTI  [   50.961545] CPU: 2 PID: 1495 Comm: cat Kdump: loaded Tainted: G    B   W  OE      6.5.0 #15  [   50.966808] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc37 05/24/2023  [   50.972663] RIP: 0010:get_slabinfo+0x42/0xf0This patch fixes this issue by properly checking shutdown_cache()'sreturn value before taking the kmem_cache_release() branch.
CVE-2023-52563: In the Linux kernel, the following vulnerability has been resolved:drm/meson: fix memory leak on ->hpd_notify callbackThe EDID returned by drm_bridge_get_edid() needs to be freed.
Key phrases: memory leak
CVE-2023-52564: In the Linux kernel, the following vulnerability has been resolved:Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239.The commit above is reverted as it did not solve the original issue.gsm_cleanup_mux() tries to free up the virtual ttys by callinggsm_dlci_release() for each available DLCI. There, dlci_put() is called todecrease the reference counter for the DLCI via tty_port_put() whichfinally calls gsm_dlci_free(). This already clears the pointer which isbeing checked in gsm_cleanup_mux() before calling gsm_dlci_release().Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux()as done in the reverted commit. The commit introduces a null pointerdereference: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x156/0x420 ? search_exception_tables+0x37/0x50 ? fixup_exception+0x21/0x310 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? tty_port_put+0x19/0xa0 gsmtty_cleanup+0x29/0x80 [n_gsm] release_one_tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>The actual issue is that nothing guards dlci_put() from being calledmultiple times while the tty driver was triggered but did not yet finishedcalling gsm_dlci_free().
Key phrases: uaf
CVE-2023-52565: In the Linux kernel, the following vulnerability has been resolved:media: uvcvideo: Fix OOB readIf the index provided by the user is bigger than the mask size, we might doan out of bound read.
Key phrases: oob readif, out of bound read
CVE-2023-52566: In the Linux kernel, the following vulnerability has been resolved:nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop thereference count of bh when the call to nilfs_dat_translate() fails.  Ifthe reference count hits 0 and its owner page gets unlocked, bh may befreed.  However, bh->b_page is dereferenced to put the page after that,which may result in a use-after-free bug.  This patch moves the releaseoperation after unlocking and putting the page.NOTE: The function in question is only called in GC, and in combinationwith current userland tools, address translation using DAT does not occurin that function, so the code path that causes this issue will not beexecuted.  However, it is possible to run that code path by intentionallymodifying the userland GC library or by calling the GC ioctl directly.[konishi.ryusuke@gmail.com: NOTE added to the commit log]
Key phrases: use after free, use-after-free bug
CVE-2023-52567: In the Linux kernel, the following vulnerability has been resolved:serial: 8250_port: Check IRQ data before useIn case the leaf driver wants to use IRQ polling (irq = 0) andIIR register shows that an interrupt happened in the 8250 hardwarethe IRQ data can be NULL. In such a case we need to skip the wakeevent as we came to this path from the timer interrupt and quitelikely system is already awake.Without this fix we have got an Oops:    serial8250: ttyS0 at I/O 0x3f8 (irq = 0, base_baud = 115200) is a 16550A    ...    BUG: kernel NULL pointer dereference, address: 0000000000000010    RIP: 0010:serial8250_handle_irq+0x7c/0x240    Call Trace:     ? serial8250_handle_irq+0x7c/0x240     ? __pfx_serial8250_timeout+0x10/0x10
