diff --git a/mapping.csv b/mapping.csv index ec080e20246..0e771e3635c 100644 --- a/mapping.csv +++ b/mapping.csv @@ -252607,3 +252607,439 @@ vulnerability,CVE-2024-49629,vulnerability--0ed7f7fc-12d4-45c3-8cae-ee1e57c4d9ed vulnerability,CVE-2024-49616,vulnerability--32823f73-e3e2-4664-9758-ee1dd7548cbf vulnerability,CVE-2024-49613,vulnerability--d3859541-e5d4-4beb-b920-70eaeef7518b vulnerability,CVE-2024-49622,vulnerability--1289cf32-f10a-43c2-99cc-db8037863f02 +vulnerability,CVE-2024-48597,vulnerability--8988842c-4930-4e48-9456-9015fe0ddc03 +vulnerability,CVE-2024-48645,vulnerability--842fefb1-4305-4d34-8531-931efd33bbab +vulnerability,CVE-2024-48930,vulnerability--54b771cc-ebf1-45f9-878f-6f6bb369cf10 +vulnerability,CVE-2024-48709,vulnerability--66aa0695-845a-4a14-a3fe-d71e735c0681 +vulnerability,CVE-2024-48659,vulnerability--030a5255-f423-41b5-97a6-e32b9e24c939 +vulnerability,CVE-2024-48231,vulnerability--139332fd-0d69-4b1b-b667-03d26d041c23 +vulnerability,CVE-2024-48509,vulnerability--523af5da-df3d-417a-98df-b36703056c9e +vulnerability,CVE-2024-30158,vulnerability--f89ae087-a057-485b-91b2-49994eb34bc5 +vulnerability,CVE-2024-30157,vulnerability--8782f1ab-dbec-43e8-8094-5f1e40c93286 +vulnerability,CVE-2024-30159,vulnerability--3f825f23-c54d-4d76-a86d-97b8a8262555 +vulnerability,CVE-2024-30160,vulnerability--13b4e668-be63-4d5e-9d21-ab2a0fdd7d4a +vulnerability,CVE-2024-45309,vulnerability--12b3b662-fcea-4473-bf11-961811e1e3c6 +vulnerability,CVE-2024-10196,vulnerability--7aba5471-8d6e-4c16-bafd-4cbc8e579bdf +vulnerability,CVE-2024-10199,vulnerability--5893961f-8d27-47e2-878d-c607014b9694 +vulnerability,CVE-2024-10125,vulnerability--81f4da30-e407-49ba-ac72-315f2d8fe780 +vulnerability,CVE-2024-10197,vulnerability--6d77eef7-b880-4a54-9a5e-ccd12a327aa8 +vulnerability,CVE-2024-10201,vulnerability--69147556-93ee-4c73-beaf-f3a86a3c58d9 +vulnerability,CVE-2024-10200,vulnerability--65e3d5fb-4f72-4d29-9519-ba5580e13fef +vulnerability,CVE-2024-10198,vulnerability--666a2501-5d70-4f72-88f3-e12a13f517af +vulnerability,CVE-2024-10202,vulnerability--59d8ff85-06a4-4c59-9d20-28018a5a68b4 +vulnerability,CVE-2024-47746,vulnerability--ef4093a9-2354-413c-856b-884d466b534a +vulnerability,CVE-2024-47716,vulnerability--356db4cc-0f7c-4d49-9ed2-e6d87d6d4673 +vulnerability,CVE-2024-47689,vulnerability--a959b860-741d-45b1-bba6-58c3555924bc +vulnerability,CVE-2024-47726,vulnerability--a6a268ed-3380-470c-9e22-e6d75d30df47 +vulnerability,CVE-2024-47738,vulnerability--508a18f6-3068-4969-94b6-579c5885837c +vulnerability,CVE-2024-47756,vulnerability--bd6dae7a-4d76-4e4f-bc2d-861806c09b21 +vulnerability,CVE-2024-47825,vulnerability--660eeb31-eec8-463f-8fa8-18a0c3372c43 +vulnerability,CVE-2024-47731,vulnerability--8cc3b9c9-f833-4056-8237-d03971525c1e +vulnerability,CVE-2024-47680,vulnerability--0e6b79d8-49bb-42de-afa4-8827d2add018 +vulnerability,CVE-2024-47912,vulnerability--3e85e2d8-a85d-47fe-81e5-041f47e01d4e +vulnerability,CVE-2024-47733,vulnerability--fe82be6b-96ef-4a03-8ee9-e5f6a9a930f7 +vulnerability,CVE-2024-47732,vulnerability--df21f18f-880e-423c-8830-90eefef676fe +vulnerability,CVE-2024-47717,vulnerability--24ae8173-4ea2-466d-a4eb-1a3494a9a598 +vulnerability,CVE-2024-47714,vulnerability--1538b174-24d9-4a86-8e7c-1abc93ba0364 +vulnerability,CVE-2024-47705,vulnerability--80bc4bc7-76bc-4f10-a4f1-3739f89737eb +vulnerability,CVE-2024-47690,vulnerability--83d47618-0e1b-42d7-a3b1-81d0c6dc08ad +vulnerability,CVE-2024-47189,vulnerability--106cae7e-6df2-4635-8ba7-0f1edb37ea30 +vulnerability,CVE-2024-47721,vulnerability--ed69adc4-7b7b-4fe1-8f09-636168cccabf +vulnerability,CVE-2024-47711,vulnerability--adf7a46f-f25e-4a4d-9fbc-05e65c6e51ff +vulnerability,CVE-2024-47706,vulnerability--758b8de4-de2d-43ab-bbaa-fd117ada5483 +vulnerability,CVE-2024-47730,vulnerability--e7cc28b2-a278-4c4a-a45c-7535f2b4c61a +vulnerability,CVE-2024-47685,vulnerability--8cfdb74d-f42e-4226-aaae-1c05ee7561cb +vulnerability,CVE-2024-47700,vulnerability--eeefa952-061b-4aac-9ec2-6842e96454c8 +vulnerability,CVE-2024-47720,vulnerability--6eecaa10-a636-4b2e-85fc-180cff339b4c +vulnerability,CVE-2024-47703,vulnerability--185a4b9c-68e8-4f39-88e1-4eaa22127479 +vulnerability,CVE-2024-47702,vulnerability--ef36da7e-453b-4d05-b181-28119bb825fd +vulnerability,CVE-2024-47692,vulnerability--32d8e4b5-0808-44d5-885b-b45a3ffc0225 +vulnerability,CVE-2024-47719,vulnerability--38192aa8-cf76-484e-bec0-c97747add806 +vulnerability,CVE-2024-47704,vulnerability--ce0fb04b-9182-465e-9c9f-db3e7c30b81a +vulnerability,CVE-2024-47740,vulnerability--588a39cd-5294-4568-a7c6-f50a8b1e2350 +vulnerability,CVE-2024-47696,vulnerability--9f740f2d-b638-49ab-9d2a-e73f4b49fd0f +vulnerability,CVE-2024-47677,vulnerability--5a9ea1ad-57d0-4f8b-a737-a963c8c5c23c +vulnerability,CVE-2024-47681,vulnerability--2cc93928-9489-46bb-a77a-f61b97df42e9 +vulnerability,CVE-2024-47757,vulnerability--b752bdaa-3403-4190-be7f-818eb6e03c0f +vulnerability,CVE-2024-47741,vulnerability--4dc11d23-a3e5-4f66-8382-cc73443f8cdd +vulnerability,CVE-2024-47709,vulnerability--0d5e365b-2ab5-4c77-a929-6aa5637393be +vulnerability,CVE-2024-47328,vulnerability--a69df355-45e4-4c08-b420-ee513584f9d1 +vulnerability,CVE-2024-47697,vulnerability--f26eac34-261d-41ff-beec-2a502a734337 +vulnerability,CVE-2024-47728,vulnerability--3851785d-8229-47cd-bb01-7072811aa65f +vulnerability,CVE-2024-47724,vulnerability--11092fa1-579e-4bb4-9532-ca646bf14d9b +vulnerability,CVE-2024-47755,vulnerability--95938611-6ce1-4ebd-b7bc-54aa6855c88c +vulnerability,CVE-2024-47747,vulnerability--558b25c6-df67-481a-ab1f-c22da919ed6b +vulnerability,CVE-2024-47727,vulnerability--070c8305-7bd4-480f-ac1f-ed543d4093cf +vulnerability,CVE-2024-47753,vulnerability--bfa72a01-2b47-4df2-a044-4d1918b90e2a +vulnerability,CVE-2024-47691,vulnerability--3753b56d-61db-450e-ac53-f124708c789a +vulnerability,CVE-2024-47739,vulnerability--3c62fe3f-548b-48cf-842c-f9e40028599d +vulnerability,CVE-2024-47713,vulnerability--917237e6-e1e1-4399-8c12-989e836b12e5 +vulnerability,CVE-2024-47729,vulnerability--62c52c69-2a12-4ff9-84ec-1a5c25124d45 +vulnerability,CVE-2024-47744,vulnerability--55f9ad4b-95b4-4129-991c-5c6219d39344 +vulnerability,CVE-2024-47715,vulnerability--3470d760-76bb-46b2-9ad2-6e3651f23797 +vulnerability,CVE-2024-47701,vulnerability--2c5deab1-d224-41fd-b308-ebaaed1df7a1 +vulnerability,CVE-2024-47223,vulnerability--d0749e60-42b8-42b7-abf0-b1de1882c7af +vulnerability,CVE-2024-47675,vulnerability--673b60e6-f5d2-4314-8604-191b166bbc7d +vulnerability,CVE-2024-47712,vulnerability--9bab7066-4d22-4d76-a1b6-1d8ea9d77f2b +vulnerability,CVE-2024-47723,vulnerability--1e445c1b-c36d-4f63-a396-3ac1d9c68ad7 +vulnerability,CVE-2024-47224,vulnerability--cc9738d3-577d-4cd3-b4d7-6e0752e2f7b4 +vulnerability,CVE-2024-47676,vulnerability--d1414843-f033-46aa-ab77-587162d44378 +vulnerability,CVE-2024-47754,vulnerability--686e2013-52cf-4151-b4e8-69f6af4e8e52 +vulnerability,CVE-2024-47750,vulnerability--6fdbfeff-dec2-452f-ba76-cd783900ee69 +vulnerability,CVE-2024-47698,vulnerability--dc513a08-32ea-472a-b1a8-2adf4819b5cb +vulnerability,CVE-2024-47735,vulnerability--04bbf17c-2176-476a-9dce-5f97ad213720 +vulnerability,CVE-2024-47722,vulnerability--e4550d29-e756-4a04-bbd5-58f339ac4423 +vulnerability,CVE-2024-47725,vulnerability--cc4ff77d-6d83-44bf-b7f1-174e05d62580 +vulnerability,CVE-2024-47752,vulnerability--d0a21fd2-6c4a-4e5e-bac6-af047cdaaf53 +vulnerability,CVE-2024-47679,vulnerability--6becd092-8e7d-47ef-a3f2-032bc9bb867d +vulnerability,CVE-2024-47745,vulnerability--46b45cc9-6335-4c8e-a6cf-37c83d128555 +vulnerability,CVE-2024-47736,vulnerability--08295707-ad2d-4fd3-aa1c-7e81de366111 +vulnerability,CVE-2024-47686,vulnerability--908b1135-dece-43cb-8e10-fc48acc5b2bc +vulnerability,CVE-2024-47748,vulnerability--0cd313e2-8627-41e5-8641-1334e57ac9c6 +vulnerability,CVE-2024-47743,vulnerability--a1dbd01a-6582-4377-9330-3209a541b0dd +vulnerability,CVE-2024-47684,vulnerability--b26833d2-6008-42a0-a5ea-155356702bba +vulnerability,CVE-2024-47683,vulnerability--4addc2e6-db8b-463a-943d-0f033872977a +vulnerability,CVE-2024-47708,vulnerability--3533e22d-3d43-4ba5-96df-e9f2b48d2b87 +vulnerability,CVE-2024-47710,vulnerability--4481e262-ad5e-4a2f-98bb-abff37e5cf5e +vulnerability,CVE-2024-47742,vulnerability--48f3f6e3-3e59-4fb9-a6bd-861455b7244c +vulnerability,CVE-2024-47699,vulnerability--b0554f50-ccc6-4c4e-8fa6-b26f25dbbb7c +vulnerability,CVE-2024-47749,vulnerability--3989d8ce-af53-4b72-8782-f1b4c324b1e8 +vulnerability,CVE-2024-47734,vulnerability--12f748ca-387f-446c-80be-ee5851004dd1 +vulnerability,CVE-2024-47687,vulnerability--5181d5ae-9b3f-4c19-a3ab-00a63b1d67b4 +vulnerability,CVE-2024-47682,vulnerability--20885786-34e3-43e5-94c8-3da0dbe68ea0 +vulnerability,CVE-2024-47694,vulnerability--36c8db1a-47d0-4ca7-9ee2-6a11e1b437a4 +vulnerability,CVE-2024-47693,vulnerability--4dc95988-9665-4a6c-a13b-172982f05528 +vulnerability,CVE-2024-47688,vulnerability--869131f1-bdab-4013-b13f-a9e3fbe4c7a0 +vulnerability,CVE-2024-47718,vulnerability--692aee73-8a1b-4d86-a1f2-1d8e265c6f9e +vulnerability,CVE-2024-47707,vulnerability--6a75fdf9-4186-47d3-8e57-ab34f6962a6f +vulnerability,CVE-2024-47695,vulnerability--4435affd-ab6e-4ca4-b122-8b5bde733f7f +vulnerability,CVE-2024-47678,vulnerability--be7bafae-047b-4b17-85c6-0a3142e24244 +vulnerability,CVE-2024-47751,vulnerability--951193d9-f91a-4c92-b757-be0c50760d3e +vulnerability,CVE-2024-47737,vulnerability--b81d7fe8-3128-4f30-a62f-36d30afad35e +vulnerability,CVE-2024-50014,vulnerability--d5cb5f6b-5a02-43a8-bf98-ffa5272a3ea5 +vulnerability,CVE-2024-50061,vulnerability--e607d7c6-daad-4de1-906e-e314b56eee61 +vulnerability,CVE-2024-50002,vulnerability--ec3e2b7c-96c3-488b-be70-07edf9774353 +vulnerability,CVE-2024-50037,vulnerability--53d5f88f-2bac-4d31-8899-da777dec5b9a +vulnerability,CVE-2024-50025,vulnerability--7d014b2b-28f0-49aa-b458-dfdd5eed1c3c +vulnerability,CVE-2024-50032,vulnerability--f8bb84db-debf-49a5-a800-31d46ffc994b +vulnerability,CVE-2024-50015,vulnerability--e874e905-4d57-42e6-9834-1565e7505044 +vulnerability,CVE-2024-50026,vulnerability--0dffe1cd-9cf2-4b20-994c-daae2abb6bb7 +vulnerability,CVE-2024-50057,vulnerability--af15fcd2-641a-4a05-94e3-9b0e0165aa20 +vulnerability,CVE-2024-50047,vulnerability--3d805172-d853-4567-ac9f-eb597cf2db9f +vulnerability,CVE-2024-50012,vulnerability--4ea93b60-a8ff-4c07-965c-aa3f89e41417 +vulnerability,CVE-2024-50055,vulnerability--a080f190-625a-40d3-a941-4dde0b76f4f7 +vulnerability,CVE-2024-50021,vulnerability--ac4b1119-72de-4c3d-b532-ed76392e85e3 +vulnerability,CVE-2024-50008,vulnerability--2231e0ac-256f-46dc-b28e-238256b657da +vulnerability,CVE-2024-50022,vulnerability--18b9f07c-8625-44fa-b694-1d8f3a4b3421 +vulnerability,CVE-2024-50065,vulnerability--4ac68d94-9842-48d3-b6ba-1586e3cae94b +vulnerability,CVE-2024-50020,vulnerability--6cd448bb-623d-41e3-954a-bce5b9636493 +vulnerability,CVE-2024-50036,vulnerability--772149a0-1311-4223-84d2-473ea3b01873 +vulnerability,CVE-2024-50039,vulnerability--863ecce4-4127-4c65-9747-07a1409d4d32 +vulnerability,CVE-2024-50009,vulnerability--27b05989-f095-4719-be0b-fca1a94e0462 +vulnerability,CVE-2024-50031,vulnerability--3345946b-42b0-4b97-81e1-7e7493daa70d +vulnerability,CVE-2024-50044,vulnerability--6d96c40f-06ca-4249-a28e-14151a80f674 +vulnerability,CVE-2024-50041,vulnerability--8984b90a-70b3-4e74-8bc5-e31d085df4f2 +vulnerability,CVE-2024-50034,vulnerability--c2d0138c-fcfd-40a0-8f0a-410eac3a88fe +vulnerability,CVE-2024-50063,vulnerability--e9a0cfd5-a47c-441f-b08d-9ccbb40eb57a +vulnerability,CVE-2024-50062,vulnerability--7ea5eb44-6f69-490c-9204-5f95556a3a2c +vulnerability,CVE-2024-50028,vulnerability--118b439d-00ed-40b6-9d49-1cb05b8c8a11 +vulnerability,CVE-2024-50003,vulnerability--9c1469cc-9ac8-4c51-a4fe-dd594e2c87b1 +vulnerability,CVE-2024-50024,vulnerability--0cb65b94-d003-40d8-842a-6a132c15a1b6 +vulnerability,CVE-2024-50027,vulnerability--d2f9cbdc-7869-4d33-8995-f02bd76776b5 +vulnerability,CVE-2024-50023,vulnerability--9939e47b-0e89-4e39-b375-d41e862ec1bb +vulnerability,CVE-2024-50040,vulnerability--20905fca-b8df-4dc1-b071-61c833552034 +vulnerability,CVE-2024-50019,vulnerability--87671fae-b274-4ace-a58e-65ac909a51e1 +vulnerability,CVE-2024-50010,vulnerability--baec1cea-3c2e-45c2-886d-c2eb45629145 +vulnerability,CVE-2024-50006,vulnerability--3138d146-8eea-4d2b-a9da-fc0787a42f6e +vulnerability,CVE-2024-50011,vulnerability--5c2ed68e-499c-47cc-bf2f-7b5f144a0d5f +vulnerability,CVE-2024-50045,vulnerability--e4390ed6-c86a-470c-8aac-bcd188973b10 +vulnerability,CVE-2024-50000,vulnerability--02194e4a-0630-4be5-971b-6a48ebf59ee0 +vulnerability,CVE-2024-50049,vulnerability--453fc0e4-27f9-4a7c-94e7-4112f14da2ec +vulnerability,CVE-2024-50001,vulnerability--ec42bdec-6869-43d3-9555-6f89a486d980 +vulnerability,CVE-2024-50048,vulnerability--19f7f527-ed52-46c6-9c83-dfd668b08c1b +vulnerability,CVE-2024-50035,vulnerability--eb7015ee-8dc3-47dd-a21b-334ef0fe61e3 +vulnerability,CVE-2024-50060,vulnerability--176487f5-fe61-48b8-98b2-c1a3be1ce937 +vulnerability,CVE-2024-50013,vulnerability--df625eb3-71d5-4290-81b2-2a149eb9ad33 +vulnerability,CVE-2024-50058,vulnerability--5f112a7f-5945-42d4-9a76-681e05e9b32e +vulnerability,CVE-2024-50064,vulnerability--63a37ac8-21d7-47d8-8f5d-83eed7944204 +vulnerability,CVE-2024-50017,vulnerability--aafcb74b-fb9a-4f68-ba03-8b2536440e5a +vulnerability,CVE-2024-50033,vulnerability--5d0b7691-408d-4de8-bbbb-b441141f501b +vulnerability,CVE-2024-50030,vulnerability--85cb8c91-daf0-4685-a85b-c7dcac69d974 +vulnerability,CVE-2024-50056,vulnerability--73aa23da-b2c7-4b1b-8687-98acba85881f +vulnerability,CVE-2024-50004,vulnerability--66cb8aa9-f651-4085-9fd4-15cb7db32b07 +vulnerability,CVE-2024-50016,vulnerability--875e778c-00d5-44f4-bc86-2176e0af10ad +vulnerability,CVE-2024-50005,vulnerability--6afc8fc3-85a0-458d-bbd1-4a9639f53d8d +vulnerability,CVE-2024-50038,vulnerability--0a94c994-7ca9-41d0-ad0f-1d9354649816 +vulnerability,CVE-2024-50046,vulnerability--c8af07c1-eb05-45b6-b623-4696edd5831f +vulnerability,CVE-2024-50018,vulnerability--189ced65-0576-4d69-9d4e-6cf3d8fc1d43 +vulnerability,CVE-2024-50007,vulnerability--5f2c1d51-f101-4b71-a921-91291da883df +vulnerability,CVE-2024-50042,vulnerability--ce79c28e-f560-45de-93dc-ac56cc38b038 +vulnerability,CVE-2024-50059,vulnerability--484afbbd-3393-44fe-8152-8a95de35918d +vulnerability,CVE-2024-50029,vulnerability--d5f76168-2014-4cb1-b10f-7a5e735f8f87 +vulnerability,CVE-2024-50043,vulnerability--b941a21a-a6aa-4a6a-b149-8247c4a382c5 +vulnerability,CVE-2024-8901,vulnerability--b3c177d6-dce7-47d8-b688-d1fe85785509 +vulnerability,CVE-2024-8305,vulnerability--c9b4c14e-11dd-43c7-8b2f-389365392056 +vulnerability,CVE-2024-8625,vulnerability--d957e712-e733-47f7-b61d-fb8c53dfe9a1 +vulnerability,CVE-2024-40746,vulnerability--1934d95e-1803-4354-b3e4-1a24379ce9c0 +vulnerability,CVE-2024-40084,vulnerability--9ebf541f-1562-49bf-ae19-307fe2bb2e7a +vulnerability,CVE-2024-40083,vulnerability--0827da67-32b3-4937-b121-b12397703934 +vulnerability,CVE-2024-40085,vulnerability--0c969e68-e3c4-4c77-b743-2b4b75721315 +vulnerability,CVE-2024-40086,vulnerability--80c8ab4c-41fa-41a1-94f1-54c902ba8352 +vulnerability,CVE-2024-40091,vulnerability--0336485f-5475-4a2c-8fc9-d80eb9de7e22 +vulnerability,CVE-2024-40088,vulnerability--352494e2-d98c-4ed0-878b-7e424a8d4627 +vulnerability,CVE-2024-40087,vulnerability--89933699-e37e-43ed-9782-615407708461 +vulnerability,CVE-2024-40090,vulnerability--25548199-f49f-464e-b5f0-a982a29290c6 +vulnerability,CVE-2024-40089,vulnerability--47c6d90b-a254-4019-a02d-41512703580a +vulnerability,CVE-2024-31007,vulnerability--0a67219d-ee69-498a-ba99-8a4222b3ab7e +vulnerability,CVE-2024-41713,vulnerability--6a5176e8-56c0-4297-b367-097826db7961 +vulnerability,CVE-2024-41714,vulnerability--829ac3e6-f004-462b-bde7-8aa7d4ead29c +vulnerability,CVE-2024-41712,vulnerability--95aee335-db4d-4018-b4a5-0c0e0a21d9cb +vulnerability,CVE-2024-35285,vulnerability--3d0adf41-40fd-4fd2-9505-5ef17bcc86c2 +vulnerability,CVE-2024-35315,vulnerability--0e7efeb3-a52c-4890-92b8-90e5386a8d0a +vulnerability,CVE-2024-35286,vulnerability--25fa4eb8-f7c8-4b06-9184-a1837120dd6b +vulnerability,CVE-2024-35314,vulnerability--08ef18b0-f7b4-4e28-b966-76436676bf33 +vulnerability,CVE-2024-35287,vulnerability--8d78bf33-cb81-41ed-b038-6604f2a50f10 +vulnerability,CVE-2024-49990,vulnerability--2d862f2a-8286-4a64-a26e-901c28d8fd6a +vulnerability,CVE-2024-49904,vulnerability--57ec1619-655a-4c8f-b6bb-bee32b106af2 +vulnerability,CVE-2024-49876,vulnerability--23386f52-66a3-4a95-8783-143a94c86bc6 +vulnerability,CVE-2024-49950,vulnerability--70823b02-50ee-4ece-a89c-43ad823c24cc +vulnerability,CVE-2024-49850,vulnerability--02d3fcbc-3e20-47ca-b45d-80f744afa59a +vulnerability,CVE-2024-49985,vulnerability--6aca634e-13e9-473f-a325-a25974424599 +vulnerability,CVE-2024-49992,vulnerability--ec05e684-82c9-4388-8cfd-3bb788405165 +vulnerability,CVE-2024-49947,vulnerability--c3fe1e4e-19eb-4735-b908-d6c109df4b0f +vulnerability,CVE-2024-49885,vulnerability--27ea7961-b674-4278-b5c0-65ee43a4a2c6 +vulnerability,CVE-2024-49911,vulnerability--594cbc1c-3b44-401b-907f-858ed6f25336 +vulnerability,CVE-2024-49942,vulnerability--c8504a75-8a75-4061-9193-db0e17f39944 +vulnerability,CVE-2024-49883,vulnerability--9cf05270-e9d9-43b7-8927-f17bc2be572b +vulnerability,CVE-2024-49895,vulnerability--edee80a5-e27f-4d25-b4e6-e0da12d58015 +vulnerability,CVE-2024-49903,vulnerability--6006555e-913c-4d28-aedc-18406c09122c +vulnerability,CVE-2024-49974,vulnerability--054695e3-b2c9-4698-ae96-d6eac1c63447 +vulnerability,CVE-2024-49976,vulnerability--2c5dfce1-e0fb-4612-baee-edeeb2b09c33 +vulnerability,CVE-2024-49917,vulnerability--34c1b672-6212-4c54-9e61-ff7448c0bfc0 +vulnerability,CVE-2024-49944,vulnerability--68c48e34-b475-42f6-9e30-6485fd644f2a +vulnerability,CVE-2024-49891,vulnerability--f76500ea-6425-4e13-bd2b-fa33d6fa2f2d +vulnerability,CVE-2024-49956,vulnerability--4145a104-c88d-476d-b718-67ecebd89eeb +vulnerability,CVE-2024-49998,vulnerability--35fca495-0ced-4d3e-b0fc-9307b0f3aa1e +vulnerability,CVE-2024-49366,vulnerability--a330fb9b-3a1a-47c5-b882-cca2b5d938f1 +vulnerability,CVE-2024-49993,vulnerability--99cf6561-6e0b-4d6a-a7ff-7ed5c1639d56 +vulnerability,CVE-2024-49924,vulnerability--adc1ef53-b0e8-4caf-b6e7-17e3f4adee09 +vulnerability,CVE-2024-49912,vulnerability--b78f4235-cda5-44ab-b1a4-53c560c35540 +vulnerability,CVE-2024-49984,vulnerability--21d6c095-3f18-4e46-8da0-9550501e04a4 +vulnerability,CVE-2024-49907,vulnerability--46b5a0ed-7087-4ef7-a8f7-e250b01b8919 +vulnerability,CVE-2024-49962,vulnerability--c0c326db-3493-4b8f-8150-ff2873894488 +vulnerability,CVE-2024-49926,vulnerability--b764be02-9344-4570-8ff0-f6adad0a28c1 +vulnerability,CVE-2024-49910,vulnerability--88febbc7-2b1b-4a32-a73b-3fb67046a83a +vulnerability,CVE-2024-49874,vulnerability--68434b62-dd23-4481-abfc-3f6103e50831 +vulnerability,CVE-2024-49897,vulnerability--f496b663-ef3f-455f-b9da-ff08f45c94fd +vulnerability,CVE-2024-49906,vulnerability--edeebba7-aa0e-419a-8d02-875487fea579 +vulnerability,CVE-2024-49972,vulnerability--2582d856-e8a2-44b4-a15f-1709066859d8 +vulnerability,CVE-2024-49905,vulnerability--28b2beb3-c3a2-49d1-9abe-30dd4e6cf74d +vulnerability,CVE-2024-49215,vulnerability--4905e21b-caba-4c23-9549-3dceae36c378 +vulnerability,CVE-2024-49852,vulnerability--ca41ec25-8c74-41c3-8427-1b1d023bdf4f +vulnerability,CVE-2024-49973,vulnerability--c0ebce48-88d5-4ba4-80c4-5f4e3a22137c +vulnerability,CVE-2024-49890,vulnerability--5398b2fc-4309-40c5-9e6d-3348541fc396 +vulnerability,CVE-2024-49995,vulnerability--22fdec8d-b717-459e-ba81-544e11c8b915 +vulnerability,CVE-2024-49954,vulnerability--609f2ff5-2007-411d-b730-8ad120ea28c5 +vulnerability,CVE-2024-49951,vulnerability--6ac6e32b-5ec2-41bc-bc46-a16e78489865 +vulnerability,CVE-2024-49878,vulnerability--1e0b87fe-c8b5-4258-b73d-dea36cb9b485 +vulnerability,CVE-2024-49978,vulnerability--5395460a-efbf-49b7-9411-a12d5aad47d9 +vulnerability,CVE-2024-49977,vulnerability--8b4c9dc3-13f1-497d-9ec6-f986dd031f97 +vulnerability,CVE-2024-49957,vulnerability--ac47ea91-9426-4b23-8d4e-2c25d5124c52 +vulnerability,CVE-2024-49932,vulnerability--3d3712cc-74b7-4e2f-9906-1b9f83810c5b +vulnerability,CVE-2024-49961,vulnerability--d9969528-9713-4196-89bc-8e33d286d0e5 +vulnerability,CVE-2024-49981,vulnerability--2b275aa1-fabc-4fb5-b956-c8a1da08fc56 +vulnerability,CVE-2024-49918,vulnerability--dbb61ccb-724d-4b9d-bb04-aa013fa936ad +vulnerability,CVE-2024-49892,vulnerability--3eb44ed1-cf2f-48ef-880e-a175a908d33e +vulnerability,CVE-2024-49902,vulnerability--d523d628-8b5f-4149-b71b-1d20fcc0b32f +vulnerability,CVE-2024-49321,vulnerability--5f7d5803-78d8-4855-ac32-b3fb7be6f2ad +vulnerability,CVE-2024-49900,vulnerability--4f30fffa-db00-4134-815e-4af70e90d27a +vulnerability,CVE-2024-49868,vulnerability--cfae3827-da9b-4099-a65c-be538d70a26d +vulnerability,CVE-2024-49908,vulnerability--922b6741-b3e5-4f66-90a2-1199229972b1 +vulnerability,CVE-2024-49940,vulnerability--062d6eca-8cb8-41a9-bd5e-b3409f5001c0 +vulnerability,CVE-2024-49987,vulnerability--92d74cf7-f099-4066-aa9a-c3be4da5cc5c +vulnerability,CVE-2024-49929,vulnerability--dca7aa29-6ab3-49bc-a76a-e22397c29fdc +vulnerability,CVE-2024-49959,vulnerability--2443ae1e-63d4-440b-9f2e-1325fba280ab +vulnerability,CVE-2024-49923,vulnerability--2147b071-8502-4824-b533-a9f269f4da34 +vulnerability,CVE-2024-49958,vulnerability--09e09481-78f9-4b2c-909b-8a9a4a6f6e73 +vulnerability,CVE-2024-49999,vulnerability--622ecc3d-9e28-4b32-90b2-b04ca70d6cdc +vulnerability,CVE-2024-49886,vulnerability--6b9030bb-ad6e-4c9f-8640-8088023e8722 +vulnerability,CVE-2024-49920,vulnerability--28a987d4-0d3a-4f46-89e3-22a8b7046b0c +vulnerability,CVE-2024-49293,vulnerability--0d059b77-41d0-418c-9178-98800570d0cb +vulnerability,CVE-2024-49368,vulnerability--05d554f5-072a-47bf-8965-793905b73424 +vulnerability,CVE-2024-49893,vulnerability--8c25d60d-80aa-480d-9204-394a17f0e02f +vulnerability,CVE-2024-49943,vulnerability--bd05a2b6-35ab-45f1-8cbb-68a8eb347034 +vulnerability,CVE-2024-49899,vulnerability--afeb0527-a997-428c-b554-4e73ef3c351e +vulnerability,CVE-2024-49994,vulnerability--2569bcf8-a72d-4ec4-a686-526f16ba731a +vulnerability,CVE-2024-49875,vulnerability--3a12957e-c3e5-49a6-a123-6d21bad0a7b1 +vulnerability,CVE-2024-49975,vulnerability--7382bd05-33b2-43a7-8745-7bde666de5ff +vulnerability,CVE-2024-49919,vulnerability--f0ac32e3-bbd6-4936-ba79-e51ee8d962ba +vulnerability,CVE-2024-49914,vulnerability--3158adcf-fd00-4ce6-bbca-276ce9ac94f6 +vulnerability,CVE-2024-49851,vulnerability--587462e3-d85a-4fa1-99e4-6dd007235c69 +vulnerability,CVE-2024-49928,vulnerability--0ce5bc91-a27d-4611-a230-a28fd3f13980 +vulnerability,CVE-2024-49931,vulnerability--e0a84db2-59b2-44de-b40e-4fdad33683e8 +vulnerability,CVE-2024-49986,vulnerability--cb61a754-3b15-42d5-b045-22d58f5bfb89 +vulnerability,CVE-2024-49933,vulnerability--b3e421de-f837-4753-a6a6-dbf13fe5e7ad +vulnerability,CVE-2024-49930,vulnerability--5df9c615-ad45-45a0-a3c9-a201d4703d33 +vulnerability,CVE-2024-49949,vulnerability--0723c8b4-b155-41a1-b0fe-ab4bd92210dc +vulnerability,CVE-2024-49955,vulnerability--60d8d50a-f69e-491d-a75a-3ba7d5f8ea74 +vulnerability,CVE-2024-49941,vulnerability--9290e5a8-5439-4665-92a0-ef8321290818 +vulnerability,CVE-2024-49935,vulnerability--c7acfa96-dc8d-4f3a-b59a-4fccbbc8c5e9 +vulnerability,CVE-2024-49967,vulnerability--448f3403-6387-4596-8d74-7cfe2d13e1c6 +vulnerability,CVE-2024-49882,vulnerability--b4911309-0592-4a8f-9e6c-94848ff6c7c6 +vulnerability,CVE-2024-49991,vulnerability--4a32caed-55ca-42b1-aadf-bf27b0d9e7c5 +vulnerability,CVE-2024-49866,vulnerability--580d789e-eda1-48d2-8ea9-5aa7dc33d388 +vulnerability,CVE-2024-49863,vulnerability--7287c2a8-3a70-44de-875b-9d31846b3488 +vulnerability,CVE-2024-49922,vulnerability--0b6d327a-a3b8-42d2-958f-26bb9af997c5 +vulnerability,CVE-2024-49948,vulnerability--9a4ffd38-0035-418a-95d6-6afb391d982b +vulnerability,CVE-2024-49865,vulnerability--e0c474c4-78dc-41b8-bfbb-350d2f09e928 +vulnerability,CVE-2024-49937,vulnerability--8573befb-1bf0-44df-be2d-bded72e0652d +vulnerability,CVE-2024-49913,vulnerability--a9755a0f-4f6a-43fa-9e16-61f7a5f60449 +vulnerability,CVE-2024-49969,vulnerability--1cabed5b-f2c5-4e41-9be0-01207b607be7 +vulnerability,CVE-2024-49966,vulnerability--a4cea89b-791f-4e87-a200-093b14e488f9 +vulnerability,CVE-2024-49367,vulnerability--b45fa98f-444b-4730-956c-e07c40ae00e9 +vulnerability,CVE-2024-49879,vulnerability--ff30e5eb-b3e0-486c-b5f0-b523081beb56 +vulnerability,CVE-2024-49963,vulnerability--59bbc091-8e78-4125-8bf6-bb87d663cef1 +vulnerability,CVE-2024-49853,vulnerability--b1f3ca13-eb6a-406b-a870-13c194c9e528 +vulnerability,CVE-2024-49887,vulnerability--22c780a8-8cb7-46fb-b53d-3f429fb86e59 +vulnerability,CVE-2024-49945,vulnerability--5f6b45be-4c02-4d6b-9b09-b5ac6aa6e06d +vulnerability,CVE-2024-49877,vulnerability--63e212e1-4c82-4bc7-bfb4-d5e3751e4dcc +vulnerability,CVE-2024-49988,vulnerability--17b6d4a3-1102-4622-ad58-9878e79f7df9 +vulnerability,CVE-2024-49884,vulnerability--b20a712a-b53c-409a-b68a-2243dfc94238 +vulnerability,CVE-2024-49996,vulnerability--8fa425a4-79b7-45ff-8996-d9d99b3854f2 +vulnerability,CVE-2024-49968,vulnerability--3dcabdfb-b8de-4aa8-bf1f-eb29bd8ca56c +vulnerability,CVE-2024-49921,vulnerability--aeea1a7b-4130-4251-a72a-e488e8edfc9a +vulnerability,CVE-2024-49965,vulnerability--5a96ee3c-8296-47b3-b863-520279907078 +vulnerability,CVE-2024-49915,vulnerability--4efcb7c9-c49a-46d1-a995-fd1b72a04142 +vulnerability,CVE-2024-49901,vulnerability--846cb5a8-243f-4984-b50c-0f10912341f9 +vulnerability,CVE-2024-49870,vulnerability--17502728-6b86-4e4a-97df-49854ef86f78 +vulnerability,CVE-2024-49936,vulnerability--2a742431-cad6-48f2-8fa0-432ed82676a1 +vulnerability,CVE-2024-49946,vulnerability--66702426-a0ba-4b03-ba34-b25ef4089abf +vulnerability,CVE-2024-49927,vulnerability--a80f78c6-d5dd-405a-886d-218781973ec3 +vulnerability,CVE-2024-49869,vulnerability--850f2554-cd0b-44a3-b847-ab15b942d025 +vulnerability,CVE-2024-49916,vulnerability--0e3c1db0-a60a-4ca7-a63d-53e388d6ec78 +vulnerability,CVE-2024-49871,vulnerability--b7b4334e-fd52-43c1-84db-313eabc1d244 +vulnerability,CVE-2024-49964,vulnerability--e4294a82-d539-4612-b5da-42b9c54beb70 +vulnerability,CVE-2024-49979,vulnerability--86fc75db-3ff9-4c62-99f0-c924ecb5ecce +vulnerability,CVE-2024-49939,vulnerability--8924b343-3eae-4bd2-9bbc-6cfad00fcacc +vulnerability,CVE-2024-49982,vulnerability--2f45f9aa-5fda-49c7-8ba9-23f1f8f108ba +vulnerability,CVE-2024-49970,vulnerability--88042ee4-81c6-4cd2-b35e-e2d7bc0fe61d +vulnerability,CVE-2024-49960,vulnerability--07be1a36-c60e-4229-a2ef-3ea17768154b +vulnerability,CVE-2024-49889,vulnerability--3504572d-530d-4bd3-a31e-b3d77045c3c9 +vulnerability,CVE-2024-49971,vulnerability--6acf7d4f-6a1b-48c0-bc33-856eb1ae33d5 +vulnerability,CVE-2024-49872,vulnerability--8e9f7e3d-5a9a-4fc4-ae2e-ad442fb6911f +vulnerability,CVE-2024-49980,vulnerability--80b6cd45-4fe8-4c45-85e7-4d6d2483614b +vulnerability,CVE-2024-49880,vulnerability--05b92c4f-0112-4695-b0fd-3e8ac78dd85d +vulnerability,CVE-2024-49273,vulnerability--0dae7800-e459-41da-95cc-b830f3af37ab +vulnerability,CVE-2024-49938,vulnerability--bb915663-b658-4abc-9b5f-84bc5b715a9f +vulnerability,CVE-2024-49925,vulnerability--6fafe2e4-c7f1-4dae-adfe-cb549a36cabe +vulnerability,CVE-2024-49867,vulnerability--37c66cf8-75d3-449e-82f8-ece43ec01ffc +vulnerability,CVE-2024-49934,vulnerability--f848f3fb-3a73-41bd-8747-b6e206dd110e +vulnerability,CVE-2024-49997,vulnerability--30e7c6eb-7a0f-4567-84a7-a90bb20e0ce5 +vulnerability,CVE-2024-49989,vulnerability--c64f86d6-2863-4cd9-9659-03c9216d8c53 +vulnerability,CVE-2024-49983,vulnerability--8c47a3cd-8835-4eed-86a5-f54f3b03fd5b +vulnerability,CVE-2024-49888,vulnerability--06617815-2fd9-4ff0-b85d-9c2b756a840f +vulnerability,CVE-2024-49894,vulnerability--ac300193-5e67-4faa-90d0-b845ab886706 +vulnerability,CVE-2024-49896,vulnerability--07ddb06c-7730-4538-8e48-2ccced3b8162 +vulnerability,CVE-2024-49953,vulnerability--25ecd17c-75ae-4c9d-b96e-d4df53b15c18 +vulnerability,CVE-2024-49881,vulnerability--c7f8e8d1-f306-4b90-a4af-ed7bf71099fc +vulnerability,CVE-2024-49952,vulnerability--fbee906f-5074-412c-9ca3-153b6005dbc8 +vulnerability,CVE-2024-49898,vulnerability--0162bc81-1c47-4cf3-b523-61b7c3a33b90 +vulnerability,CVE-2024-49909,vulnerability--dac79194-1688-45e7-b6ab-a32af56aca66 +vulnerability,CVE-2024-49864,vulnerability--73cfcf4d-23a0-4066-88bc-3feded2bbcb9 +vulnerability,CVE-2024-49873,vulnerability--666138f7-3cc7-4bfb-a31d-eb3746dd1ed0 +vulnerability,CVE-2024-46238,vulnerability--1de222fc-bec2-4548-af25-34ac94b0aae1 +vulnerability,CVE-2024-46239,vulnerability--51c42a4b-e101-46bf-9dc9-f69d7c2b2e53 +vulnerability,CVE-2024-46236,vulnerability--5cfc7a14-efe2-443e-ba0a-d792653d4803 +vulnerability,CVE-2024-46326,vulnerability--a902391b-b543-4f67-a19d-911051a74f0f +vulnerability,CVE-2024-43689,vulnerability--6562d7b5-603e-4983-98dc-9adf494cc427 +vulnerability,CVE-2024-43945,vulnerability--fdf8bee4-0434-43be-9977-6b52ae18a175 +vulnerability,CVE-2024-6519,vulnerability--74a30dc4-be19-4f54-9a23-c408619404d7 +vulnerability,CVE-2022-48997,vulnerability--8e834e53-f325-4082-a7c7-16a421d6f2f2 +vulnerability,CVE-2022-48962,vulnerability--25784db7-ecdf-4506-a7bb-7be4f4bab62b +vulnerability,CVE-2022-48971,vulnerability--a5f06037-4f48-42e8-bca6-6c200f61e041 +vulnerability,CVE-2022-48968,vulnerability--8b23f20c-7819-4e69-89a5-d8520bcaad43 +vulnerability,CVE-2022-48961,vulnerability--126e6282-fd6a-4114-a8c5-13375542a02f +vulnerability,CVE-2022-48970,vulnerability--ec5d3a0d-873b-4bb1-975b-1c966829bf83 +vulnerability,CVE-2022-48980,vulnerability--7adc1202-84d9-472b-8082-1aa140572701 +vulnerability,CVE-2022-48984,vulnerability--ab644506-5d60-4acc-9011-2ea5c55cb6e7 +vulnerability,CVE-2022-48947,vulnerability--ade81491-b9c2-4982-9907-5d50db0576c6 +vulnerability,CVE-2022-48948,vulnerability--fb0043b6-e3cf-49b1-a64f-2ed6decf266e +vulnerability,CVE-2022-48969,vulnerability--997a5bca-948c-424f-925b-5b7c72c0198a +vulnerability,CVE-2022-48975,vulnerability--4d50275f-07c0-4eb6-85ab-eb208f87e8bf +vulnerability,CVE-2022-48995,vulnerability--089b85c4-1f3b-4820-aec9-89994f8b3c03 +vulnerability,CVE-2022-48966,vulnerability--6a352bb6-d9f1-45f2-97b4-37b1e23cb03f +vulnerability,CVE-2022-48985,vulnerability--e91324d3-8863-4726-903c-0f6ce7d2ae9a +vulnerability,CVE-2022-48993,vulnerability--e8f8b049-1ec8-434f-9106-80724c471d75 +vulnerability,CVE-2022-48988,vulnerability--bec55ea9-2b14-4bfc-bdf0-d73a8dbca2f6 +vulnerability,CVE-2022-48963,vulnerability--74417d41-c30e-45a9-9479-8618c3f9cd78 +vulnerability,CVE-2022-48998,vulnerability--81a7f0ac-db7f-4b49-bab8-73fee6537377 +vulnerability,CVE-2022-48956,vulnerability--0036564e-60ce-404e-bf02-c30bf032af4e +vulnerability,CVE-2022-48982,vulnerability--d1018f9c-3294-4c7c-bed4-56234370425b +vulnerability,CVE-2022-48958,vulnerability--34c06d8d-b031-49fa-b30c-7ff1639ad003 +vulnerability,CVE-2022-48965,vulnerability--03379b81-8799-44bf-965f-8fa8b7522974 +vulnerability,CVE-2022-48976,vulnerability--1c3d0e7a-0104-4f2e-a7da-1e5054fdde0f +vulnerability,CVE-2022-48991,vulnerability--1a69510e-7929-4842-b8fe-4e2cdbea5de8 +vulnerability,CVE-2022-48994,vulnerability--60940d9d-f6ee-4d74-b92f-4c08e1487a2a +vulnerability,CVE-2022-48967,vulnerability--6ff3d6c7-a4f6-470d-9963-c330ee2091d5 +vulnerability,CVE-2022-48992,vulnerability--2fb9982f-96d0-46f2-a60d-4c27deca3b52 +vulnerability,CVE-2022-48974,vulnerability--9ca0909f-b793-4a2c-96b4-5a8628bcab1f +vulnerability,CVE-2022-48989,vulnerability--8214af54-18a2-4832-9bdd-3e3d7962e473 +vulnerability,CVE-2022-48960,vulnerability--f9290753-fde0-4fb8-a106-92cae84e4289 +vulnerability,CVE-2022-48986,vulnerability--04e4a7d3-358a-44e7-8fb7-45bc1c896b2b +vulnerability,CVE-2022-48952,vulnerability--55e0a38c-10c3-4b6c-91bb-782f74bd6cb2 +vulnerability,CVE-2022-48951,vulnerability--691ec71b-5c05-4da5-8d80-c9900f2fb5ac +vulnerability,CVE-2022-48983,vulnerability--5611c669-9f95-4406-9ad4-18c43a5b15ba +vulnerability,CVE-2022-48954,vulnerability--9e9f9127-9770-4a20-81fe-6e1514f139ef +vulnerability,CVE-2022-48955,vulnerability--49eedf14-4a28-4e2c-9fbc-55b37c4aa2e6 +vulnerability,CVE-2022-48957,vulnerability--b4fb97bf-1ba7-40d5-829d-a817c623f9bf +vulnerability,CVE-2022-48964,vulnerability--401f24da-a52b-4340-8b07-79cdc9ca8fbc +vulnerability,CVE-2022-48987,vulnerability--1a5056e3-23ac-451b-be24-7b63b30e3891 +vulnerability,CVE-2022-48979,vulnerability--549ac671-c542-47c0-abe6-d7a1e3d2eaef +vulnerability,CVE-2022-48973,vulnerability--4995e6f6-81f7-4391-ad73-e6f6492148c0 +vulnerability,CVE-2022-48981,vulnerability--f9767cfd-e4ad-417a-973f-9113beb55b6d +vulnerability,CVE-2022-48959,vulnerability--499b7883-5482-4b97-91ae-902d0d7c3ff4 +vulnerability,CVE-2022-48949,vulnerability--2f0391c2-9cdb-46f2-9f54-2e233aaa5ac3 +vulnerability,CVE-2022-48978,vulnerability--62f3d640-51dd-4682-897c-b0e1c134d734 +vulnerability,CVE-2022-48977,vulnerability--c5b0429b-e0ab-4527-a77a-6ec796d51a46 +vulnerability,CVE-2022-48950,vulnerability--cce2bade-9360-44be-8276-2aeb8889a38c +vulnerability,CVE-2022-48972,vulnerability--429b82f2-8513-4ae8-b089-d990503504f2 +vulnerability,CVE-2022-48999,vulnerability--b131d1ef-867e-4ac8-b938-8b04807787ad +vulnerability,CVE-2022-48996,vulnerability--367f29a7-0480-46ff-807e-1f1de2500458 +vulnerability,CVE-2022-48990,vulnerability--54d4a8d3-01e5-4b84-b5d0-7fd9f4bc6824 +vulnerability,CVE-2022-48953,vulnerability--ebfadac7-bed4-4060-80a7-1f63a1531e15 +vulnerability,CVE-2022-48946,vulnerability--df9f810f-80ef-4ae0-97f2-2980195a9425 +vulnerability,CVE-2022-49012,vulnerability--3bf76871-220d-4831-8d7f-4d4c319922bd +vulnerability,CVE-2022-49003,vulnerability--d5d5d32b-0b03-4b2a-97ed-c7cf9b95adab +vulnerability,CVE-2022-49019,vulnerability--bd223e83-3f8f-4677-a111-e7cc9f8a0739 +vulnerability,CVE-2022-49001,vulnerability--56e35438-1832-4c72-933e-01d0f66a8c0b +vulnerability,CVE-2022-49020,vulnerability--a2263916-77e5-4eeb-b2e6-7c5ae6a09fdd +vulnerability,CVE-2022-49005,vulnerability--4806c7e4-43ce-49c8-ad89-c560786ef6b2 +vulnerability,CVE-2022-49002,vulnerability--cb9c88e2-bb92-4421-808e-0408f732bc2e +vulnerability,CVE-2022-49008,vulnerability--2a48bef3-960f-4900-9f94-5fe351a09abd +vulnerability,CVE-2022-49027,vulnerability--8a042ae2-6e65-4e4b-85d1-68ef50e7e3c9 +vulnerability,CVE-2022-49024,vulnerability--5ff9e4b0-8b6e-473a-9987-f594370de228 +vulnerability,CVE-2022-49009,vulnerability--772f05a6-5ed8-4374-8c1f-4658649f6fdc +vulnerability,CVE-2022-49022,vulnerability--c17f285a-f79c-4a2c-95ef-4ddff9a714ca +vulnerability,CVE-2022-49026,vulnerability--c081e88c-45a9-4083-8cbd-dfde97eb4876 +vulnerability,CVE-2022-49006,vulnerability--40ee18f9-9c6b-469e-bfaf-7253a66aa43d +vulnerability,CVE-2022-49016,vulnerability--dc9e5a03-7427-4cac-b9df-2b7b7369f857 +vulnerability,CVE-2022-49015,vulnerability--5d550c97-a218-4113-abe0-86e89394e8db +vulnerability,CVE-2022-49032,vulnerability--07938b10-fe2f-48e3-8201-0081f807690e +vulnerability,CVE-2022-49030,vulnerability--5854d566-c89f-4463-ad06-f572237f8c88 +vulnerability,CVE-2022-49004,vulnerability--a688a35e-59d8-4089-993b-28170dc31a59 +vulnerability,CVE-2022-49023,vulnerability--12c52bbc-b2a1-4e4a-b8a7-d73c3de5052e +vulnerability,CVE-2022-49031,vulnerability--26120d79-9f19-494c-9e41-e9f485d605ad +vulnerability,CVE-2022-49025,vulnerability--978a17ae-25bf-440f-9481-af860dd90240 +vulnerability,CVE-2022-49014,vulnerability--f23e9480-450d-421b-8bac-eaf8f592d075 +vulnerability,CVE-2022-49011,vulnerability--97a51a57-0972-4c2d-8804-33e52e6693ac +vulnerability,CVE-2022-49007,vulnerability--21d09a80-26f2-469c-b0ff-99a803e72703 +vulnerability,CVE-2022-49010,vulnerability--72e18284-3fc9-4a0e-bc3f-3eadfcbb50d5 +vulnerability,CVE-2022-49018,vulnerability--4edd9d32-e32b-407e-a329-1e3151cb63d8 +vulnerability,CVE-2022-49000,vulnerability--d82f12b8-279e-44f7-a6b5-3d522c317dfd +vulnerability,CVE-2022-49021,vulnerability--90c994b6-89e2-469e-bfed-31fa22f3b7d5 +vulnerability,CVE-2022-49017,vulnerability--8547b687-6bc2-4673-aacf-7ad514a50446 +vulnerability,CVE-2022-49033,vulnerability--e454f364-5c4c-42e7-b63e-50f0c3f1c47b +vulnerability,CVE-2022-49029,vulnerability--363ec57c-e6e0-4a3d-8d5e-825d2e3c2449 +vulnerability,CVE-2022-49013,vulnerability--783fbf14-bc49-489f-b031-f4755dd79b2b +vulnerability,CVE-2022-49028,vulnerability--16876896-cd0c-4198-acaa-f59bcd74c729 +vulnerability,CVE-2023-52917,vulnerability--43300332-1edd-48bd-9965-5f02239a83a0 diff --git a/objects/vulnerability/vulnerability--0036564e-60ce-404e-bf02-c30bf032af4e.json b/objects/vulnerability/vulnerability--0036564e-60ce-404e-bf02-c30bf032af4e.json new file mode 100644 index 00000000000..0e3ca8eeb5a --- /dev/null +++ b/objects/vulnerability/vulnerability--0036564e-60ce-404e-bf02-c30bf032af4e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9cec32ae-2651-4e3d-9947-be9022ece6d2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0036564e-60ce-404e-bf02-c30bf032af4e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.662854Z", + "modified": "2024-10-22T00:37:16.662854Z", + "name": "CVE-2022-48956", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: avoid use-after-free in ip6_fragment()\n\nBlamed commit claimed rcu_read_lock() was held by ip6_fragment() callers.\n\nIt seems to not be always true, at least for UDP stack.