yahoo-inc/cve-impacts huggingface dataset:
CVE-2023-52603: In the Linux kernel, the following vulnerability has been resolved:UBSAN: array-index-out-of-bounds in dtSplitRootSyzkaller reported the following issue:oop0: detected capacity change from 0 to 32768UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9index -2 is out of range for type 'struct dtslot [128]'CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcdRIP: 0033:0x7fcdc0113fd9Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK>The issue is caused when the value of fsi becomes less than -1.The check to break the loop when fsi value becomes -1 is presentbut syzbot was able to produce value less than -1 which cause the error.This patch simply add the change for the values less than 0.The patch is tested via syzbot.
CVE-2023-52604: In the Linux kernel, the following vulnerability has been resolved:FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTreeSyzkaller reported the following issue:UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]')CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK>================================================================================Kernel panic - not syncing: UBSAN: panic_on_warn set ...CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK>Kernel Offset: disabledRebooting in 86400 seconds..The issue is caused when the value of lp becomes greater thanCTLTREESIZE which is the max size of stree. Adding a simple checksolves this issue.Dave:As the function returns a void, good error handlingwould require a more intrusive code reorganization, so I modifiedOsama's patch at use WARN_ON_ONCE for lack of a cleaner option.The patch is tested via syzbot.
CVE-2023-52606: In the Linux kernel, the following vulnerability has been resolved:powerpc/lib: Validate size for vector operationsSome of the fp/vmx code in sstep.c assume a certain maximum size for theinstructions being emulated. The size of those operations however isdetermined separately in analyse_instr().Add a check to validate the assumption on the maximum size of theoperations, so as to prevent any unintended kernel stack corruption.
Key phrases: kernel stack corruption
CVE-2023-52607: In the Linux kernel, the following vulnerability has been resolved:powerpc/mm: Fix null-pointer dereference in pgtable_cache_addkasprintf() returns a pointer to dynamically allocated memorywhich can be NULL upon failure. Ensure the allocation was successfulby checking the pointer validity.
Key phrases: null-pointer dereference, null pointer, null pointer dereference
CVE-2023-52608: In the Linux kernel, the following vulnerability has been resolved:firmware: arm_scmi: Check mailbox/SMT channel for consistencyOn reception of a completion interrupt the shared memory area is accessedto retrieve the message header at first and then, if the message sequencenumber identifies a transaction which is still pending, the relatedpayload is fetched too.When an SCMI command times out the channel ownership remains with theplatform until eventually a late reply is received and, as a consequence,any further transmission attempt remains pending, waiting for the channelto be relinquished by the platform.Once that late reply is received the channel ownership is given backto the agent and any pending request is then allowed to proceed andoverwrite the SMT area of the just delivered late reply; then the waitfor the reply to the new request starts.It has been observed that the spurious IRQ related to the late reply canbe wrongly associated with the freshly enqueued request: when that happensthe SCMI stack in-flight lookup procedure is fooled by the fact that themessage header now present in the SMT area is related to the new pendingtransaction, even though the real reply has still to arrive.This race-condition on the A2P channel can be detected by looking at thechannel status bits: a genuine reply from the platform will have set thechannel free bit before triggering the completion IRQ.Add a consistency check to validate such condition in the A2P ISR.
Key phrases: race-condition, race condition
CVE-2023-52609: In the Linux kernel, the following vulnerability has been resolved:binder: fix race between mmput() and do_exit()Task A calls binder_update_page_range() to allocate and insert pages ona remote address space from Task B. For this, Task A pins the remote mmvia mmget_not_zero() first. This can race with Task B do_exit() and thefinal mmput() refcount decrement will come from Task A.  Task A            | Task B  ------------------+------------------  mmget_not_zero()  |                    |  do_exit()                    |    exit_mm()                    |      mmput()  mmput()           |    exit_mmap()     |      remove_vma()  |        fput()      |In this case, the work of ____fput() from Task B is queued up in Task Aas TWA_RESUME. So in theory, Task A returns to userspace and the cleanupwork gets executed. However, Task A instead sleep, waiting for a replyfrom Task B that never comes (it's dead).This means the binder_deferred_release() is blocked until an unrelatedbinder event forces Task A to go back to userspace. All the associateddeath notifications will also be delayed until then.In order to fix this use mmput_async() that will schedule the work inthe corresponding mm->async_put_work WQ instead of Task A.