CVE-2023-52568: In the Linux kernel, the following vulnerability has been resolved:x86/sgx: Resolves SECS reclaim vs. page fault for EAUG raceThe SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for anenclave and set secs.epc_page to NULL. The SECS page is used for EAUGand ELDU in the SGX page fault handler. However, the NULL check forsecs.epc_page is only done for ELDU, not EAUG before being used.Fix this by doing the same NULL check and reloading of the SECS page asneeded for both EAUG and ELDU.The SECS page holds global enclave metadata. It can only be reclaimedwhen there are no other enclave pages remaining. At that point,virtually nothing can be done with the enclave until the SECS page ispaged back in.An enclave can not run nor generate page faults without a resident SECSpage. But it is still possible for a #PF for a non-SECS page to racewith paging out the SECS page: when the last resident non-SECS page Atriggers a #PF in a non-resident page B, and then page A and the SECSboth are paged out before the #PF on B is handled.Hitting this bug requires that race triggered with a #PF for EAUG.Following is a trace when it happens.BUG: kernel NULL pointer dereference, address: 0000000000000000RIP: 0010:sgx_encl_eaug_page+0xc7/0x210Call Trace: ? __kmem_cache_alloc_node+0x16a/0x440 ? xa_load+0x6e/0xa0 sgx_vma_fault+0x119/0x230 __do_fault+0x36/0x140 do_fault+0x12f/0x400 __handle_mm_fault+0x728/0x1110 handle_mm_fault+0x105/0x310 do_user_addr_fault+0x1ee/0x750 ? __this_cpu_preempt_check+0x13/0x20 exc_page_fault+0x76/0x180 asm_exc_page_fault+0x27/0x30
CVE-2023-52569: In the Linux kernel, the following vulnerability has been resolved:btrfs: remove BUG() after failure to insert delayed dir index itemInstead of calling BUG() when we fail to insert a delayed dir index iteminto the delayed node's tree, we can just release all the resources wehave allocated/acquired before and return the error to the caller. This isfine because all existing call chains undo anything they have done beforecalling btrfs_insert_delayed_dir_index() or BUG_ON (when creating pendingsnapshots in the transaction commit path).So remove the BUG() call and do proper error handling.This relates to a syzbot report linked below, but does not fix it becauseit only prevents hitting a BUG(), it does not fix the issue where somehowwe attempt to use twice the same index number for different index items.
CVE-2023-5257: A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest of the file src/main/java/com/feihong/ldap/HTTPServer.java. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. VDB-240866 is the identifier assigned to this vulnerability.
Key phrases: path traversal
CVE-2023-52571: In the Linux kernel, the following vulnerability has been resolved:power: supply: rk817: Fix node refcount leakDan Carpenter reports that the Smatch static checker warning has foundthat there is another refcount leak in the probe function. Whileof_node_put() was added in one of the return paths, it should infact be added for ALL return paths that return an error and at driverremoval time.
Key phrases: node refcount leakdan
CVE-2023-52572: In the Linux kernel, the following vulnerability has been resolved:cifs: Fix UAF in cifs_demultiplex_thread()There is a UAF when xfstests on cifs:  BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160  Read of size 4 at addr ffff88810103fc08 by task cifsd/923  CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45  ...  Call Trace:   <TASK>   dump_stack_lvl+0x34/0x44   print_report+0x171/0x472   kasan_report+0xad/0x130   kasan_check_range+0x145/0x1a0   smb2_is_network_name_deleted+0x27/0x160   cifs_demultiplex_thread.cold+0x172/0x5a4   kthread+0x165/0x1a0   ret_from_fork+0x1f/0x30   </TASK>  Allocated by task 923:   kasan_save_stack+0x1e/0x40   kasan_set_track+0x21/0x30   __kasan_slab_alloc+0x54/0x60   kmem_cache_alloc+0x147/0x320   mempool_alloc+0xe1/0x260   cifs_small_buf_get+0x24/0x60   allocate_buffers+0xa1/0x1c0   cifs_demultiplex_thread+0x199/0x10d0   kthread+0x165/0x1a0   ret_from_fork+0x1f/0x30  Freed by task 921:   kasan_save_stack+0x1e/0x40   kasan_set_track+0x21/0x30   kasan_save_free_info+0x2a/0x40   ____kasan_slab_free+0x143/0x1b0   kmem_cache_free+0xe3/0x4d0   cifs_small_buf_release+0x29/0x90   SMB2_negotiate+0x8b7/0x1c60   smb2_negotiate+0x51/0x70   