\n\nsyzbot reported:\n\nBUG: KASAN: use-after-free in ip6_dst_idev include/net/ip6_fib.h:245 [inline]\nBUG: KASAN: use-after-free in ip6_fragment+0x2724/0x2770 net/ipv6/ip6_output.c:951\nRead of size 8 at addr ffff88801d403e80 by task syz-executor.3/7618\n\nCPU: 1 PID: 7618 Comm: syz-executor.3 Not tainted 6.1.0-rc6-syzkaller-00012-g4312098baf37 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nCall Trace:\n \n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:284 [inline]\n print_report+0x15e/0x45d mm/kasan/report.c:395\n kasan_report+0xbf/0x1f0 mm/kasan/report.c:495\n ip6_dst_idev include/net/ip6_fib.h:245 [inline]\n ip6_fragment+0x2724/0x2770 net/ipv6/ip6_output.c:951\n __ip6_finish_output net/ipv6/ip6_output.c:193 [inline]\n ip6_finish_output+0x9a3/0x1170 net/ipv6/ip6_output.c:206\n NF_HOOK_COND include/linux/netfilter.h:291 [inline]\n ip6_output+0x1f1/0x540 net/ipv6/ip6_output.c:227\n dst_output include/net/dst.h:445 [inline]\n ip6_local_out+0xb3/0x1a0 net/ipv6/output_core.c:161\n ip6_send_skb+0xbb/0x340 net/ipv6/ip6_output.c:1966\n udp_v6_send_skb+0x82a/0x18a0 net/ipv6/udp.c:1286\n udp_v6_push_pending_frames+0x140/0x200 net/ipv6/udp.c:1313\n udpv6_sendmsg+0x18da/0x2c80 net/ipv6/udp.c:1606\n inet6_sendmsg+0x9d/0xe0 net/ipv6/af_inet6.c:665\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg+0xd3/0x120 net/socket.c:734\n sock_write_iter+0x295/0x3d0 net/socket.c:1108\n call_write_iter include/linux/fs.h:2191 [inline]\n new_sync_write fs/read_write.c:491 [inline]\n vfs_write+0x9ed/0xdd0 fs/read_write.c:584\n ksys_write+0x1ec/0x250 fs/read_write.c:637\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fde3588c0d9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fde365b6168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00007fde359ac050 RCX: 00007fde3588c0d9\nRDX: 000000000000ffdc RSI: 00000000200000c0 RDI: 000000000000000a\nRBP: 00007fde358e7ae9 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fde35acfb1f R14: 00007fde365b6300 R15: 0000000000022000\n \n\nAllocated by task 7618:\n kasan_save_stack+0x22/0x40 mm/kasan/common.c:45\n kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n __kasan_slab_alloc+0x82/0x90 mm/kasan/common.c:325\n kasan_slab_alloc include/linux/kasan.h:201 [inline]\n slab_post_alloc_hook mm/slab.h:737 [inline]\n slab_alloc_node mm/slub.c:3398 [inline]\n slab_alloc mm/slub.c:3406 [inline]\n __kmem_cache_alloc_lru mm/slub.c:3413 [inline]\n kmem_cache_alloc+0x2b4/0x3d0 mm/slub.c:3422\n dst_alloc+0x14a/0x1f0 net/core/dst.c:92\n ip6_dst_alloc+0x32/0xa0 net/ipv6/route.c:344\n ip6_rt_pcpu_alloc net/ipv6/route.c:1369 [inline]\n rt6_make_pcpu_route net/ipv6/route.c:1417 [inline]\n ip6_pol_route+0x901/0x1190 net/ipv6/route.c:2254\n pol_lookup_func include/net/ip6_fib.h:582 [inline]\n fib6_rule_lookup+0x52e/0x6f0 net/ipv6/fib6_rules.c:121\n ip6_route_output_flags_noref+0x2e6/0x380 net/ipv6/route.c:2625\n ip6_route_output_flags+0x76/0x320 net/ipv6/route.c:2638\n ip6_route_output include/net/ip6_route.h:98 [inline]\n ip6_dst_lookup_tail+0x5ab/0x1620 net/ipv6/ip6_output.c:1092\n ip6_dst_lookup_flow+0x90/0x1d0 net/ipv6/ip6_output.c:1222\n ip6_sk_dst_lookup_flow+0x553/0x980 net/ipv6/ip6_output.c:1260\n udpv6_sendmsg+0x151d/0x2c80 net/ipv6/udp.c:1554\n inet6_sendmsg+0x9d/0xe0 net/ipv6/af_inet6.c:665\n sock_sendmsg_nosec n\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48956" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0162bc81-1c47-4cf3-b523-61b7c3a33b90.json b/objects/vulnerability/vulnerability--0162bc81-1c47-4cf3-b523-61b7c3a33b90.json new file mode 100644 index 00000000000..9d071ae328c --- /dev/null +++ b/objects/vulnerability/vulnerability--0162bc81-1c47-4cf3-b523-61b7c3a33b90.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5d0542cd-7083-44cd-b9ff-f8e23775bbb1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0162bc81-1c47-4cf3-b523-61b7c3a33b90", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.279729Z", + "modified": "2024-10-22T00:37:12.279729Z", + "name": "CVE-2024-49898", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null-initialized variables\n\n[WHAT & HOW]\ndrr_timing and subvp_pipe are initialized to null and they are not\nalways assigned new values. It is necessary to check for null before\ndereferencing.\n\nThis fixes 2 FORWARD_NULL issues reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49898" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--02194e4a-0630-4be5-971b-6a48ebf59ee0.json b/objects/vulnerability/vulnerability--02194e4a-0630-4be5-971b-6a48ebf59ee0.json new file mode 100644 index 00000000000..2b127b78f88 --- /dev/null +++ b/objects/vulnerability/vulnerability--02194e4a-0630-4be5-971b-6a48ebf59ee0.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--80c8b6a5-27c4-4890-ad26-67ecf326c324", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--02194e4a-0630-4be5-971b-6a48ebf59ee0", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.006338Z", + "modified": "2024-10-22T00:37:11.006338Z", + "name": "CVE-2024-50000", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()\n\nIn mlx5e_tir_builder_alloc() kvzalloc() may return NULL\nwhich is dereferenced on the next line in a reference\nto the modify field.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50000" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--02d3fcbc-3e20-47ca-b45d-80f744afa59a.json b/objects/vulnerability/vulnerability--02d3fcbc-3e20-47ca-b45d-80f744afa59a.json new file mode 100644 index 00000000000..c1a5eed3524 --- /dev/null +++ b/objects/vulnerability/vulnerability--02d3fcbc-3e20-47ca-b45d-80f744afa59a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a98b0ae0-d52c-472e-bcab-b674caf27647", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--02d3fcbc-3e20-47ca-b45d-80f744afa59a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.017324Z", + "modified": "2024-10-22T00:37:12.017324Z", + "name": "CVE-2024-49850", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos\n\nIn case of malformed relocation record of kind BPF_CORE_TYPE_ID_LOCAL\nreferencing a non-existing BTF type, function bpf_core_calc_relo_insn\nwould cause a null pointer deference.\n\nFix this by adding a proper check upper in call stack, as malformed\nrelocation records could be passed from user space.\n\nSimplest reproducer is a program:\n\n r0 = 0\n exit\n\nWith a single relocation record:\n\n .insn_off = 0, /* patch first instruction */\n .type_id = 100500, /* this type id does not exist */\n .access_str_off = 6, /* offset of string \"0\" */\n .kind = BPF_CORE_TYPE_ID_LOCAL,\n\nSee the link for original reproducer or next commit for a test case.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49850" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--030a5255-f423-41b5-97a6-e32b9e24c939.json b/objects/vulnerability/vulnerability--030a5255-f423-41b5-97a6-e32b9e24c939.json new file mode 100644 index 00000000000..fba4be72a2d --- /dev/null +++ b/objects/vulnerability/vulnerability--030a5255-f423-41b5-97a6-e32b9e24c939.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6c417147-9a78-42c2-a206-f563bd63296e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--030a5255-f423-41b5-97a6-e32b9e24c939", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.551158Z", + "modified": "2024-10-22T00:37:10.551158Z", + "name": "CVE-2024-48659", + "description": "An issue in DCME-320-L <=9.3.2.114 allows a remote attacker to execute arbitrary code via the log_u_umount.php component.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-48659" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0336485f-5475-4a2c-8fc9-d80eb9de7e22.json b/objects/vulnerability/vulnerability--0336485f-5475-4a2c-8fc9-d80eb9de7e22.json new file mode 100644 index 00000000000..3725f56a3c6 --- /dev/null +++ b/objects/vulnerability/vulnerability--0336485f-5475-4a2c-8fc9-d80eb9de7e22.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--215a6fa0-b5a2-4170-986f-4b13996d355b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0336485f-5475-4a2c-8fc9-d80eb9de7e22", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.630757Z", + "modified": "2024-10-22T00:37:11.630757Z", + "name": "CVE-2024-40091", + "description": "Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive system.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-40091" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--03379b81-8799-44bf-965f-8fa8b7522974.json b/objects/vulnerability/vulnerability--03379b81-8799-44bf-965f-8fa8b7522974.json new file mode 100644 index 00000000000..0458218f014 --- /dev/null +++ b/objects/vulnerability/vulnerability--03379b81-8799-44bf-965f-8fa8b7522974.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ee58b971-a55b-4b33-b273-4a6bf87ba626", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--03379b81-8799-44bf-965f-8fa8b7522974", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.667236Z", + "modified": "2024-10-22T00:37:16.667236Z", + "name": "CVE-2022-48965", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio/rockchip: fix refcount leak in rockchip_gpiolib_register()\n\nThe node returned by of_get_parent() with refcount incremented,\nof_node_put() needs be called when finish using it. So add it in the\nend of of_pinctrl_get().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48965" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--04bbf17c-2176-476a-9dce-5f97ad213720.json b/objects/vulnerability/vulnerability--04bbf17c-2176-476a-9dce-5f97ad213720.json new file mode 100644 index 00000000000..023ad6b34f4 --- /dev/null +++ b/objects/vulnerability/vulnerability--04bbf17c-2176-476a-9dce-5f97ad213720.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ae90b24a-d40f-4b46-bcfd-6ef4a24871dc", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--04bbf17c-2176-476a-9dce-5f97ad213720", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.911691Z", + "modified": "2024-10-22T00:37:10.911691Z", + "name": "CVE-2024-47735", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled\n\nFix missuse of spin_lock_irq()/spin_unlock_irq() when\nspin_lock_irqsave()/spin_lock_irqrestore() was hold.\n\nThis was discovered through the lock debugging, and the corresponding\nlog is as follows:\n\nraw_local_irq_restore() called with IRQs enabled\nWARNING: CPU: 96 PID: 2074 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x30/0x40\n...\nCall trace:\n warn_bogus_irq_restore+0x30/0x40\n _raw_spin_unlock_irqrestore+0x84/0xc8\n add_qp_to_list+0x11c/0x148 [hns_roce_hw_v2]\n hns_roce_create_qp_common.constprop.0+0x240/0x780 [hns_roce_hw_v2]\n hns_roce_create_qp+0x98/0x160 [hns_roce_hw_v2]\n create_qp+0x138/0x258\n ib_create_qp_kernel+0x50/0xe8\n create_mad_qp+0xa8/0x128\n ib_mad_port_open+0x218/0x448\n ib_mad_init_device+0x70/0x1f8\n add_client_context+0xfc/0x220\n enable_device_and_get+0xd0/0x140\n ib_register_device.part.0+0xf4/0x1c8\n ib_register_device+0x34/0x50\n hns_roce_register_device+0x174/0x3d0 [hns_roce_hw_v2]\n hns_roce_init+0xfc/0x2c0 [hns_roce_hw_v2]\n __hns_roce_hw_v2_init_instance+0x7c/0x1d0 [hns_roce_hw_v2]\n hns_roce_hw_v2_init_instance+0x9c/0x180 [hns_roce_hw_v2]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47735" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--04e4a7d3-358a-44e7-8fb7-45bc1c896b2b.json b/objects/vulnerability/vulnerability--04e4a7d3-358a-44e7-8fb7-45bc1c896b2b.json new file mode 100644 index 00000000000..00e0124f610 --- /dev/null +++ b/objects/vulnerability/vulnerability--04e4a7d3-358a-44e7-8fb7-45bc1c896b2b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2fb70cfe-2f79-4791-8544-f3bcf1b072c2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--04e4a7d3-358a-44e7-8fb7-45bc1c896b2b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.686105Z", + "modified": "2024-10-22T00:37:16.686105Z", + "name": "CVE-2022-48986", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/gup: fix gup_pud_range() for dax\n\nFor dax pud, pud_huge() returns true on x86. So the function works as long\nas hugetlb is configured. However, dax doesn't depend on hugetlb.\nCommit 414fd080d125 (\"mm/gup: fix gup_pmd_range() for dax\") fixed\ndevmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as\nwell.\n\nThis fixes the below kernel panic:\n\ngeneral protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP\n\t< snip >\nCall Trace:\n\nget_user_pages_fast+0x1f/0x40\niov_iter_get_pages+0xc6/0x3b0\n? mempool_alloc+0x5d/0x170\nbio_iov_iter_get_pages+0x82/0x4e0\n? bvec_alloc+0x91/0xc0\n? bio_alloc_bioset+0x19a/0x2a0\nblkdev_direct_IO+0x282/0x480\n? __io_complete_rw_common+0xc0/0xc0\n? filemap_range_has_page+0x82/0xc0\ngeneric_file_direct_write+0x9d/0x1a0\n? inode_update_time+0x24/0x30\n__generic_file_write_iter+0xbd/0x1e0\nblkdev_write_iter+0xb4/0x150\n? io_import_iovec+0x8d/0x340\nio_write+0xf9/0x300\nio_issue_sqe+0x3c3/0x1d30\n? sysvec_reschedule_ipi+0x6c/0x80\n__io_queue_sqe+0x33/0x240\n? fget+0x76/0xa0\nio_submit_sqes+0xe6a/0x18d0\n? __fget_light+0xd1/0x100\n__x64_sys_io_uring_enter+0x199/0x880\n? __context_tracking_enter+0x1f/0x70\n? irqentry_exit_to_user_mode+0x24/0x30\n? irqentry_exit+0x1d/0x30\n? __context_tracking_exit+0xe/0x70\ndo_syscall_64+0x3b/0x90\nentry_SYSCALL_64_after_hwframe+0x61/0xcb\nRIP: 0033:0x7fc97c11a7be\n\t< snip >\n\n---[ end trace 48b2e0e67debcaeb ]---\nRIP: 0010:internal_get_user_pages_fast+0x340/0x990\n\t< snip >\nKernel panic - not syncing: Fatal exception\nKernel Offset: disabled", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48986" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--054695e3-b2c9-4698-ae96-d6eac1c63447.json b/objects/vulnerability/vulnerability--054695e3-b2c9-4698-ae96-d6eac1c63447.json new file mode 100644 index 00000000000..3d7fde83886 --- /dev/null +++ b/objects/vulnerability/vulnerability--054695e3-b2c9-4698-ae96-d6eac1c63447.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f634364f-5705-4f1d-9184-ae36f71b0e0d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--054695e3-b2c9-4698-ae96-d6eac1c63447", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.030401Z", + "modified": "2024-10-22T00:37:12.030401Z", + "name": "CVE-2024-49974", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Limit the number of concurrent async COPY operations\n\nNothing appears to limit the number of concurrent async COPY\noperations that clients can start. In addition, AFAICT each async\nCOPY can copy an unlimited number of 4MB chunks, so can run for a\nlong time. Thus IMO async COPY can become a DoS vector.\n\nAdd a restriction mechanism that bounds the number of concurrent\nbackground COPY operations. Start simple and try to be fair -- this\npatch implements a per-namespace limit.\n\nAn async COPY request that occurs while this limit is exceeded gets\nNFS4ERR_DELAY. The requesting client can choose to send the request\nagain after a delay or fall back to a traditional read/write style\ncopy.\n\nIf there is need to make the mechanism more sophisticated, we can\nvisit that in future patches.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49974" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--05b92c4f-0112-4695-b0fd-3e8ac78dd85d.json b/objects/vulnerability/vulnerability--05b92c4f-0112-4695-b0fd-3e8ac78dd85d.json new file mode 100644 index 00000000000..a785ed14e7d --- /dev/null +++ b/objects/vulnerability/vulnerability--05b92c4f-0112-4695-b0fd-3e8ac78dd85d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--95a85d95-389b-4855-960f-46116f45096e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--05b92c4f-0112-4695-b0fd-3e8ac78dd85d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.185462Z", + "modified": "2024-10-22T00:37:12.185462Z", + "name": "CVE-2024-49880", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix off by one issue in alloc_flex_gd()\n\nWesley reported an issue:\n\n==================================================================\nEXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks\n------------[ cut here ]------------\nkernel BUG at fs/ext4/resize.c:324!\nCPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27\nRIP: 0010:ext4_resize_fs+0x1212/0x12d0\nCall Trace:\n __ext4_ioctl+0x4e0/0x1800\n ext4_ioctl+0x12/0x20\n __x64_sys_ioctl+0x99/0xd0\n x64_sys_call+0x1206/0x20d0\n do_syscall_64+0x72/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n==================================================================\n\nWhile reviewing the patch, Honza found that when adjusting resize_bg in\nalloc_flex_gd(), it was possible for flex_gd->resize_bg to be bigger than\nflexbg_size.\n\nThe reproduction of the problem requires the following:\n\n o_group = flexbg_size * 2 * n;\n o_size = (o_group + 1) * group_size;\n n_group: [o_group + flexbg_size, o_group + flexbg_size * 2)\n o_size = (n_group + 1) * group_size;\n\nTake n=0,flexbg_size=16 as an example:\n\n last:15\n|o---------------|--------------n-|\no_group:0 resize to n_group:30\n\nThe corresponding reproducer is:\n\nimg=test.img\nrm -f $img\ntruncate -s 600M $img\nmkfs.ext4 -F $img -b 1024 -G 16 8M\ndev=`losetup -f --show $img`\nmkdir -p /tmp/test\nmount $dev /tmp/test\nresize2fs $dev 248M\n\nDelete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE()\nto prevent the issue from happening again.\n\n[ Note: another reproucer which this commit fixes is:\n\n img=test.img\n rm -f $img\n truncate -s 25MiB $img\n mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img\n truncate -s 3GiB $img\n dev=`losetup -f --show $img`\n mkdir -p /tmp/test\n mount $dev /tmp/test\n resize2fs $dev 3G\n umount $dev\n losetup -d $dev\n\n -- TYT ]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49880" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--05d554f5-072a-47bf-8965-793905b73424.json b/objects/vulnerability/vulnerability--05d554f5-072a-47bf-8965-793905b73424.json new file mode 100644 index 00000000000..89fcb60a295 --- /dev/null +++ b/objects/vulnerability/vulnerability--05d554f5-072a-47bf-8965-793905b73424.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--fe888f49-1f52-40ce-9d75-6bcb16fdd692", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--05d554f5-072a-47bf-8965-793905b73424", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.106232Z", + "modified": "2024-10-22T00:37:12.106232Z", + "name": "CVE-2024-49368", + "description": "Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49368" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--062d6eca-8cb8-41a9-bd5e-b3409f5001c0.json b/objects/vulnerability/vulnerability--062d6eca-8cb8-41a9-bd5e-b3409f5001c0.json new file mode 100644 index 00000000000..8620b0c5721 --- /dev/null +++ b/objects/vulnerability/vulnerability--062d6eca-8cb8-41a9-bd5e-b3409f5001c0.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b734b979-2080-4fcc-b9aa-3c11cbfae762", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--062d6eca-8cb8-41a9-bd5e-b3409f5001c0", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.092648Z", + "modified": "2024-10-22T00:37:12.092648Z", + "name": "CVE-2024-49940", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session->tunnel is non-NULL. However, session->tunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession->tunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession->tunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session->tunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session->tunnel set. Add a check for\nthis case.