CVE-2023-5261: A vulnerability, which was classified as critical, was found in Tongda OA 2017. Affected is an unknown function of the file general/hr/manage/staff_title_evaluation/delete.php. The manipulation of the argument EVALUATION_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-240870 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-52611: In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: sdio: Honor the host max_req_size in the RX pathLukas reports skb_over_panic errors on his Banana Pi BPI-CM4 which comeswith an Amlogic A311D (G12B) SoC and a RTL8822CS SDIO wifi/Bluetoothcombo card. The error he observed is identical to what has been fixedin commit e967229ead0e ("wifi: rtw88: sdio: Check the HISR RX_REQUESTbit in rtw_sdio_rx_isr()") but that commit didn't fix Lukas' problem.Lukas found that disabling or limiting RX aggregation works around theproblem for some time (but does not fully fix it). In the followingdiscussion a few key topics have been discussed which have an impact onthis problem:- The Amlogic A311D (G12B) SoC has a hardware bug in the SDIO controller  which prevents DMA transfers. Instead all transfers need to go through  the controller SRAM which limits transfers to 1536 bytes- rtw88 chips don't split incoming (RX) packets, so if a big packet is  received this is forwarded to the host in it's original form- rtw88 chips can do RX aggregation, meaning more multiple incoming  packets can be pulled by the host from the card with one MMC/SDIO  transfer. This Depends on settings in the REG_RXDMA_AGG_PG_TH  register (BIT_RXDMA_AGG_PG_TH limits the number of packets that will  be aggregated, BIT_DMA_AGG_TO_V1 configures a timeout for aggregation  and BIT_EN_PRE_CALC makes the chip honor the limits more effectively)Use multiple consecutive reads in rtw_sdio_read_port() and limit thenumber of bytes which are copied by the host from the card in oneMMC/SDIO transfer. This allows receiving a buffer that's larger thanthe hosts max_req_size (number of bytes which can be transferred inone MMC/SDIO transfer). As a result of this the skb_over_panic erroris gone as the rtw88 driver is now able to receive more than 1536 bytesfrom the card (either because the incoming packet is larger than thator because multiple packets have been aggregated).In case of an receive errors (-EILSEQ has been observed by Lukas) weneed to drain the remaining data from the card's buffer, otherwise thecard will return corrupt data for the next rtw_sdio_read_port() call.
Key phrases: receive more than 1536 bytesfrom the card (
CVE-2023-52612: In the Linux kernel, the following vulnerability has been resolved:crypto: scomp - fix req->dst buffer overflowThe req->dst buffer size should be checked before copying from thescomp_scratch->dst to avoid req->dst buffer overflow problem.
Key phrases: req->dst buffer overflowthe
CVE-2023-52614: In the Linux kernel, the following vulnerability has been resolved:PM / devfreq: Fix buffer overflow in trans_stat_showFix buffer overflow in trans_stat_show().Convert simple snprintf to the more secure scnprintf with size ofPAGE_SIZE.Add condition checking if we are exceeding PAGE_SIZE and exit early fromloop. Also add at the end a warning that we exceeded PAGE_SIZE and thatstats is disabled.Return -EFBIG in the case where we don't have enough space to write thefull transition table.Also document in the ABI that this function can return -EFBIG error.
Key phrases: buffer overflow
CVE-2023-52615: In the Linux kernel, the following vulnerability has been resolved:hwrng: core - Fix page fault dead lock on mmap-ed hwrngThere is a dead-lock in the hwrng device read path.  This triggerswhen the user reads from /dev/hwrng into memory also mmap-ed from/dev/hwrng.  The resulting page fault triggers a recursive readwhich then dead-locks.Fix this by using a stack buffer when calling copy_to_user.