cifs_negotiate_protocol+0xf0/0x160   cifs_get_smb_ses+0x5fa/0x13c0   mount_get_conns+0x7a/0x750   cifs_mount+0x103/0xd00   cifs_smb3_do_mount+0x1dd/0xcb0   smb3_get_tree+0x1d5/0x300   vfs_get_tree+0x41/0xf0   path_mount+0x9b3/0xdd0   __x64_sys_mount+0x190/0x1d0   do_syscall_64+0x35/0x80   entry_SYSCALL_64_after_hwframe+0x46/0xb0The UAF is because: mount(pid: 921)               | cifsd(pid: 923)-------------------------------|-------------------------------                               | cifs_demultiplex_threadSMB2_negotiate                 | cifs_send_recv                |  compound_send_recv           |   smb_send_rqst               |    wait_for_response          |     wait_event_state      [1] |                               |  standard_receive3                               |   cifs_handle_standard                               |    handle_mid                               |     mid->resp_buf = buf;  [2]                               |     dequeue_mid           [3]     KILL the process      [4] |    resp_iov[i].iov_base = buf | free_rsp_buf              [5] |                               |   is_network_name_deleted [6]                               |   callback1. After send request to server, wait the response until    mid->mid_state != SUBMITTED;2. Receive response from server, and set it to mid;3. Set the mid state to RECEIVED;4. Kill the process, the mid state already RECEIVED, get 0;5. Handle and release the negotiate response;6. UAF.It can be easily reproduce with add some delay in [3] - [6].Only sync call has the problem since async call's callback isexecuted in cifsd process.Add an extra state to mark the mid state to READY before wakeup thewaitter, then it can get the resp safely.
Key phrases: use after free
CVE-2023-52573: In the Linux kernel, the following vulnerability has been resolved:net: rds: Fix possible NULL-pointer dereferenceIn rds_rdma_cm_event_handler_cmn() check, if conn pointer existsbefore dereferencing it as rdma_set_service_type() argumentFound by Linux Verification Center (linuxtesting.org) with SVACE.
Key phrases: null-pointer dereferencein
CVE-2023-52574: In the Linux kernel, the following vulnerability has been resolved:team: fix null-ptr-deref when team device type is changedGet a null-ptr-deref bug as follows with reproducer [1].BUG: kernel NULL pointer dereference, address: 0000000000000228...RIP: 0010:vlan_dev_hard_header+0x35/0x140 [8021q]...Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x150 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? vlan_dev_hard_header+0x35/0x140 [8021q] ? vlan_dev_hard_header+0x8e/0x140 [8021q] neigh_connected_output+0xb2/0x100 ip6_finish_output2+0x1cb/0x520 ? nf_hook_slow+0x43/0xc0 ? ip6_mtu+0x46/0x80 ip6_finish_output+0x2a/0xb0 mld_sendpack+0x18f/0x250 mld_ifc_work+0x39/0x160 process_one_work+0x1e6/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30[1]$ teamd -t team0 -d -c '{"runner": {"name": "loadbalance"}}'$ ip link add name t-dummy type dummy$ ip link add link t-dummy name t-dummy.100 type vlan id 100$ ip link add name t-nlmon type nlmon$ ip link set t-nlmon master team0$ ip link set t-nlmon nomaster$ ip link set t-dummy up$ ip link set team0 up$ ip link set t-dummy.100 down$ ip link set t-dummy.100 master team0When enslave a vlan device to team device and team device type is changedfrom non-ether to ether, header_ops of team device is changed tovlan_header_ops. That is incorrect and will trigger null-ptr-dereffor vlan->real_dev in vlan_dev_hard_header() because team device is nota vlan device.Cache eth_header_ops in team_setup(), then assign cached header_ops toheader_ops of team net device when its type is changed from non-etherto ether to fix the bug.
Key phrases: null-ptr-deref
CVE-2023-52575: In the Linux kernel, the following vulnerability has been resolved:x86/srso: Fix SBPB enablement for spec_rstack_overflow=offIf the user has requested no SRSO mitigation, other mitigations can usethe lighter-weight SBPB instead of IBPB.