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49940" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--06617815-2fd9-4ff0-b85d-9c2b756a840f.json b/objects/vulnerability/vulnerability--06617815-2fd9-4ff0-b85d-9c2b756a840f.json new file mode 100644 index 00000000000..45a6bf8e8c3 --- /dev/null +++ b/objects/vulnerability/vulnerability--06617815-2fd9-4ff0-b85d-9c2b756a840f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--53a81b24-f2ee-473e-aee2-13c159ec1a6c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--06617815-2fd9-4ff0-b85d-9c2b756a840f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.198246Z", + "modified": "2024-10-22T00:37:12.198246Z", + "name": "CVE-2024-49888", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a sdiv overflow issue\n\nZac Ecob reported a problem where a bpf program may cause kernel crash due\nto the following error:\n Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI\n\nThe failure is due to the below signed divide:\n LLONG_MIN/-1 where LLONG_MIN equals to -9,223,372,036,854,775,808.\nLLONG_MIN/-1 is supposed to give a positive number 9,223,372,036,854,775,808,\nbut it is impossible since for 64-bit system, the maximum positive\nnumber is 9,223,372,036,854,775,807. On x86_64, LLONG_MIN/-1 will\ncause a kernel exception. On arm64, the result for LLONG_MIN/-1 is\nLLONG_MIN.\n\nFurther investigation found all the following sdiv/smod cases may trigger\nan exception when bpf program is running on x86_64 platform:\n - LLONG_MIN/-1 for 64bit operation\n - INT_MIN/-1 for 32bit operation\n - LLONG_MIN%-1 for 64bit operation\n - INT_MIN%-1 for 32bit operation\nwhere -1 can be an immediate or in a register.\n\nOn arm64, there are no exceptions:\n - LLONG_MIN/-1 = LLONG_MIN\n - INT_MIN/-1 = INT_MIN\n - LLONG_MIN%-1 = 0\n - INT_MIN%-1 = 0\nwhere -1 can be an immediate or in a register.\n\nInsn patching is needed to handle the above cases and the patched codes\nproduced results aligned with above arm64 result. The below are pseudo\ncodes to handle sdiv/smod exceptions including both divisor -1 and divisor 0\nand the divisor is stored in a register.\n\nsdiv:\n tmp = rX\n tmp += 1 /* [-1, 0] -> [0, 1]\n if tmp >(unsigned) 1 goto L2\n if tmp == 0 goto L1\n rY = 0\n L1:\n rY = -rY;\n goto L3\n L2:\n rY /= rX\n L3:\n\nsmod:\n tmp = rX\n tmp += 1 /* [-1, 0] -> [0, 1]\n if tmp >(unsigned) 1 goto L1\n if tmp == 1 (is64 ? goto L2 : goto L3)\n rY = 0;\n goto L2\n L1:\n rY %= rX\n L2:\n goto L4 // only when !is64\n L3:\n wY = wY // only when !is64\n L4:\n\n [1] https://lore.kernel.org/bpf/tPJLTEh7S_DxFEqAI2Ji5MBSoZVg7_G-Py2iaZpAaWtM961fFTWtsnlzwvTbzBzaUzwQAoNATXKUlt0LZOFgnDcIyKCswAnAGdUF3LBrhGQ=@protonmail.com/", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49888" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--070c8305-7bd4-480f-ac1f-ed543d4093cf.json b/objects/vulnerability/vulnerability--070c8305-7bd4-480f-ac1f-ed543d4093cf.json new file mode 100644 index 00000000000..e6e9779aa1c --- /dev/null +++ b/objects/vulnerability/vulnerability--070c8305-7bd4-480f-ac1f-ed543d4093cf.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--924521ab-c4f1-43b3-aac2-b1ecbf07cf9c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--070c8305-7bd4-480f-ac1f-ed543d4093cf", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.884402Z", + "modified": "2024-10-22T00:37:10.884402Z", + "name": "CVE-2024-47727", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/tdx: Fix \"in-kernel MMIO\" check\n\nTDX only supports kernel-initiated MMIO operations. The handle_mmio()\nfunction checks if the #VE exception occurred in the kernel and rejects\nthe operation if it did not.\n\nHowever, userspace can deceive the kernel into performing MMIO on its\nbehalf. For example, if userspace can point a syscall to an MMIO address,\nsyscall does get_user() or put_user() on it, triggering MMIO #VE. The\nkernel will treat the #VE as in-kernel MMIO.\n\nEnsure that the target MMIO address is within the kernel before decoding\ninstruction.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47727" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0723c8b4-b155-41a1-b0fe-ab4bd92210dc.json b/objects/vulnerability/vulnerability--0723c8b4-b155-41a1-b0fe-ab4bd92210dc.json new file mode 100644 index 00000000000..4383362c457 --- /dev/null +++ b/objects/vulnerability/vulnerability--0723c8b4-b155-41a1-b0fe-ab4bd92210dc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c6c2b5d6-7045-4035-b682-e4dfdbed21fa", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0723c8b4-b155-41a1-b0fe-ab4bd92210dc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.125406Z", + "modified": "2024-10-22T00:37:12.125406Z", + "name": "CVE-2024-49949", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: avoid potential underflow in qdisc_pkt_len_init() with UFO\n\nAfter commit 7c6d2ecbda83 (\"net: be more gentle about silly gso\nrequests coming from user\") virtio_net_hdr_to_skb() had sanity check\nto detect malicious attempts from user space to cook a bad GSO packet.\n\nThen commit cf9acc90c80ec (\"net: virtio_net_hdr_to_skb: count\ntransport header in UFO\") while fixing one issue, allowed user space\nto cook a GSO packet with the following characteristic :\n\nIPv4 SKB_GSO_UDP, gso_size=3, skb->len = 28.\n\nWhen this packet arrives in qdisc_pkt_len_init(), we end up\nwith hdr_len = 28 (IPv4 header + UDP header), matching skb->len\n\nThen the following sets gso_segs to 0 :\n\ngso_segs = DIV_ROUND_UP(skb->len - hdr_len,\n shinfo->gso_size);\n\nThen later we set qdisc_skb_cb(skb)->pkt_len to back to zero :/\n\nqdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len;\n\nThis leads to the following crash in fq_codel [1]\n\nqdisc_pkt_len_init() is best effort, we only want an estimation\nof the bytes sent on the wire, not crashing the kernel.\n\nThis patch is fixing this particular issue, a following one\nadds more sanity checks for another potential bug.\n\n[1]\n[ 70.724101] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 70.724561] #PF: supervisor read access in kernel mode\n[ 70.724561] #PF: error_code(0x0000) - not-present page\n[ 70.724561] PGD 10ac61067 P4D 10ac61067 PUD 107ee2067 PMD 0\n[ 70.724561] Oops: Oops: 0000 [#1] SMP NOPTI\n[ 70.724561] CPU: 11 UID: 0 PID: 2163 Comm: b358537762 Not tainted 6.11.0-virtme #991\n[ 70.724561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 70.724561] RIP: 0010:fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel\n[ 70.724561] Code: 24 08 49 c1 e1 06 44 89 7c 24 18 45 31 ed 45 31 c0 31 ff 89 44 24 14 4c 03 8b 90 01 00 00 eb 04 39 ca 73 37 4d 8b 39 83 c7 01 <49> 8b 17 49 89 11 41 8b 57 28 45 8b 5f 34 49 c7 07 00 00 00 00 49\nAll code\n========\n 0:\t24 08 \tand $0x8,%al\n 2:\t49 c1 e1 06 \tshl $0x6,%r9\n 6:\t44 89 7c 24 18 \tmov %r15d,0x18(%rsp)\n b:\t45 31 ed \txor %r13d,%r13d\n e:\t45 31 c0 \txor %r8d,%r8d\n 11:\t31 ff \txor %edi,%edi\n 13:\t89 44 24 14 \tmov %eax,0x14(%rsp)\n 17:\t4c 03 8b 90 01 00 00 \tadd 0x190(%rbx),%r9\n 1e:\teb 04 \tjmp 0x24\n 20:\t39 ca \tcmp %ecx,%edx\n 22:\t73 37 \tjae 0x5b\n 24:\t4d 8b 39 \tmov (%r9),%r15\n 27:\t83 c7 01 \tadd $0x1,%edi\n 2a:*\t49 8b 17 \tmov (%r15),%rdx\t\t<-- trapping instruction\n 2d:\t49 89 11 \tmov %rdx,(%r9)\n 30:\t41 8b 57 28 \tmov 0x28(%r15),%edx\n 34:\t45 8b 5f 34 \tmov 0x34(%r15),%r11d\n 38:\t49 c7 07 00 00 00 00 \tmovq $0x0,(%r15)\n 3f:\t49 \trex.WB\n\nCode starting with the faulting instruction\n===========================================\n 0:\t49 8b 17 \tmov (%r15),%rdx\n 3:\t49 89 11 \tmov %rdx,(%r9)\n 6:\t41 8b 57 28 \tmov 0x28(%r15),%edx\n a:\t45 8b 5f 34 \tmov 0x34(%r15),%r11d\n e:\t49 c7 07 00 00 00 00 \tmovq $0x0,(%r15)\n 15:\t49 \trex.WB\n[ 70.724561] RSP: 0018:ffff95ae85e6fb90 EFLAGS: 00000202\n[ 70.724561] RAX: 0000000002000000 RBX: ffff95ae841de000 RCX: 0000000000000000\n[ 70.724561] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001\n[ 70.724561] RBP: ffff95ae85e6fbf8 R08: 0000000000000000 R09: ffff95b710a30000\n[ 70.724561] R10: 0000000000000000 R11: bdf289445ce31881 R12: ffff95ae85e6fc58\n[ 70.724561] R13: 0000000000000000 R14: 0000000000000040 R15: 0000000000000000\n[ 70.724561] FS: 000000002c5c1380(0000) GS:ffff95bd7fcc0000(0000) knlGS:0000000000000000\n[ 70.724561] CS: 0010 DS: 0000 ES: 0000 C\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49949" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--07938b10-fe2f-48e3-8201-0081f807690e.json b/objects/vulnerability/vulnerability--07938b10-fe2f-48e3-8201-0081f807690e.json new file mode 100644 index 00000000000..29620f9ab8a --- /dev/null +++ b/objects/vulnerability/vulnerability--07938b10-fe2f-48e3-8201-0081f807690e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--786eaea8-25fc-4e0c-8125-9d419c88c0bd", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--07938b10-fe2f-48e3-8201-0081f807690e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.942738Z", + "modified": "2024-10-22T00:37:17.942738Z", + "name": "CVE-2022-49032", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: health: afe4404: Fix oob read in afe4404_[read|write]_raw\n\nKASAN report out-of-bounds read as follows:\n\nBUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380\nRead of size 4 at addr ffffffffc00e4658 by task cat/278\n\nCall Trace:\n afe4404_read_raw\n iio_read_channel_info\n dev_attr_show\n\nThe buggy address belongs to the variable:\n afe4404_channel_leds+0x18/0xffffffffffffe9c0\n\nThis issue can be reproduce by singe command:\n\n $ cat /sys/bus/i2c/devices/0-0058/iio\\:device0/in_intensity6_raw\n\nThe array size of afe4404_channel_leds and afe4404_channel_offdacs\nare less than channels, so access with chan->address cause OOB read\nin afe4404_[read|write]_raw. Fix it by moving access before use them.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49032" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--07be1a36-c60e-4229-a2ef-3ea17768154b.json b/objects/vulnerability/vulnerability--07be1a36-c60e-4229-a2ef-3ea17768154b.json new file mode 100644 index 00000000000..d1bfb4bba6d --- /dev/null +++ b/objects/vulnerability/vulnerability--07be1a36-c60e-4229-a2ef-3ea17768154b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--070feb6b-eef8-4fd7-a59f-f6dec04bb5d7", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--07be1a36-c60e-4229-a2ef-3ea17768154b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.178909Z", + "modified": "2024-10-22T00:37:12.178909Z", + "name": "CVE-2024-49960", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix timer use-after-free on failed mount\n\nSyzbot has found an ODEBUG bug in ext4_fill_super\n\nThe del_timer_sync function cancels the s_err_report timer,\nwhich reminds about filesystem errors daily. We should\nguarantee the timer is no longer active before kfree(sbi).\n\nWhen filesystem mounting fails, the flow goes to failed_mount3,\nwhere an error occurs when ext4_stop_mmpd is called, causing\na read I/O failure. This triggers the ext4_handle_error function\nthat ultimately re-arms the timer,\nleaving the s_err_report timer active before kfree(sbi) is called.\n\nFix the issue by canceling the s_err_report timer after calling ext4_stop_mmpd.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49960" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--07ddb06c-7730-4538-8e48-2ccced3b8162.json b/objects/vulnerability/vulnerability--07ddb06c-7730-4538-8e48-2ccced3b8162.json new file mode 100644 index 00000000000..75bdf390b80 --- /dev/null +++ b/objects/vulnerability/vulnerability--07ddb06c-7730-4538-8e48-2ccced3b8162.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c0b530c1-717f-459f-81e8-88e59021f6f1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--07ddb06c-7730-4538-8e48-2ccced3b8162", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.20079Z", + "modified": "2024-10-22T00:37:12.20079Z", + "name": "CVE-2024-49896", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check stream before comparing them\n\n[WHAT & HOW]\namdgpu_dm can pass a null stream to dc_is_stream_unchanged. It is\nnecessary to check for null before dereferencing them.\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49896" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0827da67-32b3-4937-b121-b12397703934.json b/objects/vulnerability/vulnerability--0827da67-32b3-4937-b121-b12397703934.json new file mode 100644 index 00000000000..19ba15b54d4 --- /dev/null +++ b/objects/vulnerability/vulnerability--0827da67-32b3-4937-b121-b12397703934.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5dfd2424-09d9-4211-a0e1-be1c8b3c6652", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0827da67-32b3-4937-b121-b12397703934", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.608423Z", + "modified": "2024-10-22T00:37:11.608423Z", + "name": "CVE-2024-40083", + "description": "A Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via sscanf reading the token and timezone JSON fields into a fixed-length buffer.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-40083" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--08295707-ad2d-4fd3-aa1c-7e81de366111.json b/objects/vulnerability/vulnerability--08295707-ad2d-4fd3-aa1c-7e81de366111.json new file mode 100644 index 00000000000..f56216f8cf5 --- /dev/null +++ b/objects/vulnerability/vulnerability--08295707-ad2d-4fd3-aa1c-7e81de366111.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--90e13e59-9bca-4958-9bde-7ec2debe6cb4", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--08295707-ad2d-4fd3-aa1c-7e81de366111", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.920254Z", + "modified": "2024-10-22T00:37:10.920254Z", + "name": "CVE-2024-47736", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: handle overlapped pclusters out of crafted images properly\n\nsyzbot reported a task hang issue due to a deadlock case where it is\nwaiting for the folio lock of a cached folio that will be used for\ncache I/Os.\n\nAfter looking into the crafted fuzzed image, I found it's formed with\nseveral overlapped big pclusters as below:\n\n Ext: logical offset | length : physical offset | length\n 0: 0.. 16384 | 16384 : 151552.. 167936 | 16384\n 1: 16384.. 32768 | 16384 : 155648.. 172032 | 16384\n 2: 32768.. 49152 | 16384 : 537223168.. 537239552 | 16384\n...\n\nHere, extent 0/1 are physically overlapped although it's entirely\n_impossible_ for normal filesystem images generated by mkfs.\n\nFirst, managed folios containing compressed data will be marked as\nup-to-date and then unlocked immediately (unlike in-place folios) when\ncompressed I/Os are complete. If physical blocks are not submitted in\nthe incremental order, there should be separate BIOs to avoid dependency\nissues. However, the current code mis-arranges z_erofs_fill_bio_vec()\nand BIO submission which causes unexpected BIO waits.\n\nSecond, managed folios will be connected to their own pclusters for\nefficient inter-queries. However, this is somewhat hard to implement\neasily if overlapped big pclusters exist. Again, these only appear in\nfuzzed images so let's simply fall back to temporary short-lived pages\nfor correctness.\n\nAdditionally, it justifies that referenced managed folios cannot be\ntruncated for now and reverts part of commit 2080ca1ed3e4 (\"erofs: tidy\nup `struct z_erofs_bvec`\") for simplicity although it shouldn't be any\ndifference.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47736" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--089b85c4-1f3b-4820-aec9-89994f8b3c03.json b/objects/vulnerability/vulnerability--089b85c4-1f3b-4820-aec9-89994f8b3c03.json new file mode 100644 index 00000000000..8c032c10fe8 --- /dev/null +++ b/objects/vulnerability/vulnerability--089b85c4-1f3b-4820-aec9-89994f8b3c03.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b8eaccde-87c8-4915-9ce3-146ab83e898b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--089b85c4-1f3b-4820-aec9-89994f8b3c03", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.647477Z", + "modified": "2024-10-22T00:37:16.647477Z", + "name": "CVE-2022-48995", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: raydium_ts_i2c - fix memory leak in raydium_i2c_send()\n\nThere is a kmemleak when test the raydium_i2c_ts with bpf mock device:\n\n unreferenced object 0xffff88812d3675a0 (size 8):\n comm \"python3\", pid 349, jiffies 4294741067 (age 95.695s)\n hex dump (first 8 bytes):\n 11 0e 10 c0 01 00 04 00 ........\n backtrace:\n [<0000000068427125>] __kmalloc+0x46/0x1b0\n [<0000000090180f91>] raydium_i2c_send+0xd4/0x2bf [raydium_i2c_ts]\n [<000000006e631aee>] raydium_i2c_initialize.cold+0xbc/0x3e4 [raydium_i2c_ts]\n [<00000000dc6fcf38>] raydium_i2c_probe+0x3cd/0x6bc [raydium_i2c_ts]\n [<00000000a310de16>] i2c_device_probe+0x651/0x680\n [<00000000f5a96bf3>] really_probe+0x17c/0x3f0\n [<00000000096ba499>] __driver_probe_device+0xe3/0x170\n [<00000000c5acb4d9>] driver_probe_device+0x49/0x120\n [<00000000264fe082>] __device_attach_driver+0xf7/0x150\n [<00000000f919423c>] bus_for_each_drv+0x114/0x180\n [<00000000e067feca>] __device_attach+0x1e5/0x2d0\n [<0000000054301fc2>] bus_probe_device+0x126/0x140\n [<00000000aad93b22>] device_add+0x810/0x1130\n [<00000000c086a53f>] i2c_new_client_device+0x352/0x4e0\n [<000000003c2c248c>] of_i2c_register_device+0xf1/0x110\n [<00000000ffec4177>] of_i2c_notify+0x100/0x160\n unreferenced object 0xffff88812d3675c8 (size 8):\n comm \"python3\", pid 349, jiffies 4294741070 (age 95.692s)\n hex dump (first 8 bytes):\n 22 00 36 2d 81 88 ff ff \".6-....\n backtrace:\n [<0000000068427125>] __kmalloc+0x46/0x1b0\n [<0000000090180f91>] raydium_i2c_send+0xd4/0x2bf [raydium_i2c_ts]\n [<000000001d5c9620>] raydium_i2c_initialize.cold+0x223/0x3e4 [raydium_i2c_ts]\n [<00000000dc6fcf38>] raydium_i2c_probe+0x3cd/0x6bc [raydium_i2c_ts]\n [<00000000a310de16>] i2c_device_probe+0x651/0x680\n [<00000000f5a96bf3>] really_probe+0x17c/0x3f0\n [<00000000096ba499>] __driver_probe_device+0xe3/0x170\n [<00000000c5acb4d9>] driver_probe_device+0x49/0x120\n [<00000000264fe082>] __device_attach_driver+0xf7/0x150\n [<00000000f919423c>] bus_for_each_drv+0x114/0x180\n [<00000000e067feca>] __device_attach+0x1e5/0x2d0\n [<0000000054301fc2>] bus_probe_device+0x126/0x140\n [<00000000aad93b22>] device_add+0x810/0x1130\n [<00000000c086a53f>] i2c_new_client_device+0x352/0x4e0\n [<000000003c2c248c>] of_i2c_register_device+0xf1/0x110\n [<00000000ffec4177>] of_i2c_notify+0x100/0x160\n\nAfter BANK_SWITCH command from i2c BUS, no matter success or error\nhappened, the tx_buf should be freed.