CVE-2023-52616: In the Linux kernel, the following vulnerability has been resolved:crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_initWhen the mpi_ec_ctx structure is initialized, some fields are notcleared, causing a crash when referencing the field when thestructure was released. Initially, this issue was ignored becausememory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.For example, this error will be triggered when calculating theZa value for SM2 separately.
Key phrases: crash
CVE-2023-52617: In the Linux kernel, the following vulnerability has been resolved:PCI: switchtec: Fix stdev_release() crash after surprise hot removeA PCI device hot removal may occur while stdev->cdev is held open. The callto stdev_release() then happens during close or exit, at a point way pastswitchtec_pci_remove(). Otherwise the last ref would vanish with thetrailing put_device(), just before return.At that later point in time, the devm cleanup has already removed thestdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a countedone. Therefore, in DMA mode, the iowrite32() in stdev_release() will causea fatal page fault, and the subsequent dma_free_coherent(), if reached,would pass a stale &stdev->pdev->dev pointer.Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), afterstdev_kill(). Counting the stdev->pdev ref is now optional, but may preventfuture accidents.Reproducible via the script athttps://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com
Key phrases: crash
CVE-2023-52618: In the Linux kernel, the following vulnerability has been resolved:block/rnbd-srv: Check for unlikely string overflowSince "dev_search_path" can technically be as large as PATH_MAX,there was a risk of truncation when copying it and a second stringinto "full_path" since it was also PATH_MAX sized. The W=1 builds werereporting this warning:drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra':drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=]  616 |                 snprintf(full_path, PATH_MAX, "%s/%s",      |                                                   ^~In function 'rnbd_srv_get_full_path',    inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096  616 |                 snprintf(full_path, PATH_MAX, "%s/%s",      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  617 |                          dev_search_path, dev_name);      |                          ~~~~~~~~~~~~~~~~~~~~~~~~~~To fix this, unconditionally check for truncation (as was already donefor the case where "%SESSNAME%" was present).
Key phrases: string overflowsince, truncation
CVE-2023-52619: In the Linux kernel, the following vulnerability has been resolved:pstore/ram: Fix crash when setting number of cpus to an odd numberWhen the number of cpu cores is adjusted to 7 or other odd numbers,the zone size will become an odd number.The address of the zone will become:    addr of zone0 = BASE    addr of zone1 = BASE + zone_size    addr of zone2 = BASE + zone_size*2    ...The address of zone1/3/5/7 will be mapped to non-alignment va.Eventually crashes will occur when accessing these va.So, use ALIGN_DOWN() to make sure the zone size is evento avoid this bug.
Key phrases: crash
CVE-2023-5262: A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. Affected by this vulnerability is the function isImg of the file /admin/config/uploadicon.php. The manipulation of the argument fileName leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240871.
Key phrases: unrestricted upload
CVE-2023-52620: In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: disallow timeout for anonymous setsNever used from userspace, disallow these parameters.