Key phrases: spec_rstack_overflow
CVE-2023-52576: In the Linux kernel, the following vulnerability has been resolved:x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()The code calling ima_free_kexec_buffer() runs long after the memblockallocator has already been torn down, potentially resulting in a useafter free in memblock_isolate_range().With KASAN or KFENCE, this use after free will result in a BUGfrom the idle task, and a subsequent kernel panic.Switch ima_free_kexec_buffer() over to memblock_free_late() to avoidthat bug.
Key phrases: mm, useafter free, use after free
CVE-2023-52577: In the Linux kernel, the following vulnerability has been resolved:dccp: fix dccp_v4_err()/dccp_v6_err() againdh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr",not in the "byte 7" as Jann claimed.We need to make sure the ICMP messages are big enough,using more standard ways (no more assumptions).syzbot reported:BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline]BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline]BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94pskb_may_pull_reason include/linux/skbuff.h:2667 [inline]pskb_may_pull include/linux/skbuff.h:2681 [inline]dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867icmpv6_rcv+0x19d5/0x30d0ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438ip6_input_finish net/ipv6/ip6_input.c:483 [inline]NF_HOOK include/linux/netfilter.h:304 [inline]ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586dst_input include/net/dst.h:468 [inline]ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79NF_HOOK include/linux/netfilter.h:304 [inline]ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310__netif_receive_skb_one_core net/core/dev.c:5523 [inline]__netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637netif_receive_skb_internal net/core/dev.c:5723 [inline]netif_receive_skb+0x58/0x660 net/core/dev.c:5782tun_rx_batched+0x83b/0x920tun_get_user+0x564c/0x6940 drivers/net/tun.c:2002tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048call_write_iter include/linux/fs.h:1985 [inline]new_sync_write fs/read_write.c:491 [inline]vfs_write+0x8ef/0x15c0 fs/read_write.c:584ksys_write+0x20f/0x4c0 fs/read_write.c:637__do_sys_write fs/read_write.c:649 [inline]__se_sys_write fs/read_write.c:646 [inline]__x64_sys_write+0x93/0xd0 fs/read_write.c:646do_syscall_x64 arch/x86/entry/common.c:50 [inline]do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80entry_SYSCALL_64_after_hwframe+0x63/0xcdUninit was created at:slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767slab_alloc_node mm/slub.c:3478 [inline]kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559__alloc_skb+0x318/0x740 net/core/skbuff.c:650alloc_skb include/linux/skbuff.h:1286 [inline]alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6313sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2795tun_alloc_skb drivers/net/tun.c:1531 [inline]tun_get_user+0x23cf/0x6940 drivers/net/tun.c:1846tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048call_write_iter include/linux/fs.h:1985 [inline]new_sync_write fs/read_write.c:491 [inline]vfs_write+0x8ef/0x15c0 fs/read_write.c:584ksys_write+0x20f/0x4c0 fs/read_write.c:637__do_sys_write fs/read_write.c:649 [inline]__se_sys_write fs/read_write.c:646 [inline]__x64_sys_write+0x93/0xd0 fs/read_write.c:646do_syscall_x64 arch/x86/entry/common.c:50 [inline]do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80entry_SYSCALL_64_after_hwframe+0x63/0xcdCPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
CVE-2023-5258: A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /resource/addgood.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240867.
Key phrases: sql injection
CVE-2023-52581: In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: fix memleak when more than 255 elements expiredWhen more than 255 elements expired we're supposed to switch to a new gccontainer structure.This never happens: u8 type will wrap before reaching the boundaryand nft_trans_gc_space() always returns true.This means we recycle the initial gc container structure andlose track of the elements that came before.While at it, don't deref 'gc' after we've passed it to call_rcu.