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48995" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--08ef18b0-f7b4-4e28-b966-76436676bf33.json b/objects/vulnerability/vulnerability--08ef18b0-f7b4-4e28-b966-76436676bf33.json new file mode 100644 index 00000000000..717212078f4 --- /dev/null +++ b/objects/vulnerability/vulnerability--08ef18b0-f7b4-4e28-b966-76436676bf33.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e553c4b0-028e-4bfd-9700-a1b8dd4ff5e2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--08ef18b0-f7b4-4e28-b966-76436676bf33", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.002596Z", + "modified": "2024-10-22T00:37:12.002596Z", + "name": "CVE-2024-35314", + "description": "A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary scripts.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-35314" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--09e09481-78f9-4b2c-909b-8a9a4a6f6e73.json b/objects/vulnerability/vulnerability--09e09481-78f9-4b2c-909b-8a9a4a6f6e73.json new file mode 100644 index 00000000000..a804829fa42 --- /dev/null +++ b/objects/vulnerability/vulnerability--09e09481-78f9-4b2c-909b-8a9a4a6f6e73.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c002ceb5-b626-465c-a405-31a3e50b70bd", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--09e09481-78f9-4b2c-909b-8a9a4a6f6e73", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.099784Z", + "modified": "2024-10-22T00:37:12.099784Z", + "name": "CVE-2024-49958", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reserve space for inline xattr before attaching reflink tree\n\nOne of our customers reported a crash and a corrupted ocfs2 filesystem. \nThe crash was due to the detection of corruption. Upon troubleshooting,\nthe fsck -fn output showed the below corruption\n\n[EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record,\nbut fsck believes the largest valid value is 227. Clamp the next record value? n\n\nThe stat output from the debugfs.ocfs2 showed the following corruption\nwhere the \"Next Free Rec:\" had overshot the \"Count:\" in the root metadata\nblock.\n\n Inode: 33080590 Mode: 0640 Generation: 2619713622 (0x9c25a856)\n FS Generation: 904309833 (0x35e6ac49)\n CRC32: 00000000 ECC: 0000\n Type: Regular Attr: 0x0 Flags: Valid\n Dynamic Features: (0x16) HasXattr InlineXattr Refcounted\n Extended Attributes Block: 0 Extended Attributes Inline Size: 256\n User: 0 (root) Group: 0 (root) Size: 281320357888\n Links: 1 Clusters: 141738\n ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024\n atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024\n mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024\n dtime: 0x0 -- Wed Dec 31 17:00:00 1969\n Refcount Block: 2777346\n Last Extblk: 2886943 Orphan Slot: 0\n Sub Alloc Slot: 0 Sub Alloc Bit: 14\n Tree Depth: 1 Count: 227 Next Free Rec: 230\n ## Offset Clusters Block#\n 0 0 2310 2776351\n 1 2310 2139 2777375\n 2 4449 1221 2778399\n 3 5670 731 2779423\n 4 6401 566 2780447\n ....... .... .......\n ....... .... .......\n\nThe issue was in the reflink workfow while reserving space for inline\nxattr. The problematic function is ocfs2_reflink_xattr_inline(). By the\ntime this function is called the reflink tree is already recreated at the\ndestination inode from the source inode. At this point, this function\nreserves space for inline xattrs at the destination inode without even\nchecking if there is space at the root metadata block. It simply reduces\nthe l_count from 243 to 227 thereby making space of 256 bytes for inline\nxattr whereas the inode already has extents beyond this index (in this\ncase up to 230), thereby causing corruption.\n\nThe fix for this is to reserve space for inline metadata at the destination\ninode before the reflink tree gets recreated. The customer has verified the\nfix.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49958" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0a67219d-ee69-498a-ba99-8a4222b3ab7e.json b/objects/vulnerability/vulnerability--0a67219d-ee69-498a-ba99-8a4222b3ab7e.json new file mode 100644 index 00000000000..2922eda476c --- /dev/null +++ b/objects/vulnerability/vulnerability--0a67219d-ee69-498a-ba99-8a4222b3ab7e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b3f58a65-9800-4c4f-b602-a53b52cb8abe", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0a67219d-ee69-498a-ba99-8a4222b3ab7e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.70516Z", + "modified": "2024-10-22T00:37:11.70516Z", + "name": "CVE-2024-31007", + "description": "Buffer Overflow vulnerability in IrfanView 32bit v.4.66 allows a local attacker to cause a denial of service via a crafted file. Affected component is IrfanView 32bit 4.66 with plugin formats.dll.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-31007" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0a94c994-7ca9-41d0-ad0f-1d9354649816.json b/objects/vulnerability/vulnerability--0a94c994-7ca9-41d0-ad0f-1d9354649816.json new file mode 100644 index 00000000000..0487b7955a8 --- /dev/null +++ b/objects/vulnerability/vulnerability--0a94c994-7ca9-41d0-ad0f-1d9354649816.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--93c934a5-3311-4614-a1ed-3094cf1d54c5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0a94c994-7ca9-41d0-ad0f-1d9354649816", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.02438Z", + "modified": "2024-10-22T00:37:11.02438Z", + "name": "CVE-2024-50038", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xtables: avoid NFPROTO_UNSPEC where needed\n\nsyzbot managed to call xt_cluster match via ebtables:\n\n WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780\n [..]\n ebt_do_table+0x174b/0x2a40\n\nModule registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet\nprocessing. As this is only useful to restrict locally terminating\nTCP/UDP traffic, register this for ipv4 and ipv6 family only.\n\nPablo points out that this is a general issue, direct users of the\nset/getsockopt interface can call into targets/matches that were only\nintended for use with ip(6)tables.\n\nCheck all UNSPEC matches and targets for similar issues:\n\n- matches and targets are fine except if they assume skb_network_header()\n is valid -- this is only true when called from inet layer: ip(6) stack\n pulls the ip/ipv6 header into linear data area.\n- targets that return XT_CONTINUE or other xtables verdicts must be\n restricted too, they are incompatbile with the ebtables traverser, e.g.\n EBT_CONTINUE is a completely different value than XT_CONTINUE.\n\nMost matches/targets are changed to register for NFPROTO_IPV4/IPV6, as\nthey are provided for use by ip(6)tables.\n\nThe MARK target is also used by arptables, so register for NFPROTO_ARP too.\n\nWhile at it, bail out if connbytes fails to enable the corresponding\nconntrack family.\n\nThis change passes the selftests in iptables.git.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50038" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0b6d327a-a3b8-42d2-958f-26bb9af997c5.json b/objects/vulnerability/vulnerability--0b6d327a-a3b8-42d2-958f-26bb9af997c5.json new file mode 100644 index 00000000000..303ed064864 --- /dev/null +++ b/objects/vulnerability/vulnerability--0b6d327a-a3b8-42d2-958f-26bb9af997c5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1e15f6a9-1d2e-417d-8725-d9cd62581ce3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0b6d327a-a3b8-42d2-958f-26bb9af997c5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.136138Z", + "modified": "2024-10-22T00:37:12.136138Z", + "name": "CVE-2024-49922", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before using them\n\n[WHAT & HOW]\nThese pointers are null checked previously in the same function,\nindicating they might be null as reported by Coverity. As a result,\nthey need to be checked when used again.\n\nThis fixes 3 FORWARD_NULL issue reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49922" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0c969e68-e3c4-4c77-b743-2b4b75721315.json b/objects/vulnerability/vulnerability--0c969e68-e3c4-4c77-b743-2b4b75721315.json new file mode 100644 index 00000000000..21b67bec7c1 --- /dev/null +++ b/objects/vulnerability/vulnerability--0c969e68-e3c4-4c77-b743-2b4b75721315.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--958b0d3f-5255-4fbc-b2af-fdb26eb2dae6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0c969e68-e3c4-4c77-b743-2b4b75721315", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.624292Z", + "modified": "2024-10-22T00:37:11.624292Z", + "name": "CVE-2024-40085", + "description": "A Buffer Overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via pppoe_username and pppoe_password fields being larger than 128 bytes in length.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-40085" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0cb65b94-d003-40d8-842a-6a132c15a1b6.json b/objects/vulnerability/vulnerability--0cb65b94-d003-40d8-842a-6a132c15a1b6.json new file mode 100644 index 00000000000..65a2dbc486c --- /dev/null +++ b/objects/vulnerability/vulnerability--0cb65b94-d003-40d8-842a-6a132c15a1b6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--454d1b4f-5537-4041-8c4d-6d5885410540", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0cb65b94-d003-40d8-842a-6a132c15a1b6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.995397Z", + "modified": "2024-10-22T00:37:10.995397Z", + "name": "CVE-2024-50024", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix an unsafe loop on the list\n\nThe kernel may crash when deleting a genetlink family if there are still\nlisteners for that family:\n\nOops: Kernel access of bad area, sig: 11 [#1]\n ...\n NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0\n LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0\n Call Trace:\n__netlink_clear_multicast_users+0x74/0xc0\ngenl_unregister_family+0xd4/0x2d0\n\nChange the unsafe loop on the list to a safe one, because inside the\nloop there is an element removal from this list.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50024" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0cd313e2-8627-41e5-8641-1334e57ac9c6.json b/objects/vulnerability/vulnerability--0cd313e2-8627-41e5-8641-1334e57ac9c6.json new file mode 100644 index 00000000000..d08d9ae81b2 --- /dev/null +++ b/objects/vulnerability/vulnerability--0cd313e2-8627-41e5-8641-1334e57ac9c6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--bbea28a5-ab29-44d4-b96e-916b0c15ae69", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0cd313e2-8627-41e5-8641-1334e57ac9c6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.923191Z", + "modified": "2024-10-22T00:37:10.923191Z", + "name": "CVE-2024-47748", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost_vdpa: assign irq bypass producer token correctly\n\nWe used to call irq_bypass_unregister_producer() in\nvhost_vdpa_setup_vq_irq() which is problematic as we don't know if the\ntoken pointer is still valid or not.\n\nActually, we use the eventfd_ctx as the token so the life cycle of the\ntoken should be bound to the VHOST_SET_VRING_CALL instead of\nvhost_vdpa_setup_vq_irq() which could be called by set_status().\n\nFixing this by setting up irq bypass producer's token when handling\nVHOST_SET_VRING_CALL and un-registering the producer before calling\nvhost_vring_ioctl() to prevent a possible use after free as eventfd\ncould have been released in vhost_vring_ioctl(). And such registering\nand unregistering will only be done if DRIVER_OK is set.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47748" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0ce5bc91-a27d-4611-a230-a28fd3f13980.json b/objects/vulnerability/vulnerability--0ce5bc91-a27d-4611-a230-a28fd3f13980.json new file mode 100644 index 00000000000..0453d124232 --- /dev/null +++ b/objects/vulnerability/vulnerability--0ce5bc91-a27d-4611-a230-a28fd3f13980.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b6984229-3b66-4cb2-92bc-8e4506b9d394", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0ce5bc91-a27d-4611-a230-a28fd3f13980", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.117647Z", + "modified": "2024-10-22T00:37:12.117647Z", + "name": "CVE-2024-49928", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid reading out of bounds when loading TX power FW elements\n\nBecause the loop-expression will do one more time before getting false from\ncond-expression, the original code copied one more entry size beyond valid\nregion.\n\nFix it by moving the entry copy to loop-body.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49928" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0d059b77-41d0-418c-9178-98800570d0cb.json b/objects/vulnerability/vulnerability--0d059b77-41d0-418c-9178-98800570d0cb.json new file mode 100644 index 00000000000..403b52fbec2 --- /dev/null +++ b/objects/vulnerability/vulnerability--0d059b77-41d0-418c-9178-98800570d0cb.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1a03c8b3-c7aa-4e6d-9f90-3371dc130b8c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0d059b77-41d0-418c-9178-98800570d0cb", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.105042Z", + "modified": "2024-10-22T00:37:12.105042Z", + "name": "CVE-2024-49293", + "description": "Missing Authorization vulnerability in Rextheme WP VR allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 8.5.4.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49293" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0d5e365b-2ab5-4c77-a929-6aa5637393be.json b/objects/vulnerability/vulnerability--0d5e365b-2ab5-4c77-a929-6aa5637393be.json new file mode 100644 index 00000000000..aa9e5dcb807 --- /dev/null +++ b/objects/vulnerability/vulnerability--0d5e365b-2ab5-4c77-a929-6aa5637393be.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d54be49d-4920-4b9d-bc9f-99e4767f59de", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0d5e365b-2ab5-4c77-a929-6aa5637393be", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.873008Z", + "modified": "2024-10-22T00:37:10.873008Z", + "name": "CVE-2024-47709", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: Clear bo->bcm_proc_read after remove_proc_entry().\n\nsyzbot reported a warning in bcm_release(). [0]\n\nThe blamed change fixed another warning that is triggered when\nconnect() is issued again for a socket whose connect()ed device has\nbeen unregistered.\n\nHowever, if the socket is just close()d without the 2nd connect(), the\nremaining bo->bcm_proc_read triggers unnecessary remove_proc_entry()\nin bcm_release().\n\nLet's clear bo->bcm_proc_read after remove_proc_entry() in bcm_notify().\n\n[0]\nname '4986'\nWARNING: CPU: 0 PID: 5234 at fs/proc/generic.c:711 remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711\nModules linked in:\nCPU: 0 UID: 0 PID: 5234 Comm: syz-executor606 Not tainted 6.11.0-rc5-syzkaller-00178-g5517ae241919 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nRIP: 0010:remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711\nCode: ff eb 05 e8 cb 1e 5e ff 48 8b 5c 24 10 48 c7 c7 e0 f7 aa 8e e8 2a 38 8e 09 90 48 c7 c7 60 3a 1b 8c 48 89 de e8 da 42 20 ff 90 <0f> 0b 90 90 48 8b 44 24 18 48 c7 44 24 40 0e 36 e0 45 49 c7 04 07\nRSP: 0018:ffffc9000345fa20 EFLAGS: 00010246\nRAX: 2a2d0aee2eb64600 RBX: ffff888032f1f548 RCX: ffff888029431e00\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffc9000345fb08 R08: ffffffff8155b2f2 R09: 1ffff1101710519a\nR10: dffffc0000000000 R11: ffffed101710519b R12: ffff888011d38640\nR13: 0000000000000004 R14: 0000000000000000 R15: dffffc0000000000\nFS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fcfb52722f0 CR3: 000000000e734000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n bcm_release+0x250/0x880 net/can/bcm.c:1578\n __sock_release net/socket.c:659 [inline]\n sock_close+0xbc/0x240 net/socket.c:1421\n __fput+0x24a/0x8a0 fs/file_table.c:422\n task_work_run+0x24f/0x310 kernel/task_work.c:228\n exit_task_work include/linux/task_work.h:40 [inline]\n do_exit+0xa2f/0x27f0 kernel/exit.c:882\n do_group_exit+0x207/0x2c0 kernel/exit.c:1031\n __do_sys_exit_group kernel/exit.c:1042 [inline]\n __se_sys_exit_group kernel/exit.c:1040 [inline]\n __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040\n x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fcfb51ee969\nCode: Unable to access opcode bytes at 0x7fcfb51ee93f.\nRSP: 002b:00007ffce0109ca8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\nRAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fcfb51ee969\nRDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001\nRBP: 00007fcfb526f3b0 R08: ffffffffffffffb8 R09: 0000555500000000\nR10: 0000555500000000 R11: 0000000000000246 R12: 00007fcfb526f3b0\nR13: 0000000000000000 R14: 00007fcfb5271ee0 R15: 00007fcfb51bf160\n ", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47709" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0dae7800-e459-41da-95cc-b830f3af37ab.json b/objects/vulnerability/vulnerability--0dae7800-e459-41da-95cc-b830f3af37ab.json new file mode 100644 index 00000000000..ddc0fe85e9a --- /dev/null +++ b/objects/vulnerability/vulnerability--0dae7800-e459-41da-95cc-b830f3af37ab.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0d5abc97-402c-4229-a0b1-7d09de3aba52", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0dae7800-e459-41da-95cc-b830f3af37ab", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.186457Z", + "modified": "2024-10-22T00:37:12.186457Z", + "name": "CVE-2024-49273", + "description": "Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid.This issue affects ProfileGrid: from n/a through 5.9.3.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49273" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0dffe1cd-9cf2-4b20-994c-daae2abb6bb7.json b/objects/vulnerability/vulnerability--0dffe1cd-9cf2-4b20-994c-daae2abb6bb7.json new file mode 100644 index 00000000000..18634c8f22a --- /dev/null +++ b/objects/vulnerability/vulnerability--0dffe1cd-9cf2-4b20-994c-daae2abb6bb7.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6997f211-95b0-43db-a3db-66e7a9e1ba77", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0dffe1cd-9cf2-4b20-994c-daae2abb6bb7", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.969991Z", + "modified": "2024-10-22T00:37:10.969991Z", + "name": "CVE-2024-50026", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: wd33c93: Don't use stale scsi_pointer value\n\nA regression was introduced with commit dbb2da557a6a (\"scsi: wd33c93:\nMove the SCSI pointer to private command data\") which results in an oops\nin wd33c93_intr(). That commit added the scsi_pointer variable and\ninitialized it from hostdata->connected. However, during selection,\nhostdata->connected is not yet valid. Fix this by getting the current\nscsi_pointer from hostdata->selecting.