CVE-2023-52621: In the Linux kernel, the following vulnerability has been resolved:bpf: Check rcu_read_lock_trace_held() before calling bpf map helpersThese three bpf_map_{lookup,update,delete}_elem() helpers are alsoavailable for sleepable bpf program, so add the corresponding lockassertion for sleepable bpf program, otherwise the following warningwill be reported when a sleepable bpf program manipulates bpf map underinterpreter mode (aka bpf_jit_enable=0):  WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ......  CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......  RIP: 0010:bpf_map_lookup_elem+0x54/0x60  ......  Call Trace:   <TASK>   ? __warn+0xa5/0x240   ? bpf_map_lookup_elem+0x54/0x60   ? report_bug+0x1ba/0x1f0   ? handle_bug+0x40/0x80   ? exc_invalid_op+0x18/0x50   ? asm_exc_invalid_op+0x1b/0x20   ? __pfx_bpf_map_lookup_elem+0x10/0x10   ? rcu_lockdep_current_cpu_online+0x65/0xb0   ? rcu_is_watching+0x23/0x50   ? bpf_map_lookup_elem+0x54/0x60   ? __pfx_bpf_map_lookup_elem+0x10/0x10   ___bpf_prog_run+0x513/0x3b70   __bpf_prog_run32+0x9d/0xd0   ? __bpf_prog_enter_sleepable_recur+0xad/0x120   ? __bpf_prog_enter_sleepable_recur+0x3e/0x120   bpf_trampoline_6442580665+0x4d/0x1000   __x64_sys_getpgid+0x5/0x30   ? do_syscall_64+0x36/0xb0   entry_SYSCALL_64_after_hwframe+0x6e/0x76   </TASK>
CVE-2023-52622: In the Linux kernel, the following vulnerability has been resolved:ext4: avoid online resizing failures due to oversized flex bgWhen we online resize an ext4 filesystem with a oversized flexbg_size,     mkfs.ext4 -F -G 67108864 $dev -b 4096 100M     mount $dev $dir     resize2fs $dev 16Gthe following WARN_ON is triggered:==================================================================WARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550Modules linked in: sg(E)CPU: 0 PID: 427 Comm: resize2fs Tainted: G  E  6.6.0-rc5+ #314RIP: 0010:__alloc_pages+0x411/0x550Call Trace: <TASK> __kmalloc_large_node+0xa2/0x200 __kmalloc+0x16e/0x290 ext4_resize_fs+0x481/0xd80 __ext4_ioctl+0x1616/0x1d90 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0xf0/0x150 do_syscall_64+0x3b/0x90==================================================================This is because flexbg_size is too large and the size of the new_group_dataarray to be allocated exceeds MAX_ORDER. Currently, the minimum value ofMAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the correspondingmaximum number of groups that can be allocated is: (PAGE_SIZE << MAX_ORDER) / sizeof(struct ext4_new_group_data) ? 21845And the value that is down-aligned to the power of 2 is 16384. Therefore,this value is defined as MAX_RESIZE_BG, and the number of groups addedeach time does not exceed this value during resizing, and is added multipletimes to complete the online resizing. The difference is that the metadatain a flex_bg may be more dispersed.
CVE-2023-52624: In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Wake DMCUB before executing GPINT commands[Why]DMCUB can be in idle when we attempt to interface with the HW throughthe GPINT mailbox resulting in a system hang.[How]Add dc_wake_and_execute_gpint() to wrap the wake, execute, sleepsequence.If the GPINT executes successfully then DMCUB will be put back intosleep after the optional response is returned.It functions similar to the inbox command interface.
CVE-2023-52625: In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Refactor DMCUB enter/exit idle interface[Why]We can hang in place trying to send commands when the DMCUB isn'tpowered on.[How]We need to exit out of the idle state prior to sending a command,but the process that performs the exit also invokes a command itself.Fixing this issue involves the following:1. Using a software state to track whether or not we need to start   the process to exit idle or notify idle.It's possible for the hardware to have exited an idle state withoutdriver knowledge, but entering one is always restricted to a driverallow - which makes the SW state vs HW state mismatch issue purely oneof optimization, which should seldomly be hit, if at all.2. Refactor any instances of exit/notify idle to use a single wrapper   that maintains this SW state.This works simialr to dc_allow_idle_optimizations, but works at theDMCUB level and makes sure the state is marked prior to any notify/exitidle so we don't enter an infinite loop.3. Make sure we exit out of idle prior to sending any commands or   waiting for DMCUB idle.This patch takes care of 1/2. A future patch will take care of wrappingDMCUB command submission with calls to this new interface.
Key phrases: hang
CVE-2023-52626: In the Linux kernel, the following vulnerability has been resolved:net/mlx5e: Fix operation precedence bug in port timestamping napi_poll contextIndirection (*) is of lower precedence than postfix increment (++). Logicin napi_poll context would cause an out-of-bound read by first incrementthe pointer address by byte address space and then dereference the value.Rather, the intended logic was to dereference first and then increment theunderlying value.