Key phrases: memleak
CVE-2023-52582: In the Linux kernel, the following vulnerability has been resolved:netfs: Only call folio_start_fscache() one time for each folioIf a network filesystem using netfs implements a clamp_length()function, it can set subrequest lengths smaller than a page size.When we loop through the folios in netfs_rreq_unlock_folios() toset any folios to be written back, we need to make sure we onlycall folio_start_fscache() once for each folio.Otherwise, this simple testcase:  mount -o fsc,rsize=1024,wsize=1024 127.0.0.1:/export /mnt/nfs  dd if=/dev/zero of=/mnt/nfs/file.bin bs=4096 count=1  1+0 records in  1+0 records out  4096 bytes (4.1 kB, 4.0 KiB) copied, 0.0126359 s, 324 kB/s  echo 3 > /proc/sys/vm/drop_caches  cat /mnt/nfs/file.bin > /dev/nullwill trigger an oops similar to the following:  page dumped because: VM_BUG_ON_FOLIO(folio_test_private_2(folio))  ------------[ cut here ]------------  kernel BUG at include/linux/netfs.h:44!  ...  CPU: 5 PID: 134 Comm: kworker/u16:5 Kdump: loaded Not tainted 6.4.0-rc5  ...  RIP: 0010:netfs_rreq_unlock_folios+0x68e/0x730 [netfs]  ...  Call Trace:    netfs_rreq_assess+0x497/0x660 [netfs]    netfs_subreq_terminated+0x32b/0x610 [netfs]    nfs_netfs_read_completion+0x14e/0x1a0 [nfs]    nfs_read_completion+0x2f9/0x330 [nfs]    rpc_free_task+0x72/0xa0 [sunrpc]    rpc_async_release+0x46/0x70 [sunrpc]    process_one_work+0x3bd/0x710    worker_thread+0x89/0x610    kthread+0x181/0x1c0    ret_from_fork+0x29/0x50
CVE-2023-52583: In the Linux kernel, the following vulnerability has been resolved:ceph: fix deadlock or deadcode of misusing dget()The lock order is incorrect between denty and its parent, we shouldalways make sure that the parent get the lock first.But since this deadcode is never used and the parent dir will alwaysbe set from the callers, let's just remove it.
Key phrases: deadlock, deadcode
CVE-2023-52584: In the Linux kernel, the following vulnerability has been resolved:spmi: mediatek: Fix UAF on device removeThe pmif driver data that contains the clocks is allocated along withspmi_controller.On device remove, spmi_controller will be freed first, and then devres, including the clocks, will be cleanup.This leads to UAF because putting the clocks will access the clocks inthe pmif driver data, which is already freed along with spmi_controller.This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE andbuilding the kernel with KASAN.Fix the UAF issue by using unmanaged clk_bulk_get() and putting theclocks before freeing spmi_controller.
Key phrases: uaf
CVE-2023-52585: In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()Return invalid error code -EINVAL for invalid block id.Fixes the below:drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1183 amdgpu_ras_query_error_status_helper() error: we previously assumed 'info' could be null (see line 1176)
Key phrases: null dereference
CVE-2023-52586: In the Linux kernel, the following vulnerability has been resolved:drm/msm/dpu: Add mutex lock in control vblank irqAdd a mutex lock to control vblank irq to synchronize vblankenable/disable operations happening from different threads to preventrace conditions while registering/unregistering the vblank irq callback.v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a    parameter of dpu_encoder_phys.    -Switch from atomic refcnt to a simple int counter as mutex has    now been addedv3: Mistakenly did not change wording in last version. It is done now.v2: Slightly changed wording of commit messagePatchwork: https://patchwork.freedesktop.org/patch/571854/
CVE-2023-52588: In the Linux kernel, the following vulnerability has been resolved:f2fs: fix to tag gcing flag on page during block migrationIt needs to add missing gcing flag on page during block migration,in order to garantee migrated data be persisted during checkpoint,otherwise out-of-order persistency between data and node may causedata corruption after SPOR.Similar issue was fixed by commit 2d1fe8a86bf5 ("f2fs: fix to taggcing flag on page during file defragment").