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50026" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0e3c1db0-a60a-4ca7-a63d-53e388d6ec78.json b/objects/vulnerability/vulnerability--0e3c1db0-a60a-4ca7-a63d-53e388d6ec78.json new file mode 100644 index 00000000000..69c43742dae --- /dev/null +++ b/objects/vulnerability/vulnerability--0e3c1db0-a60a-4ca7-a63d-53e388d6ec78.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b93cc50d-391f-47c1-b71b-8c5ba4fbc1f1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0e3c1db0-a60a-4ca7-a63d-53e388d6ec78", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.170467Z", + "modified": "2024-10-22T00:37:12.170467Z", + "name": "CVE-2024-49916", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn401_init_hw` function. The issue could occur when `dc->clk_mgr` or\n`dc->clk_mgr->funcs` is null.\n\nThe fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is\nnot null before accessing its functions. This prevents a potential null\npointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn401/dcn401_hwseq.c:416 dcn401_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 225)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49916" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0e6b79d8-49bb-42de-afa4-8827d2add018.json b/objects/vulnerability/vulnerability--0e6b79d8-49bb-42de-afa4-8827d2add018.json new file mode 100644 index 00000000000..d4ebb5add60 --- /dev/null +++ b/objects/vulnerability/vulnerability--0e6b79d8-49bb-42de-afa4-8827d2add018.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--32f9d53b-0906-4933-8bc0-bb4f4439eaae", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0e6b79d8-49bb-42de-afa4-8827d2add018", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.834067Z", + "modified": "2024-10-22T00:37:10.834067Z", + "name": "CVE-2024-47680", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: check discard support for conventional zones\n\nAs the helper function f2fs_bdev_support_discard() shows, f2fs checks if\nthe target block devices support discard by calling\nbdev_max_discard_sectors() and bdev_is_zoned(). This check works well\nfor most cases, but it does not work for conventional zones on zoned\nblock devices. F2fs assumes that zoned block devices support discard,\nand calls __submit_discard_cmd(). When __submit_discard_cmd() is called\nfor sequential write required zones, it works fine since\n__submit_discard_cmd() issues zone reset commands instead of discard\ncommands. However, when __submit_discard_cmd() is called for\nconventional zones, __blkdev_issue_discard() is called even when the\ndevices do not support discard.\n\nThe inappropriate __blkdev_issue_discard() call was not a problem before\nthe commit 30f1e7241422 (\"block: move discard checks into the ioctl\nhandler\") because __blkdev_issue_discard() checked if the target devices\nsupport discard or not. If not, it returned EOPNOTSUPP. After the\ncommit, __blkdev_issue_discard() no longer checks it. It always returns\nzero and sets NULL to the given bio pointer. This NULL pointer triggers\nf2fs_bug_on() in __submit_discard_cmd(). The BUG is recreated with the\ncommands below at the umount step, where /dev/nullb0 is a zoned null_blk\nwith 5GB total size, 128MB zone size and 10 conventional zones.\n\n$ mkfs.f2fs -f -m /dev/nullb0\n$ mount /dev/nullb0 /mnt\n$ for ((i=0;i<5;i++)); do dd if=/dev/zero of=/mnt/test bs=65536 count=1600 conv=fsync; done\n$ umount /mnt\n\nTo fix the BUG, avoid the inappropriate __blkdev_issue_discard() call.\nWhen discard is requested for conventional zones, check if the device\nsupports discard or not. If not, return EOPNOTSUPP.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47680" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--0e7efeb3-a52c-4890-92b8-90e5386a8d0a.json b/objects/vulnerability/vulnerability--0e7efeb3-a52c-4890-92b8-90e5386a8d0a.json new file mode 100644 index 00000000000..63b6406e204 --- /dev/null +++ b/objects/vulnerability/vulnerability--0e7efeb3-a52c-4890-92b8-90e5386a8d0a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--75d09457-034d-4c25-8ffd-ba5d8996bb2a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--0e7efeb3-a52c-4890-92b8-90e5386a8d0a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.96625Z", + "modified": "2024-10-22T00:37:11.96625Z", + "name": "CVE-2024-35315", + "description": "A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an authenticated attacker to conduct a privilege escalation attack due to improper file validation. A successful exploit could allow an attacker to run arbitrary code with elevated privileges.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-35315" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--106cae7e-6df2-4635-8ba7-0f1edb37ea30.json b/objects/vulnerability/vulnerability--106cae7e-6df2-4635-8ba7-0f1edb37ea30.json new file mode 100644 index 00000000000..5f6fb7bde2b --- /dev/null +++ b/objects/vulnerability/vulnerability--106cae7e-6df2-4635-8ba7-0f1edb37ea30.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4237d8b9-e2a8-4027-8b87-f5c0c6326fc6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--106cae7e-6df2-4635-8ba7-0f1edb37ea30", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.846004Z", + "modified": "2024-10-22T00:37:10.846004Z", + "name": "CVE-2024-47189", + "description": "The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge of specific details to access non-sensitive user provisioning information and execute arbitrary SQL database commands.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47189" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--11092fa1-579e-4bb4-9532-ca646bf14d9b.json b/objects/vulnerability/vulnerability--11092fa1-579e-4bb4-9532-ca646bf14d9b.json new file mode 100644 index 00000000000..88225e43f36 --- /dev/null +++ b/objects/vulnerability/vulnerability--11092fa1-579e-4bb4-9532-ca646bf14d9b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--246b011e-f472-4dee-b52d-05031517dd15", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--11092fa1-579e-4bb4-9532-ca646bf14d9b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.87971Z", + "modified": "2024-10-22T00:37:10.87971Z", + "name": "CVE-2024-47724", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: use work queue to process beacon tx event\n\nCommit 3a415daa3e8b (\"wifi: ath11k: add P2P IE in beacon template\")\nfrom Feb 28, 2024 (linux-next), leads to the following Smatch static\nchecker warning:\n\ndrivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie()\nwarn: sleeping in atomic context\n\nThe reason is that ath11k_bcn_tx_status_event() will directly call might\nsleep function ath11k_wmi_cmd_send() during RCU read-side critical\nsections. The call trace is like:\n\nath11k_bcn_tx_status_event()\n-> rcu_read_lock()\n-> ath11k_mac_bcn_tx_event()\n\t-> ath11k_mac_setup_bcn_tmpl()\n\t……\n\t\t-> ath11k_wmi_bcn_tmpl()\n\t\t\t-> ath11k_wmi_cmd_send()\n-> rcu_read_unlock()\n\nCommit 886433a98425 (\"ath11k: add support for BSS color change\") added the\nath11k_mac_bcn_tx_event(), commit 01e782c89108 (\"ath11k: fix warning\nof RCU usage for ath11k_mac_get_arvif_by_vdev_id()\") added the RCU lock\nto avoid warning but also introduced this BUG.\n\nUse work queue to avoid directly calling ath11k_mac_bcn_tx_event()\nduring RCU critical sections. No need to worry about the deletion of vif\nbecause cancel_work_sync() will drop the work if it doesn't start or\nblock vif deletion until the running work is done.\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47724" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--118b439d-00ed-40b6-9d49-1cb05b8c8a11.json b/objects/vulnerability/vulnerability--118b439d-00ed-40b6-9d49-1cb05b8c8a11.json new file mode 100644 index 00000000000..d2eeca011d1 --- /dev/null +++ b/objects/vulnerability/vulnerability--118b439d-00ed-40b6-9d49-1cb05b8c8a11.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--71f238b5-0e0e-4885-9198-1844c796e07d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--118b439d-00ed-40b6-9d49-1cb05b8c8a11", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.992858Z", + "modified": "2024-10-22T00:37:10.992858Z", + "name": "CVE-2024-50028", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Reference count the zone in thermal_zone_get_by_id()\n\nThere are places in the thermal netlink code where nothing prevents\nthe thermal zone object from going away while being accessed after it\nhas been returned by thermal_zone_get_by_id().\n\nTo address this, make thermal_zone_get_by_id() get a reference on the\nthermal zone device object to be returned with the help of get_device(),\nunder thermal_list_lock, and adjust all of its callers to this change\nwith the help of the cleanup.h infrastructure.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50028" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--126e6282-fd6a-4114-a8c5-13375542a02f.json b/objects/vulnerability/vulnerability--126e6282-fd6a-4114-a8c5-13375542a02f.json new file mode 100644 index 00000000000..c9ee669220c --- /dev/null +++ b/objects/vulnerability/vulnerability--126e6282-fd6a-4114-a8c5-13375542a02f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e8eff074-d5a6-48e8-a508-87511caedc5d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--126e6282-fd6a-4114-a8c5-13375542a02f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.635609Z", + "modified": "2024-10-22T00:37:16.635609Z", + "name": "CVE-2022-48961", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mdio: fix unbalanced fwnode reference count in mdio_device_release()\n\nThere is warning report about of_node refcount leak\nwhile probing mdio device:\n\nOF: ERROR: memory leak, expected refcount 1 instead of 2,\nof_node_get()/of_node_put() unbalanced - destroy cset entry:\nattach overlay node /spi/soc@0/mdio@710700c0/ethernet@4\n\nIn of_mdiobus_register_device(), we increase fwnode refcount\nby fwnode_handle_get() before associating the of_node with\nmdio device, but it has never been decreased in normal path.\nSince that, in mdio_device_release(), it needs to call\nfwnode_handle_put() in addition instead of calling kfree()\ndirectly.\n\nAfter above, just calling mdio_device_free() in the error handle\npath of of_mdiobus_register_device() is enough to keep the\nrefcount balanced.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48961" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--12b3b662-fcea-4473-bf11-961811e1e3c6.json b/objects/vulnerability/vulnerability--12b3b662-fcea-4473-bf11-961811e1e3c6.json new file mode 100644 index 00000000000..317cf55d17c --- /dev/null +++ b/objects/vulnerability/vulnerability--12b3b662-fcea-4473-bf11-961811e1e3c6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1a52535e-6524-4dc6-abd2-f4f2cccaba22", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--12b3b662-fcea-4473-bf11-961811e1e3c6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.664312Z", + "modified": "2024-10-22T00:37:10.664312Z", + "name": "CVE-2024-45309", + "description": "OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-45309" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--12c52bbc-b2a1-4e4a-b8a7-d73c3de5052e.json b/objects/vulnerability/vulnerability--12c52bbc-b2a1-4e4a-b8a7-d73c3de5052e.json new file mode 100644 index 00000000000..cfb52acaf15 --- /dev/null +++ b/objects/vulnerability/vulnerability--12c52bbc-b2a1-4e4a-b8a7-d73c3de5052e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--709c6653-a9dd-49d6-91f0-b31e35e3c70f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--12c52bbc-b2a1-4e4a-b8a7-d73c3de5052e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.946444Z", + "modified": "2024-10-22T00:37:17.946444Z", + "name": "CVE-2022-49023", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: fix buffer overflow in elem comparison\n\nFor vendor elements, the code here assumes that 5 octets\nare present without checking. Since the element itself is\nalready checked to fit, we only need to check the length.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49023" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--12f748ca-387f-446c-80be-ee5851004dd1.json b/objects/vulnerability/vulnerability--12f748ca-387f-446c-80be-ee5851004dd1.json new file mode 100644 index 00000000000..c1d7255afc0 --- /dev/null +++ b/objects/vulnerability/vulnerability--12f748ca-387f-446c-80be-ee5851004dd1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--69a8a808-28de-4767-891a-65bc81196332", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--12f748ca-387f-446c-80be-ee5851004dd1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.936768Z", + "modified": "2024-10-22T00:37:10.936768Z", + "name": "CVE-2024-47734", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()\n\nsyzbot reported a WARNING in bond_xdp_get_xmit_slave. To reproduce\nthis[1], one bond device (bond1) has xdpdrv, which increases\nbpf_master_redirect_enabled_key. Another bond device (bond0) which is\nunsupported by XDP but its slave (veth3) has xdpgeneric that returns\nXDP_TX. This triggers WARN_ON_ONCE() from the xdp_master_redirect().\nTo reduce unnecessary warnings and improve log management, we need to\ndelete the WARN_ON_ONCE() and add ratelimit to the netdev_err().\n\n[1] Steps to reproduce:\n # Needs tx_xdp with return XDP_TX;\n ip l add veth0 type veth peer veth1\n ip l add veth3 type veth peer veth4\n ip l add bond0 type bond mode 6 # BOND_MODE_ALB, unsupported by XDP\n ip l add bond1 type bond # BOND_MODE_ROUNDROBIN by default\n ip l set veth0 master bond1\n ip l set bond1 up\n # Increases bpf_master_redirect_enabled_key\n ip l set dev bond1 xdpdrv object tx_xdp.o section xdp_tx\n ip l set veth3 master bond0\n ip l set bond0 up\n ip l set veth4 up\n # Triggers WARN_ON_ONCE() from the xdp_master_redirect()\n ip l set veth3 xdpgeneric object tx_xdp.o section xdp_tx", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47734" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--139332fd-0d69-4b1b-b667-03d26d041c23.json b/objects/vulnerability/vulnerability--139332fd-0d69-4b1b-b667-03d26d041c23.json new file mode 100644 index 00000000000..abf80ecc5bb --- /dev/null +++ b/objects/vulnerability/vulnerability--139332fd-0d69-4b1b-b667-03d26d041c23.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--200131c3-d4a9-42b9-a46c-82edb4ed7444", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--139332fd-0d69-4b1b-b667-03d26d041c23", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.554771Z", + "modified": "2024-10-22T00:37:10.554771Z", + "name": "CVE-2024-48231", + "description": "Funadmin 5.0.2 is vulnerable to SQL Injection.via the selectFields parameter in the index method of \\app\\backend\\controller\\auth\\Auth.php.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-48231" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--13b4e668-be63-4d5e-9d21-ab2a0fdd7d4a.json b/objects/vulnerability/vulnerability--13b4e668-be63-4d5e-9d21-ab2a0fdd7d4a.json new file mode 100644 index 00000000000..40f1998ba74 --- /dev/null +++ b/objects/vulnerability/vulnerability--13b4e668-be63-4d5e-9d21-ab2a0fdd7d4a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--00c1fe64-f4a7-475b-9a18-67700470a8e1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--13b4e668-be63-4d5e-9d21-ab2a0fdd7d4a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.60037Z", + "modified": "2024-10-22T00:37:10.60037Z", + "name": "CVE-2024-30160", + "description": "A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-30160" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--1538b174-24d9-4a86-8e7c-1abc93ba0364.json b/objects/vulnerability/vulnerability--1538b174-24d9-4a86-8e7c-1abc93ba0364.json new file mode 100644 index 00000000000..a38becb279b --- /dev/null +++ b/objects/vulnerability/vulnerability--1538b174-24d9-4a86-8e7c-1abc93ba0364.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e2a263aa-491f-4235-b07e-21b8027582b2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--1538b174-24d9-4a86-8e7c-1abc93ba0364", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.84211Z", + "modified": "2024-10-22T00:37:10.84211Z", + "name": "CVE-2024-47714", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: use hweight16 to get correct tx antenna\n\nThe chainmask is u16 so using hweight8 cannot get correct tx_ant.\nWithout this patch, the tx_ant of band 2 would be -1 and lead to the\nfollowing issue:\nBUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47714" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--16876896-cd0c-4198-acaa-f59bcd74c729.json b/objects/vulnerability/vulnerability--16876896-cd0c-4198-acaa-f59bcd74c729.json new file mode 100644 index 00000000000..d2ab43ab384 --- /dev/null +++ b/objects/vulnerability/vulnerability--16876896-cd0c-4198-acaa-f59bcd74c729.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--41ff2f9f-d7de-43f3-a5d4-c56d12b3b52b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--16876896-cd0c-4198-acaa-f59bcd74c729", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.964577Z", + "modified": "2024-10-22T00:37:17.964577Z", + "name": "CVE-2022-49028", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: Fix resource leak in ixgbevf_init_module()\n\nixgbevf_init_module() won't destroy the workqueue created by\ncreate_singlethread_workqueue() when pci_register_driver() failed. Add\ndestroy_workqueue() in fail path to prevent the resource leak.\n\nSimilar to the handling of u132_hcd_init in commit f276e002793c\n(\"usb: u132-hcd: fix resource leak\")", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49028" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--17502728-6b86-4e4a-97df-49854ef86f78.json b/objects/vulnerability/vulnerability--17502728-6b86-4e4a-97df-49854ef86f78.json new file mode 100644 index 00000000000..a440e7615e0 --- /dev/null +++ b/objects/vulnerability/vulnerability--17502728-6b86-4e4a-97df-49854ef86f78.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--19141072-259b-4bff-aebb-5d6eb66a6dbe", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--17502728-6b86-4e4a-97df-49854ef86f78", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.16382Z", + "modified": "2024-10-22T00:37:12.16382Z", + "name": "CVE-2024-49870", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix dentry leak in cachefiles_open_file()\n\nA dentry leak may be caused when a lookup cookie and a cull are concurrent:\n\n P1 | P2\n-----------------------------------------------------------\ncachefiles_lookup_cookie\n cachefiles_look_up_object\n lookup_one_positive_unlocked\n // get dentry\n cachefiles_cull\n inode->i_flags |= S_KERNEL_FILE;\n cachefiles_open_file\n cachefiles_mark_inode_in_use\n __cachefiles_mark_inode_in_use\n can_use = false\n if (!