Key phrases: operation precedence bug, out-of-bound read, out of bound read
CVE-2023-52627: In the Linux kernel, the following vulnerability has been resolved:iio: adc: ad7091r: Allow users to configure device eventsAD7091R-5 devices are supported by the ad7091r-5 driver together withthe ad7091r-base driver. Those drivers declared iio events for notifyinguser space when ADC readings fall bellow the thresholds of low limitregisters or above the values set in high limit registers.However, to configure iio events and their thresholds, a set of callbackfunctions must be implemented and those were not present until now.The consequence of trying to configure ad7091r-5 events without theproper callback functions was a null pointer dereference in the kernelbecause the pointers to the callback functions were not set.Implement event configuration callbacks allowing users to read/writeevent thresholds and enable/disable event generation.Since the event spec structs are generic to AD7091R devices, also movethose from the ad7091r-5 driver the base driver so they can be reusedwhen support for ad7091r-2/-4/-8 be added.
Key phrases: configure device eventsAD7091R-5 devices are supported by the, read/writeevent thresholds and enable/disable, null pointer dereference
CVE-2023-52628: In the Linux kernel, the following vulnerability has been resolved:netfilter: nftables: exthdr: fix 4-byte stack OOB writeIf priv->len is a multiple of 4, then dst[len / 4] can write pastthe destination array which leads to stack corruption.This construct is necessary to clean the remainder of the registerin case ->len is NOT a multiple of the register size, so make itconditional just like nft_payload.c does.The bug was added in 4.1 cycle and then copied/inherited whentcp/sctp and ip option support was added.Bug reported by Zero Day Initiative project (ZDI-CAN-21950,ZDI-CAN-21951, ZDI-CAN-21961).
Key phrases: stack oob writeif, stack corruption
CVE-2023-52629: In the Linux kernel, the following vulnerability has been resolved:sh: push-switch: Reorder cleanup operations to avoid use-after-free bugThe original code puts flush_work() before timer_shutdown_sync()in switch_drv_remove(). Although we use flush_work() to stopthe worker, it could be rescheduled in switch_timer(). As a result,a use-after-free bug can occur. The details are shown below:      (cpu 0)                    |      (cpu 1)switch_drv_remove()              | flush_work()                    |  ...                            |  switch_timer // timer                                 |   schedule_work(&psw->work) timer_shutdown_sync()           | ...                             |  switch_work_handler // worker kfree(psw) // free              |                                 |   psw->state = 0 // useThis patch puts timer_shutdown_sync() before flush_work() tomitigate the bugs. As a result, the worker and timer will bestopped safely before the deallocate operations.
Key phrases: use-after-free bugthe, use after free
CVE-2023-5263: A vulnerability was found in ZZZCMS 2.1.7 and classified as critical. Affected by this issue is the function restore of the file /admin/save.php of the component Database Backup File Handler. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240872.
CVE-2023-52630: In the Linux kernel, the following vulnerability has been resolved:blk-iocost: Fix an UBSAN shift-out-of-bounds warningWhen iocg_kick_delay() is called from a CPU different than the one which setthe delay, @now may be in the past of @iocg->delay_at leading to thefollowing warning:  UBSAN: shift-out-of-bounds in block/blk-iocost.c:1359:23  shift exponent 18446744073709 is too large for 64-bit type 'u64' (aka 'unsigned long long')  ...  Call Trace:   <TASK>   dump_stack_lvl+0x79/0xc0   __ubsan_handle_shift_out_of_bounds+0x2ab/0x300   iocg_kick_delay+0x222/0x230   ioc_rqos_merge+0x1d7/0x2c0   __rq_qos_merge+0x2c/0x80   bio_attempt_back_merge+0x83/0x190   blk_attempt_plug_merge+0x101/0x150   blk_mq_submit_bio+0x2b1/0x720   submit_bio_noacct_nocheck+0x320/0x3e0   __swap_writepage+0x2ab/0x9d0The underflow itself doesn't really affect the behavior in any meaningfulway; however, the past timestamp may exaggerate the delay amount calculatedlater in the code, which shouldn't be a material problem given the nature ofthe delay mechanism.If @now is in the past, this CPU is racing another CPU which recently set upthe delay and there's nothing this CPU can contribute w.r.t. the delay.Let's bail early from iocg_kick_delay() in such cases.