CVE-2023-52589: In the Linux kernel, the following vulnerability has been resolved:media: rkisp1: Fix IRQ disable race issueIn rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks theinterrupts and then apparently assumes that the interrupt handler won'tbe running, and proceeds in the stop procedure. This is not the case, asthe interrupt handler can already be running, which would lead to theISP being disabled while the interrupt handler handling a capturedframe.This brings up two issues: 1) the ISP could be powered off while theinterrupt handler is still running and accessing registers, leading toboard lockup, and 2) the interrupt handler code and the code thatdisables the streaming might do things that conflict.It is not clear to me if 2) causes a real issue, but 1) can be seen witha suitable delay (or printk in my case) in the interrupt handler,leading to board lockup.
CVE-2023-5259: A vulnerability classified as problematic was found in ForU CMS. This vulnerability affects unknown code of the file /admin/cms_admin.php. The manipulation of the argument del leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-240868.
Key phrases: denial of service
CVE-2023-52590: In the Linux kernel, the following vulnerability has been resolved:ocfs2: Avoid touching renamed directory if parent does not changeThe VFS will not be locking moved directory if its parent does notchange. Change ocfs2 rename code to avoid touching renamed directory ifits parent does not change as without locking that can corrupt thefilesystem.
Key phrases: corrupt
CVE-2023-52591: In the Linux kernel, the following vulnerability has been resolved:reiserfs: Avoid touching renamed directory if parent does not changeThe VFS will not be locking moved directory if its parent does notchange. Change reiserfs rename code to avoid touching renamed directoryif its parent does not change as without locking that can corrupt thefilesystem.
Key phrases: reiserfs, corrupt
CVE-2023-52593: In the Linux kernel, the following vulnerability has been resolved:wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()Since 'ieee80211_beacon_get()' can return NULL, 'wfx_set_mfp_ap()'should check the return value before examining skb data. So convertthe latter to return an appropriate error code and propagate it toreturn from 'wfx_start_ap()' as well. Compile tested only.
Key phrases: null pointer dereference
CVE-2023-52594: In the Linux kernel, the following vulnerability has been resolved:wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bugoccurs when txs->cnt, data from a URB provided by a USB device, isbigger than the size of the array txs->txstatus, which isHTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bughandling code after the check. Make the function return if that is thecase.Found by a modified version of syzkaller.UBSAN: array-index-out-of-bounds in htc_drv_txrx.cindex 13 is out of range for type '__wmi_event_txstatus [12]'Call Trace: ath9k_htc_txstatus ath9k_wmi_event_tasklet tasklet_action_common __do_softirq irq_exit_rxu sysvec_apic_timer_interrupt
Key phrases: array-index-out-of-bounds read, out of bounds read
CVE-2023-52595: In the Linux kernel, the following vulnerability has been resolved:wifi: rt2x00: restart beacon queue when hardware resetWhen a hardware reset is triggered, all registers are reset, so allqueues are forced to stop in hardware interface. However, mac80211will not automatically stop the queue. If we don't manually stop thebeacon queue, the queue will be deadlocked and unable to start again.This patch fixes the issue where Apple devices cannot connect to theAP after calling ieee80211_restart_hw().
CVE-2023-52596: In the Linux kernel, the following vulnerability has been resolved:sysctl: Fix out of bounds access for empty sysctl registersWhen registering tables to the sysctl subsystem there is a check to seeif header is a permanently empty directory (used for mounts). This checkevaluates the first element of the ctl_table. This results in an out ofbounds evaluation when registering empty directories.The function register_sysctl_mount_point now passes a ctl_table of size1 instead of size 0. It now relies solely on the type to identifya permanently empty register.Make sure that the ctl_table has at least one element before testing forpermanent emptiness.