(inode->i_flags & S_KERNEL_FILE))\n can_use = true\n\t return false\n return false\n // Returns an error but doesn't put dentry\n\nAfter that the following WARNING will be triggered when the backend folder\nis umounted:\n\n==================================================================\nBUG: Dentry 000000008ad87947{i=7a,n=Dx_1_1.img} still in use (1) [unmount of ext4 sda]\nWARNING: CPU: 4 PID: 359261 at fs/dcache.c:1767 umount_check+0x5d/0x70\nCPU: 4 PID: 359261 Comm: umount Not tainted 6.6.0-dirty #25\nRIP: 0010:umount_check+0x5d/0x70\nCall Trace:\n \n d_walk+0xda/0x2b0\n do_one_tree+0x20/0x40\n shrink_dcache_for_umount+0x2c/0x90\n generic_shutdown_super+0x20/0x160\n kill_block_super+0x1a/0x40\n ext4_kill_sb+0x22/0x40\n deactivate_locked_super+0x35/0x80\n cleanup_mnt+0x104/0x160\n==================================================================\n\nWhether cachefiles_open_file() returns true or false, the reference count\nobtained by lookup_positive_unlocked() in cachefiles_look_up_object()\nshould be released.\n\nTherefore release that reference count in cachefiles_look_up_object() to\nfix the above issue and simplify the code.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49870" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--176487f5-fe61-48b8-98b2-c1a3be1ce937.json b/objects/vulnerability/vulnerability--176487f5-fe61-48b8-98b2-c1a3be1ce937.json new file mode 100644 index 00000000000..c77b24a46d8 --- /dev/null +++ b/objects/vulnerability/vulnerability--176487f5-fe61-48b8-98b2-c1a3be1ce937.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--394f7776-9617-4cfe-850e-d3e33ee6a608", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--176487f5-fe61-48b8-98b2-c1a3be1ce937", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.011713Z", + "modified": "2024-10-22T00:37:11.011713Z", + "name": "CVE-2024-50060", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: check if we need to reschedule during overflow flush\n\nIn terms of normal application usage, this list will always be empty.\nAnd if an application does overflow a bit, it'll have a few entries.\nHowever, nothing obviously prevents syzbot from running a test case\nthat generates a ton of overflow entries, and then flushing them can\ntake quite a while.\n\nCheck for needing to reschedule while flushing, and drop our locks and\ndo so if necessary. There's no state to maintain here as overflows\nalways prune from head-of-list, hence it's fine to drop and reacquire\nthe locks at the end of the loop.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50060" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--17b6d4a3-1102-4622-ad58-9878e79f7df9.json b/objects/vulnerability/vulnerability--17b6d4a3-1102-4622-ad58-9878e79f7df9.json new file mode 100644 index 00000000000..7ddec0e570b --- /dev/null +++ b/objects/vulnerability/vulnerability--17b6d4a3-1102-4622-ad58-9878e79f7df9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--af16ca2d-44ec-4646-9044-a6e411679c20", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--17b6d4a3-1102-4622-ad58-9878e79f7df9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.15317Z", + "modified": "2024-10-22T00:37:12.15317Z", + "name": "CVE-2024-49988", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add refcnt to ksmbd_conn struct\n\nWhen sending an oplock break request, opinfo->conn is used,\nBut freed ->conn can be used on multichannel.\nThis patch add a reference count to the ksmbd_conn struct\nso that it can be freed when it is no longer used.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49988" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--185a4b9c-68e8-4f39-88e1-4eaa22127479.json b/objects/vulnerability/vulnerability--185a4b9c-68e8-4f39-88e1-4eaa22127479.json new file mode 100644 index 00000000000..845ad4bebbb --- /dev/null +++ b/objects/vulnerability/vulnerability--185a4b9c-68e8-4f39-88e1-4eaa22127479.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3eb85bfc-7ec7-48fb-9e16-756c05f03844", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--185a4b9c-68e8-4f39-88e1-4eaa22127479", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.857744Z", + "modified": "2024-10-22T00:37:10.857744Z", + "name": "CVE-2024-47703", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, lsm: Add check for BPF LSM return value\n\nA bpf prog returning a positive number attached to file_alloc_security\nhook makes kernel panic.\n\nThis happens because file system can not filter out the positive number\nreturned by the LSM prog using IS_ERR, and misinterprets this positive\nnumber as a file pointer.\n\nGiven that hook file_alloc_security never returned positive number\nbefore the introduction of BPF LSM, and other BPF LSM hooks may\nencounter similar issues, this patch adds LSM return value check\nin verifier, to ensure no unexpected value is returned.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47703" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--189ced65-0576-4d69-9d4e-6cf3d8fc1d43.json b/objects/vulnerability/vulnerability--189ced65-0576-4d69-9d4e-6cf3d8fc1d43.json new file mode 100644 index 00000000000..3ad8d8dcfe4 --- /dev/null +++ b/objects/vulnerability/vulnerability--189ced65-0576-4d69-9d4e-6cf3d8fc1d43.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--341441d4-41ae-43c1-911a-e79473b36c71", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--189ced65-0576-4d69-9d4e-6cf3d8fc1d43", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.027618Z", + "modified": "2024-10-22T00:37:11.027618Z", + "name": "CVE-2024-50018", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: napi: Prevent overflow of napi_defer_hard_irqs\n\nIn commit 6f8b12d661d0 (\"net: napi: add hard irqs deferral feature\")\nnapi_defer_irqs was added to net_device and napi_defer_irqs_count was\nadded to napi_struct, both as type int.\n\nThis value never goes below zero, so there is not reason for it to be a\nsigned int. Change the type for both from int to u32, and add an\noverflow check to sysfs to limit the value to S32_MAX.\n\nThe limit of S32_MAX was chosen because the practical limit before this\npatch was S32_MAX (anything larger was an overflow) and thus there are\nno behavioral changes introduced. If the extra bit is needed in the\nfuture, the limit can be raised.\n\nBefore this patch:\n\n$ sudo bash -c 'echo 2147483649 > /sys/class/net/eth4/napi_defer_hard_irqs'\n$ cat /sys/class/net/eth4/napi_defer_hard_irqs\n-2147483647\n\nAfter this patch:\n\n$ sudo bash -c 'echo 2147483649 > /sys/class/net/eth4/napi_defer_hard_irqs'\nbash: line 0: echo: write error: Numerical result out of range\n\nSimilarly, /sys/class/net/XXXXX/tx_queue_len is defined as unsigned:\n\ninclude/linux/netdevice.h: unsigned int tx_queue_len;\n\nAnd has an overflow check:\n\ndev_change_tx_queue_len(..., unsigned long new_len):\n\n if (new_len != (unsigned int)new_len)\n return -ERANGE;", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50018" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--18b9f07c-8625-44fa-b694-1d8f3a4b3421.json b/objects/vulnerability/vulnerability--18b9f07c-8625-44fa-b694-1d8f3a4b3421.json new file mode 100644 index 00000000000..f64d6376431 --- /dev/null +++ b/objects/vulnerability/vulnerability--18b9f07c-8625-44fa-b694-1d8f3a4b3421.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a6feb0ab-b7ec-430c-8bf3-e9351ee7105e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--18b9f07c-8625-44fa-b694-1d8f3a4b3421", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.978006Z", + "modified": "2024-10-22T00:37:10.978006Z", + "name": "CVE-2024-50022", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevice-dax: correct pgoff align in dax_set_mapping()\n\npgoff should be aligned using ALIGN_DOWN() instead of ALIGN(). Otherwise,\nvmf->address not aligned to fault_size will be aligned to the next\nalignment, that can result in memory failure getting the wrong address.\n\nIt's a subtle situation that only can be observed in\npage_mapped_in_vma() after the page is page fault handled by\ndev_dax_huge_fault. Generally, there is little chance to perform\npage_mapped_in_vma in dev-dax's page unless in specific error injection\nto the dax device to trigger an MCE - memory-failure. In that case,\npage_mapped_in_vma() will be triggered to determine which task is\naccessing the failure address and kill that task in the end.\n\n\nWe used self-developed dax device (which is 2M aligned mapping) , to\nperform error injection to random address. It turned out that error\ninjected to non-2M-aligned address was causing endless MCE until panic.\nBecause page_mapped_in_vma() kept resulting wrong address and the task\naccessing the failure address was never killed properly:\n\n\n[ 3783.719419] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3784.049006] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3784.049190] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3784.448042] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3784.448186] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3784.792026] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3784.792179] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3785.162502] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3785.162633] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3785.461116] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3785.461247] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3785.764730] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3785.764859] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3786.042128] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3786.042259] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3786.464293] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3786.464423] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3786.818090] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3786.818217] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n[ 3787.085297] mce: Uncorrected hardware memory error in user-access at \n200c9742380\n[ 3787.085424] Memory failure: 0x200c9742: recovery action for dax page: \nRecovered\n\nIt took us several weeks to pinpoint this problem,  but we eventually\nused bpftrace to trace the page fault and mce address and successfully\nidentified the issue.\n\n\nJoao added:\n\n; Likely we never reproduce in production because we always pin\n: device-dax regions in the region align they provide (Qemu does\n: similarly with prealloc in hugetlb/file backed memory). I think this\n: bug requires that we touch *unpinned* device-dax regions unaligned to\n: the device-dax selected alignment (page size i.e. 4K/2M/1G)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50022" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--1934d95e-1803-4354-b3e4-1a24379ce9c0.json b/objects/vulnerability/vulnerability--1934d95e-1803-4354-b3e4-1a24379ce9c0.json new file mode 100644 index 00000000000..f87e46c6aad --- /dev/null +++ b/objects/vulnerability/vulnerability--1934d95e-1803-4354-b3e4-1a24379ce9c0.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--85f92ad8-e80c-4f53-be05-e00abf94c0d5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--1934d95e-1803-4354-b3e4-1a24379ce9c0", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.597784Z", + "modified": "2024-10-22T00:37:11.597784Z", + "name": "CVE-2024-40746", + "description": "A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `description` parameter of any product. The `description `parameter is not sanitised in the backend.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-40746" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--19f7f527-ed52-46c6-9c83-dfd668b08c1b.json b/objects/vulnerability/vulnerability--19f7f527-ed52-46c6-9c83-dfd668b08c1b.json new file mode 100644 index 00000000000..f379e014ac8 --- /dev/null +++ b/objects/vulnerability/vulnerability--19f7f527-ed52-46c6-9c83-dfd668b08c1b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--03ecb3c1-e8d0-4250-ae37-29723cb947db", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--19f7f527-ed52-46c6-9c83-dfd668b08c1b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.009708Z", + "modified": "2024-10-22T00:37:11.009708Z", + "name": "CVE-2024-50048", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Fix a NULL pointer dereference issue in fbcon_putcs\n\nsyzbot has found a NULL pointer dereference bug in fbcon.\nHere is the simplified C reproducer:\n\nstruct param {\n\tuint8_t type;\n\tstruct tiocl_selection ts;\n};\n\nint main()\n{\n\tstruct fb_con2fbmap con2fb;\n\tstruct param param;\n\n\tint fd = open(\"/dev/fb1\", 0, 0);\n\n\tcon2fb.console = 0x19;\n\tcon2fb.framebuffer = 0;\n\tioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);\n\n\tparam.type = 2;\n\tparam.ts.xs = 0; param.ts.ys = 0;\n\tparam.ts.xe = 0; param.ts.ye = 0;\n\tparam.ts.sel_mode = 0;\n\n\tint fd1 = open(\"/dev/tty1\", O_RDWR, 0);\n\tioctl(fd1, TIOCLINUX, ¶m);\n\n\tcon2fb.console = 1;\n\tcon2fb.framebuffer = 0;\n\tioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);\n\n\treturn 0;\n}\n\nAfter calling ioctl(fd1, TIOCLINUX, ¶m), the subsequent ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb)\ncauses the kernel to follow a different execution path:\n\n set_con2fb_map\n -> con2fb_init_display\n -> fbcon_set_disp\n -> redraw_screen\n -> hide_cursor\n -> clear_selection\n -> highlight\n -> invert_screen\n -> do_update_region\n -> fbcon_putcs\n -> ops->putcs\n\nSince ops->putcs is a NULL pointer, this leads to a kernel panic.\nTo prevent this, we need to call set_blitting_type() within set_con2fb_map()\nto properly initialize ops->putcs.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50048" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--1a5056e3-23ac-451b-be24-7b63b30e3891.json b/objects/vulnerability/vulnerability--1a5056e3-23ac-451b-be24-7b63b30e3891.json new file mode 100644 index 00000000000..bbac0693cc8 --- /dev/null +++ b/objects/vulnerability/vulnerability--1a5056e3-23ac-451b-be24-7b63b30e3891.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4a742fd5-ad71-429a-971c-3b1bb1e6a7c2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--1a5056e3-23ac-451b-be24-7b63b30e3891", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.702613Z", + "modified": "2024-10-22T00:37:16.702613Z", + "name": "CVE-2022-48987", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-dv-timings.c: fix too strict blanking sanity checks\n\nSanity checks were added to verify the v4l2_bt_timings blanking fields\nin order to avoid integer overflows when userspace passes weird values.\n\nBut that assumed that userspace would correctly fill in the front porch,\nbackporch and sync values, but sometimes all you know is the total\nblanking, which is then assigned to just one of these fields.\n\nAnd that can fail with these checks.\n\nSo instead set a maximum for the total horizontal and vertical\nblanking and check that each field remains below that.\n\nThat is still sufficient to avoid integer overflows, but it also\nallows for more flexibility in how userspace fills in these fields.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48987" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--1a69510e-7929-4842-b8fe-4e2cdbea5de8.json b/objects/vulnerability/vulnerability--1a69510e-7929-4842-b8fe-4e2cdbea5de8.json new file mode 100644 index 00000000000..683a28e5b07 --- /dev/null +++ b/objects/vulnerability/vulnerability--1a69510e-7929-4842-b8fe-4e2cdbea5de8.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--641c60c7-4ae7-4dc2-b627-0a532489e287", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--1a69510e-7929-4842-b8fe-4e2cdbea5de8", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.673216Z", + "modified": "2024-10-22T00:37:16.673216Z", + "name": "CVE-2022-48991", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\n\nAny codepath that zaps page table entries must invoke MMU notifiers to\nensure that secondary MMUs (like KVM) don't keep accessing pages which\naren't mapped anymore. Secondary MMUs don't hold their own references to\npages that are mirrored over, so failing to notify them can lead to page\nuse-after-free.\n\nI'm marking this as addressing an issue introduced in commit f3f0e1d2150b\n(\"khugepaged: add support of collapse for tmpfs/shmem pages\"), but most of\nthe security impact of this only came in commit 27e1f8273113 (\"khugepaged:\nenable collapse pmd for pte-mapped THP\"), which actually omitted flushes\nfor the removal of present PTEs, not just for the removal of empty page\ntables.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48991" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--1c3d0e7a-0104-4f2e-a7da-1e5054fdde0f.json b/objects/vulnerability/vulnerability--1c3d0e7a-0104-4f2e-a7da-1e5054fdde0f.json new file mode 100644 index 00000000000..615ef4aa405 --- /dev/null +++ b/objects/vulnerability/vulnerability--1c3d0e7a-0104-4f2e-a7da-1e5054fdde0f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a1c861ef-51dc-4d11-ba8b-e934f357681d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--1c3d0e7a-0104-4f2e-a7da-1e5054fdde0f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.668302Z", + "modified": "2024-10-22T00:37:16.668302Z", + "name": "CVE-2022-48976", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable_offload: fix using __this_cpu_add in preemptible\n\nflow_offload_queue_work() can be called in workqueue without\nbh disabled, like the call trace showed in my act_ct testing,\ncalling NF_FLOW_TABLE_STAT_INC() there would cause a call\ntrace:\n\n BUG: using __this_cpu_add() in preemptible [00000000] code: kworker/u4:0/138560\n caller is flow_offload_queue_work+0xec/0x1b0 [nf_flow_table]\n Workqueue: act_ct_workqueue tcf_ct_flow_table_cleanup_work [act_ct]\n Call Trace:\n \n dump_stack_lvl+0x33/0x46\n check_preemption_disabled+0xc3/0xf0\n flow_offload_queue_work+0xec/0x1b0 [nf_flow_table]\n nf_flow_table_iterate+0x138/0x170 [nf_flow_table]\n nf_flow_table_free+0x140/0x1a0 [nf_flow_table]\n tcf_ct_flow_table_cleanup_work+0x2f/0x2b0 [act_ct]\n process_one_work+0x6a3/0x1030\n worker_thread+0x8a/0xdf0\n\nThis patch fixes it by using NF_FLOW_TABLE_STAT_INC_ATOMIC()\ninstead in flow_offload_queue_work().\n\nNote that for FLOW_CLS_REPLACE branch in flow_offload_queue_work(),\nit may not be called in preemptible path, but it's good to use\nNF_FLOW_TABLE_STAT_INC_ATOMIC() for all cases in\nflow_offload_queue_work().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48976" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--1cabed5b-f2c5-4e41-9be0-01207b607be7.json b/objects/vulnerability/vulnerability--1cabed5b-f2c5-4e41-9be0-01207b607be7.json new file mode 100644 index 00000000000..b3bfcf6f52a --- /dev/null +++ b/objects/vulnerability/vulnerability--1cabed5b-f2c5-4e41-9be0-01207b607be7.