CVE-2023-52631: In the Linux kernel, the following vulnerability has been resolved:fs/ntfs3: Fix an NULL dereference bugThe issue here is when this is called from ntfs_load_attr_list().  The"size" comes from le32_to_cpu(attr->res.data_size) so it can't overflowon a 64bit systems but on 32bit systems the "+ 1023" can overflow andthe result is zero.  This means that the kmalloc will succeed byreturning the ZERO_SIZE_PTR and then the memcpy() will crash with anOops on the next line.
Key phrases: null dereference bugthe, crash
CVE-2023-52632: In the Linux kernel, the following vulnerability has been resolved:drm/amdkfd: Fix lock dependency warning with srcu======================================================WARNING: possible circular locking dependency detected6.5.0-kfd-yangp #2289 Not tainted------------------------------------------------------kworker/0:2/996 is trying to acquire lock:        (srcu){.+.+}-{0:0}, at: __synchronize_srcu+0x5/0x1a0but task is already holding lock:        ((work_completion)(&svms->deferred_list_work)){+.+.}-{0:0}, at:	process_one_work+0x211/0x560which lock already depends on the new lock.the existing dependency chain (in reverse order) is:-> #3 ((work_completion)(&svms->deferred_list_work)){+.+.}-{0:0}:        __flush_work+0x88/0x4f0        svm_range_list_lock_and_flush_work+0x3d/0x110 [amdgpu]        svm_range_set_attr+0xd6/0x14c0 [amdgpu]        kfd_ioctl+0x1d1/0x630 [amdgpu]        __x64_sys_ioctl+0x88/0xc0-> #2 (&info->lock#2){+.+.}-{3:3}:        __mutex_lock+0x99/0xc70        amdgpu_amdkfd_gpuvm_restore_process_bos+0x54/0x740 [amdgpu]        restore_process_helper+0x22/0x80 [amdgpu]        restore_process_worker+0x2d/0xa0 [amdgpu]        process_one_work+0x29b/0x560        worker_thread+0x3d/0x3d0-> #1 ((work_completion)(&(&process->restore_work)->work)){+.+.}-{0:0}:        __flush_work+0x88/0x4f0        __cancel_work_timer+0x12c/0x1c0        kfd_process_notifier_release_internal+0x37/0x1f0 [amdgpu]        __mmu_notifier_release+0xad/0x240        exit_mmap+0x6a/0x3a0        mmput+0x6a/0x120        do_exit+0x322/0xb90        do_group_exit+0x37/0xa0        __x64_sys_exit_group+0x18/0x20        do_syscall_64+0x38/0x80-> #0 (srcu){.+.+}-{0:0}:        __lock_acquire+0x1521/0x2510        lock_sync+0x5f/0x90        __synchronize_srcu+0x4f/0x1a0        __mmu_notifier_release+0x128/0x240        exit_mmap+0x6a/0x3a0        mmput+0x6a/0x120        svm_range_deferred_list_work+0x19f/0x350 [amdgpu]        process_one_work+0x29b/0x560        worker_thread+0x3d/0x3d0other info that might help us debug this:Chain exists of:  srcu --> &info->lock#2 --> (work_completion)(&svms->deferred_list_work)Possible unsafe locking scenario:        CPU0                    CPU1        ----                    ----        lock((work_completion)(&svms->deferred_list_work));                        lock(&info->lock#2);			lock((work_completion)(&svms->deferred_list_work));        sync(srcu);
CVE-2023-52633: In the Linux kernel, the following vulnerability has been resolved:um: time-travel: fix time corruptionIn 'basic' time-travel mode (without =inf-cpu or =ext), westill get timer interrupts. These can happen at arbitrarypoints in time, i.e. while in timer_read(), which pushestime forward just a little bit. Then, if we happen to getthe interrupt after calculating the new time to push to,but before actually finishing that, the interrupt will setthe time to a value that's incompatible with the forward,and we'll crash because time goes backwards when we do theforwarding.Fix this by reading the time_travel_time, calculating theadjustment, and doing the adjustment all with interruptsdisabled.