Key phrases: out of bounds access
CVE-2023-52597: In the Linux kernel, the following vulnerability has been resolved:KVM: s390: fix setting of fpc registerkvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control(fpc) register of a guest cpu. The new value is tested for validity bytemporarily loading it into the fpc register.This may lead to corruption of the fpc register of the host process:if an interrupt happens while the value is temporarily loaded into the fpcregister, and within interrupt context floating point or vector registersare used, the current fp/vx registers are saved with save_fpu_regs()assuming they belong to user space and will be loaded into fp/vx registerswhen returning to user space.test_fp_ctl() restores the original user space / host process fpc registervalue, however it will be discarded, when returning to user space.In result the host process will incorrectly continue to run with the valuethat was supposed to be used for a guest cpu.Fix this by simply removing the test. There is another test right beforethe SIE context is entered which will handles invalid values.This results in a change of behaviour: invalid values will now be acceptedinstead of that the ioctl fails with -EINVAL. This seems to be acceptable,given that this interface is most likely not used anymore, and this is inaddition the same behaviour implemented with the memory mapped interface(replace invalid values with zero) - see sync_regs() in kvm-s390.c.
Key phrases: set the floating point control(fpc) register of
CVE-2023-52598: In the Linux kernel, the following vulnerability has been resolved:s390/ptrace: handle setting of fpc register correctlyIf the content of the floating point control (fpc) register of a tracedprocess is modified with the ptrace interface the new value is tested forvalidity by temporarily loading it into the fpc register.This may lead to corruption of the fpc register of the tracing process:if an interrupt happens while the value is temporarily loaded into thefpc register, and within interrupt context floating point or vectorregisters are used, the current fp/vx registers are saved withsave_fpu_regs() assuming they belong to user space and will be loaded intofp/vx registers when returning to user space.test_fp_ctl() restores the original user space fpc register value, howeverit will be discarded, when returning to user space.In result the tracer will incorrectly continue to run with the value thatwas supposed to be used for the traced process.Fix this by saving fpu register contents with save_fpu_regs() before usingtest_fp_ctl().
Key phrases: corruption
CVE-2023-52599: In the Linux kernel, the following vulnerability has been resolved:jfs: fix array-index-out-of-bounds in diNewExt[Syz report]UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2index -878706688 is out of range for type 'struct iagctl[128]'CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360 diAllocExt fs/jfs/jfs_imap.c:1949 [inline] diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666 diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587 ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56 jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225 vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106 do_mkdirat+0x264/0x3a0 fs/namei.c:4129 __do_sys_mkdir fs/namei.c:4149 [inline] __se_sys_mkdir fs/namei.c:4147 [inline] __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6bRIP: 0033:0x7fcb7e6a0b57Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000[Analysis]When the agstart is too large, it can cause agno overflow.[Fix]After obtaining agno, if the value is invalid, exit the subsequent process.Modified the test from agno > MAXAG to agno >= MAXAG based on linux-nextreport by kernel test robot (Dan Carpenter).
CVE-2023-5260: A vulnerability, which was classified as critical, has been found in SourceCodester Simple Membership System 1.0. This issue affects some unknown processing of the file group_validator.php. The manipulation of the argument club_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240869 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-52600: In the Linux kernel, the following vulnerability has been resolved:jfs: fix uaf in jfs_evict_inodeWhen the execution of diMount(ipimap) fails, the object ipimap that has beenreleased may be accessed in diFreeSpecial(). Asynchronous ipimap release occurswhen rcu_core() calls jfs_free_node().Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized asipimap.
Key phrases: uaf
CVE-2023-52601: In the Linux kernel, the following vulnerability has been resolved:jfs: fix array-index-out-of-bounds in dbAdjTreeCurrently there is a bound check missing in the dbAdjTree whileaccessing the dmt_stree. To add the required check added the bool is_ctlwhich is required to determine the size as suggest in the followingcommit.https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e75f4fa@oracle.com/
Key phrases: array-index-out-of-bounds
CVE-2023-52602: In the Linux kernel, the following vulnerability has been resolved:jfs: fix slab-out-of-bounds Read in dtSearchCurrently while searching for current page in the sorted entry tableof the page there is a out of bound access. Added a bound check to fixthe error.Dave:Set return code to -EIO
Key phrases: slab-out-of-bounds read, out of bound access