Key phrases: crash
CVE-2023-52634: In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Fix disable_otg_wa logic[Why]When switching to another HDMI mode, we are unnecesarillydisabling/enabling FIFO causing both HPO and DIG registers to be set atthe same time when only HPO is supposed to be set.This can lead to a system hang the next time we change refresh rates asthere are cases when we don't disable OTG/FIFO but FIFO is enabled whenit isn't supposed to be.[How]Removing the enable/disable FIFO entirely.
Key phrases: hang
CVE-2023-52636: In the Linux kernel, the following vulnerability has been resolved:libceph: just wait for more data to be available on the socketA short read may occur while reading the message footer from thesocket.  Later, when the socket is ready for another read, themessenger invokes all read_partial_*() handlers, includingread_partial_sparse_msg_data().  The expectation is thatread_partial_sparse_msg_data() would bail, allowing the messenger toinvoke read_partial() for the footer and pick up where it left off.However read_partial_sparse_msg_data() violates that and ends upcalling into the state machine in the OSD client.  The sparse-readstate machine assumes that it's a new op and interprets some piece ofthe footer as the sparse-read header and returns bogus extents/datalength, etc.To determine whether read_partial_sparse_msg_data() should bail, let'sreuse cursor->total_resid.  Because once it reaches to zero that meansall the extents and data have been successfully received in last read,else it could break out when partially reading any of the extents anddata.  And then osd_sparse_read() could continue where it left off.[ idryomov: changelog ]
Key phrases: determine whether read_partial_sparse_msg_data() should bail
CVE-2023-52638: In the Linux kernel, the following vulnerability has been resolved:can: j1939: prevent deadlock by changing j1939_socks_lock to rwlockThe following 3 locks would race against each other, causing thedeadlock situation in the Syzbot bug report:- j1939_socks_lock- active_session_list_lock- sk_session_queue_lockA reasonable fix is to change j1939_socks_lock to an rwlock, since inthe rare situations where a write lock is required for the linked listthat j1939_socks_lock is protecting, the code does not attempt toacquire any more locks. This would break the circular lock dependency,where, for example, the current thread already locks j1939_socks_lockand attempts to acquire sk_session_queue_lock, and at the same time,another thread attempts to acquire j1939_socks_lock while holdingsk_session_queue_lock.NOTE: This patch along does not fix the unregister_netdevice bugreported by Syzbot; instead, it solves a deadlock situation to preparefor one or more further patches to actually fix the Syzbot bug, whichappears to be a reference counting problem within the j1939 codebase.[mkl: remove unrelated newline change]
CVE-2023-52639: In the Linux kernel, the following vulnerability has been resolved:KVM: s390: vsie: fix race during shadow creationRight now it is possible to see gmap->private being zero inkvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to thefact that we add gmap->private == kvm after creation:static int acquire_gmap_shadow(struct kvm_vcpu *vcpu,                               struct vsie_page *vsie_page){[...]        gmap = gmap_shadow(vcpu->arch.gmap, asce, edat);        if (IS_ERR(gmap))                return PTR_ERR(gmap);        gmap->private = vcpu->kvm;Let children inherit the private field of the parent.
Key phrases: crash
CVE-2023-5264: A vulnerability classified as critical was found in huakecms 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/cms_content.php. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240877 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-52640: In the Linux kernel, the following vulnerability has been resolved:fs/ntfs3: Fix oob in ntfs_listxattrThe length of name cannot exceed the space occupied by ea.
Key phrases: oob
CVE-2023-52641: In the Linux kernel, the following vulnerability has been resolved:fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame()It is preferable to exit through the out: label becauseinternal debugging functions are located there.
Key phrases: null ptr dereference
CVE-2023-5265: A vulnerability, which was classified as critical, has been found in Tongda OA 2017. Affected by this issue is some unknown functionality of the file general/hr/manage/staff_transfer/delete.php. The manipulation of the argument TRANSFER_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-240878 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-5266: A vulnerability, which was classified as critical, was found in DedeBIZ 6.2. This affects an unknown part of the file /src/admin/tags_main.php. The manipulation of the argument ids leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240879.
Key phrases: sql injection
CVE-2023-5267: A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/recruit/hr_pool/delete.php. The manipulation of the argument EXPERT_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-240880.
Key phrases: sql injection
CVE-2023-5268: A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/makehtml_taglist_action.php. The manipulation of the argument mktime leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240881 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-5269: A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file parcel_list.php of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-240882 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-5270: A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file view_parcel.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240883.
Key phrases: sql injection
CVE-2023-5271: A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file edit_parcel.php. The manipulation of the argument email leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240884.
Key phrases: sql injection
CVE-2023-5272: A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. This affects an unknown part of the file edit_parcel.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-240885 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-5273: A vulnerability classified as problematic was found in SourceCodester Best Courier Management System 1.0. This vulnerability affects unknown code of the file manage_parcel_status.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-240886 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2023-5274: Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by sending specially crafted packets. However, the attacker would need to send the packets from within the same personal computer where the function is running.
Key phrases: cause a denial-of-service (, improper input validation, denial-of-service (dos), denial of service
CVE-2023-5275: Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by sending specially crafted packets. However, the attacker would need to send the packets from within the same personal computer where the function is running.
Key phrases: cause a denial-of-service (, improper input validation, denial-of-service (dos), denial of service
CVE-2023-5276: A vulnerability classified as critical was found in SourceCodester Engineers Online Portal 1.0. This vulnerability affects unknown code of the file downloadable_student.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-240904.
Key phrases: sql injection
CVE-2023-5277: A vulnerability, which was classified as critical, has been found in SourceCodester Engineers Online Portal 1.0. This issue affects some unknown processing of the file student_avatar.php. The manipulation of the argument change leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240905 was assigned to this vulnerability.
Key phrases: unrestricted upload
CVE-2023-5278: A vulnerability, which was classified as critical, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-240906 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-5279: A vulnerability has been found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file my_classmates.php. The manipulation of the argument teacher_class_student_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240907.
Key phrases: sql injection
CVE-2023-5280: A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file my_students.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240908.
Key phrases: sql injection
CVE-2023-5281: A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as critical. This affects an unknown part of the file remove_inbox_message.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240909 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-5282: A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file seed_message_student.php. The manipulation of the argument teacher_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-240910 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-5283: A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file teacher_signup.php. The manipulation of the argument firstname/lastname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240911.
Key phrases: sql injection
CVE-2023-5284: A vulnerability classified as critical has been found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file upload_save_student.php. The manipulation of the argument uploaded_file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240912.
Key phrases: unrestricted upload
CVE-2023-5285: A vulnerability classified as critical was found in Tongda OA 2017. Affected by this vulnerability is an unknown functionality of the file general/hr/recruit/recruitment/delete.php. The manipulation of the argument RECRUITMENT_ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-240913 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-5286: A vulnerability, which was classified as problematic, has been found in SourceCodester Expense Tracker App v1. Affected by this issue is some unknown functionality of the file add_category.php of the component Category Handler. The manipulation of the argument category_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240914 is the identifier assigned to this vulnerability.
CVE-2023-5287: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in BEECMS 4.0. This affects an unknown part of the file /admin/admin_content_tag.php?action=save_content. The manipulation of the argument tag leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240915. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: cross site scripting, cross-site scripting
CVE-2023-5288: A remote unauthorized attacker may connect to the SIM1012, interact with the device andchange configuration settings. The adversary may also reset the SIM and in the worst case upload anew firmware version to the device.
Key phrases: worst case
CVE-2023-5289: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.
Key phrases: allocation of resources
CVE-2023-5291: The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'AWL-BlogFilter' shortcode in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-5292: The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-5293: A vulnerability, which was classified as critical, was found in ECshop 4.1.5. Affected is an unknown function of the file /admin/leancloud.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240924.
Key phrases: sql injection
CVE-2023-5294: A vulnerability has been found in ECshop 4.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/order.php. The manipulation of the argument goods_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240925 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2023-5295: The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vivafbcomment' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2023-5296: A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240926 is the identifier assigned to this vulnerability.