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--84725c5f-9186-4edc-8eb6-e5efc5070ac7", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--1cabed5b-f2c5-4e41-9be0-01207b607be7", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.142835Z", + "modified": "2024-10-22T00:37:12.142835Z", + "name": "CVE-2024-49969", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in DCN30 color transformation\n\nThis commit addresses a potential index out of bounds issue in the\n`cm3_helper_translate_curve_to_hw_format` function in the DCN30 color\nmanagement module. The issue could occur when the index 'i' exceeds the\nnumber of transfer function points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds, the function returns\nfalse to indicate an error.\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49969" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--1de222fc-bec2-4548-af25-34ac94b0aae1.json b/objects/vulnerability/vulnerability--1de222fc-bec2-4548-af25-34ac94b0aae1.json new file mode 100644 index 00000000000..ecb08bba9c0 --- /dev/null +++ b/objects/vulnerability/vulnerability--1de222fc-bec2-4548-af25-34ac94b0aae1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--87ee03dd-6a53-42e1-bbde-0efefa6aadb2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--1de222fc-bec2-4548-af25-34ac94b0aae1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.473564Z", + "modified": "2024-10-22T00:37:12.473564Z", + "name": "CVE-2024-46238", + "description": "Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /admin/add-doctor.php and /admin/edit-doctor.php", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-46238" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--1e0b87fe-c8b5-4258-b73d-dea36cb9b485.json b/objects/vulnerability/vulnerability--1e0b87fe-c8b5-4258-b73d-dea36cb9b485.json new file mode 100644 index 00000000000..6c4d5aa084a --- /dev/null +++ b/objects/vulnerability/vulnerability--1e0b87fe-c8b5-4258-b73d-dea36cb9b485.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--23302920-f181-4bf1-bf70-dffa4f67af8b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--1e0b87fe-c8b5-4258-b73d-dea36cb9b485", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.071014Z", + "modified": "2024-10-22T00:37:12.071014Z", + "name": "CVE-2024-49878", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nresource: fix region_intersects() vs add_memory_driver_managed()\n\nOn a system with CXL memory, the resource tree (/proc/iomem) related to\nCXL memory may look like something as follows.\n\n490000000-50fffffff : CXL Window 0\n 490000000-50fffffff : region0\n 490000000-50fffffff : dax0.0\n 490000000-50fffffff : System RAM (kmem)\n\nBecause drivers/dax/kmem.c calls add_memory_driver_managed() during\nonlining CXL memory, which makes \"System RAM (kmem)\" a descendant of \"CXL\nWindow X\". This confuses region_intersects(), which expects all \"System\nRAM\" resources to be at the top level of iomem_resource. This can lead to\nbugs.\n\nFor example, when the following command line is executed to write some\nmemory in CXL memory range via /dev/mem,\n\n $ dd if=data of=/dev/mem bs=$((1 << 10)) seek=$((0x490000000 >> 10)) count=1\n dd: error writing '/dev/mem': Bad address\n 1+0 records in\n 0+0 records out\n 0 bytes copied, 0.0283507 s, 0.0 kB/s\n\nthe command fails as expected. However, the error code is wrong. It\nshould be \"Operation not permitted\" instead of \"Bad address\". More\nseriously, the /dev/mem permission checking in devmem_is_allowed() passes\nincorrectly. Although the accessing is prevented later because ioremap()\nisn't allowed to map system RAM, it is a potential security issue. During\ncommand executing, the following warning is reported in the kernel log for\ncalling ioremap() on system RAM.\n\n ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff\n WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d\n Call Trace:\n memremap+0xcb/0x184\n xlate_dev_mem_ptr+0x25/0x2f\n write_mem+0x94/0xfb\n vfs_write+0x128/0x26d\n ksys_write+0xac/0xfe\n do_syscall_64+0x9a/0xfd\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe details of command execution process are as follows. In the above\nresource tree, \"System RAM\" is a descendant of \"CXL Window 0\" instead of a\ntop level resource. So, region_intersects() will report no System RAM\nresources in the CXL memory region incorrectly, because it only checks the\ntop level resources. Consequently, devmem_is_allowed() will return 1\n(allow access via /dev/mem) for CXL memory region incorrectly. \nFortunately, ioremap() doesn't allow to map System RAM and reject the\naccess.\n\nSo, region_intersects() needs to be fixed to work correctly with the\nresource tree with \"System RAM\" not at top level as above. To fix it, if\nwe found a unmatched resource in the top level, we will continue to search\nmatched resources in its descendant resources. So, we will not miss any\nmatched resources in resource tree anymore.\n\nIn the new implementation, an example resource tree\n\n|------------- \"CXL Window 0\" ------------|\n|-- \"System RAM\" --|\n\nwill behave similar as the following fake resource tree for\nregion_intersects(, IORESOURCE_SYSTEM_RAM, ),\n\n|-- \"System RAM\" --||-- \"CXL Window 0a\" --|\n\nWhere \"CXL Window 0a\" is part of the original \"CXL Window 0\" that\nisn't covered by \"System RAM\".", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49878" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--1e445c1b-c36d-4f63-a396-3ac1d9c68ad7.json b/objects/vulnerability/vulnerability--1e445c1b-c36d-4f63-a396-3ac1d9c68ad7.json new file mode 100644 index 00000000000..13a68b7701c --- /dev/null +++ b/objects/vulnerability/vulnerability--1e445c1b-c36d-4f63-a396-3ac1d9c68ad7.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--12a7d0fd-3799-4431-a979-2952fcf0c733", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--1e445c1b-c36d-4f63-a396-3ac1d9c68ad7", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.902922Z", + "modified": "2024-10-22T00:37:10.902922Z", + "name": "CVE-2024-47723", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix out-of-bounds in dbNextAG() and diAlloc()\n\nIn dbNextAG() , there is no check for the case where bmp->db_numag is\ngreater or same than MAXAG due to a polluted image, which causes an\nout-of-bounds. Therefore, a bounds check should be added in dbMount().\n\nAnd in dbNextAG(), a check for the case where agpref is greater than\nbmp->db_numag should be added, so an out-of-bounds exception should be\nprevented.\n\nAdditionally, a check for the case where agno is greater or same than\nMAXAG should be added in diAlloc() to prevent out-of-bounds.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47723" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--20885786-34e3-43e5-94c8-3da0dbe68ea0.json b/objects/vulnerability/vulnerability--20885786-34e3-43e5-94c8-3da0dbe68ea0.json new file mode 100644 index 00000000000..6b535c903b2 --- /dev/null +++ b/objects/vulnerability/vulnerability--20885786-34e3-43e5-94c8-3da0dbe68ea0.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e8f3b120-8852-49a2-99ed-cfe20dc02cee", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--20885786-34e3-43e5-94c8-3da0dbe68ea0", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.94048Z", + "modified": "2024-10-22T00:37:10.94048Z", + "name": "CVE-2024-47682", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: Fix off-by-one error in sd_read_block_characteristics()\n\nFf the device returns page 0xb1 with length 8 (happens with qemu v2.x, for\nexample), sd_read_block_characteristics() may attempt an out-of-bounds\nmemory access when accessing the zoned field at offset 8.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47682" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--20905fca-b8df-4dc1-b071-61c833552034.json b/objects/vulnerability/vulnerability--20905fca-b8df-4dc1-b071-61c833552034.json new file mode 100644 index 00000000000..74a35f22df5 --- /dev/null +++ b/objects/vulnerability/vulnerability--20905fca-b8df-4dc1-b071-61c833552034.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4f40a75c-cb90-4e82-a0b3-ffe6a9c2be29", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--20905fca-b8df-4dc1-b071-61c833552034", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.999548Z", + "modified": "2024-10-22T00:37:10.999548Z", + "name": "CVE-2024-50040", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Do not bring the device up after non-fatal error\n\nCommit 004d25060c78 (\"igb: Fix igb_down hung on surprise removal\")\nchanged igb_io_error_detected() to ignore non-fatal pcie errors in order\nto avoid hung task that can happen when igb_down() is called multiple\ntimes. This caused an issue when processing transient non-fatal errors.\nigb_io_resume(), which is called after igb_io_error_detected(), assumes\nthat device is brought down by igb_io_error_detected() if the interface\nis up. This resulted in panic with stacktrace below.\n\n[ T3256] igb 0000:09:00.0 haeth0: igb: haeth0 NIC Link is Down\n[ T292] pcieport 0000:00:1c.5: AER: Uncorrected (Non-Fatal) error received: 0000:09:00.0\n[ T292] igb 0000:09:00.0: PCIe Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, (Requester ID)\n[ T292] igb 0000:09:00.0: device [8086:1537] error status/mask=00004000/00000000\n[ T292] igb 0000:09:00.0: [14] CmpltTO [ 200.105524,009][ T292] igb 0000:09:00.0: AER: TLP Header: 00000000 00000000 00000000 00000000\n[ T292] pcieport 0000:00:1c.5: AER: broadcast error_detected message\n[ T292] igb 0000:09:00.0: Non-correctable non-fatal error reported.\n[ T292] pcieport 0000:00:1c.5: AER: broadcast mmio_enabled message\n[ T292] pcieport 0000:00:1c.5: AER: broadcast resume message\n[ T292] ------------[ cut here ]------------\n[ T292] kernel BUG at net/core/dev.c:6539!\n[ T292] invalid opcode: 0000 [#1] PREEMPT SMP\n[ T292] RIP: 0010:napi_enable+0x37/0x40\n[ T292] Call Trace:\n[ T292] \n[ T292] ? die+0x33/0x90\n[ T292] ? do_trap+0xdc/0x110\n[ T292] ? napi_enable+0x37/0x40\n[ T292] ? do_error_trap+0x70/0xb0\n[ T292] ? napi_enable+0x37/0x40\n[ T292] ? napi_enable+0x37/0x40\n[ T292] ? exc_invalid_op+0x4e/0x70\n[ T292] ? napi_enable+0x37/0x40\n[ T292] ? asm_exc_invalid_op+0x16/0x20\n[ T292] ? napi_enable+0x37/0x40\n[ T292] igb_up+0x41/0x150\n[ T292] igb_io_resume+0x25/0x70\n[ T292] report_resume+0x54/0x70\n[ T292] ? report_frozen_detected+0x20/0x20\n[ T292] pci_walk_bus+0x6c/0x90\n[ T292] ? aer_print_port_info+0xa0/0xa0\n[ T292] pcie_do_recovery+0x22f/0x380\n[ T292] aer_process_err_devices+0x110/0x160\n[ T292] aer_isr+0x1c1/0x1e0\n[ T292] ? disable_irq_nosync+0x10/0x10\n[ T292] irq_thread_fn+0x1a/0x60\n[ T292] irq_thread+0xe3/0x1a0\n[ T292] ? irq_set_affinity_notifier+0x120/0x120\n[ T292] ? irq_affinity_notify+0x100/0x100\n[ T292] kthread+0xe2/0x110\n[ T292] ? kthread_complete_and_exit+0x20/0x20\n[ T292] ret_from_fork+0x2d/0x50\n[ T292] ? kthread_complete_and_exit+0x20/0x20\n[ T292] ret_from_fork_asm+0x11/0x20\n[ T292] \n\nTo fix this issue igb_io_resume() checks if the interface is running and\nthe device is not down this means igb_io_error_detected() did not bring\nthe device down and there is no need to bring it up.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50040" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2147b071-8502-4824-b533-a9f269f4da34.json b/objects/vulnerability/vulnerability--2147b071-8502-4824-b533-a9f269f4da34.json new file mode 100644 index 00000000000..45e59973b55 --- /dev/null +++ b/objects/vulnerability/vulnerability--2147b071-8502-4824-b533-a9f269f4da34.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4ea4f127-9fc2-456f-89ad-71e55f85543c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2147b071-8502-4824-b533-a9f269f4da34", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.097619Z", + "modified": "2024-10-22T00:37:12.097619Z", + "name": "CVE-2024-49923", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags\n\n[WHAT & HOW]\n\"dcn20_validate_apply_pipe_split_flags\" dereferences merge, and thus it\ncannot be a null pointer. Let's pass a valid pointer to avoid null\ndereference.\n\nThis fixes 2 FORWARD_NULL issues reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49923" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--21d09a80-26f2-469c-b0ff-99a803e72703.json b/objects/vulnerability/vulnerability--21d09a80-26f2-469c-b0ff-99a803e72703.json new file mode 100644 index 00000000000..a7e78f5dd8c --- /dev/null +++ b/objects/vulnerability/vulnerability--21d09a80-26f2-469c-b0ff-99a803e72703.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--047a6869-c64e-4b80-804d-119438fcd667", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--21d09a80-26f2-469c-b0ff-99a803e72703", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.952863Z", + "modified": "2024-10-22T00:37:17.952863Z", + "name": "CVE-2022-49007", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()\n\nSyzbot reported a null-ptr-deref bug:\n\n NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP\n frequency < 30 seconds\n general protection fault, probably for non-canonical address\n 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n CPU: 1 PID: 3603 Comm: segctord Not tainted\n 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0\n Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google\n 10/11/2022\n RIP: 0010:nilfs_palloc_commit_free_entry+0xe5/0x6b0\n fs/nilfs2/alloc.c:608\n Code: 00 00 00 00 fc ff df 80 3c 02 00 0f 85 cd 05 00 00 48 b8 00 00 00\n 00 00 fc ff df 4c 8b 73 08 49 8d 7e 10 48 89 fa 48 c1 ea 03 <80> 3c 02\n 00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7\n RSP: 0018:ffffc90003dff830 EFLAGS: 00010212\n RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d\n RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010\n RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f\n R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158\n R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004\n FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000)\n knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fb1c08316a8 CR3: 0000000018560000 CR4: 0000000000350ee0\n Call Trace:\n \n nilfs_dat_commit_free fs/nilfs2/dat.c:114 [inline]\n nilfs_dat_commit_end+0x464/0x5f0 fs/nilfs2/dat.c:193\n nilfs_dat_commit_update+0x26/0x40 fs/nilfs2/dat.c:236\n nilfs_btree_commit_update_v+0x87/0x4a0 fs/nilfs2/btree.c:1940\n nilfs_btree_commit_propagate_v fs/nilfs2/btree.c:2016 [inline]\n nilfs_btree_propagate_v fs/nilfs2/btree.c:2046 [inline]\n nilfs_btree_propagate+0xa00/0xd60 fs/nilfs2/btree.c:2088\n nilfs_bmap_propagate+0x73/0x170 fs/nilfs2/bmap.c:337\n nilfs_collect_file_data+0x45/0xd0 fs/nilfs2/segment.c:568\n nilfs_segctor_apply_buffers+0x14a/0x470 fs/nilfs2/segment.c:1018\n nilfs_segctor_scan_file+0x3f4/0x6f0 fs/nilfs2/segment.c:1067\n nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1197 [inline]\n nilfs_segctor_collect fs/nilfs2/segment.c:1503 [inline]\n nilfs_segctor_do_construct+0x12fc/0x6af0 fs/nilfs2/segment.c:2045\n nilfs_segctor_construct+0x8e3/0xb30 fs/nilfs2/segment.c:2379\n nilfs_segctor_thread_construct fs/nilfs2/segment.c:2487 [inline]\n nilfs_segctor_thread+0x3c3/0xf30 fs/nilfs2/segment.c:2570\n kthread+0x2e4/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n \n ...\n\nIf DAT metadata file is corrupted on disk, there is a case where\nreq->pr_desc_bh is NULL and blocknr is 0 at nilfs_dat_commit_end() during\na b-tree operation that cascadingly updates ancestor nodes of the b-tree,\nbecause nilfs_dat_commit_alloc() for a lower level block can initialize\nthe blocknr on the same DAT entry between nilfs_dat_prepare_end() and\nnilfs_dat_commit_end().\n\nIf this happens, nilfs_dat_commit_end() calls nilfs_dat_commit_free()\nwithout valid buffer heads in req->pr_desc_bh and req->pr_bitmap_bh, and\ncauses the NULL pointer dereference above in\nnilfs_palloc_commit_free_entry() function, which leads to a crash.\n\nFix this by adding a NULL check on req->pr_desc_bh and req->pr_bitmap_bh\nbefore nilfs_palloc_commit_free_entry() in nilfs_dat_commit_free().\n\nThis also calls nilfs_error() in that case to notify that there is a fatal\nflaw in the filesystem metadata and prevent further operations.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49007" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--21d6c095-3f18-4e46-8da0-9550501e04a4.json b/objects/vulnerability/vulnerability--21d6c095-3f18-4e46-8da0-9550501e04a4.json new file mode 100644 index 00000000000..974f6595625 --- /dev/null +++ b/objects/vulnerability/vulnerability--21d6c095-3f18-4e46-8da0-9550501e04a4.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--80896c6c-c5d1-4c0c-8655-661732e792ce", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--21d6c095-3f18-4e46-8da0-9550501e04a4", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.044964Z", + "modified": "2024-10-22T00:37:12.044964Z", + "name": "CVE-2024-49984", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Prevent out of bounds access in performance query extensions\n\nCheck that the number of perfmons userspace is passing in the copy and\nreset extensions is not greater than the internal kernel storage where\nthe ids will be copied into.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49984" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2231e0ac-256f-46dc-b28e-238256b657da.json b/objects/vulnerability/vulnerability--2231e0ac-256f-46dc-b28e-238256b657da.json new file mode 100644 index 00000000000..56ce702f341 --- /dev/null +++ b/objects/vulnerability/vulnerability--2231e0ac-256f-46dc-b28e-238256b657da.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8cb7e3b2-0bb2-435d-9df6-85a25da3d217", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2231e0ac-256f-46dc-b28e-238256b657da", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.97694Z", + "modified": "2024-10-22T00:37:10.97694Z", + "name": "CVE-2024-50008", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()\n\nReplace one-element array with a flexible-array member in\n`struct host_cmd_ds_802_11_scan_ext`.\n\nWith this, fix the following warning:\n\nelo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------\nelo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field \"ext_scan->tlv_buffer\" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1)\nelo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50008" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--22c780a8-8cb7-46fb-b53d-3f429fb86e59.json b/objects/vulnerability/vulnerability--22c780a8-8cb7-46fb-b53d-3f429fb86e59.json new file mode 100644 index 00000000000..9000be0a219 --- /dev/null +++ b/objects/vulnerability/vulnerability--22c780a8-8cb7-46fb-b53d-3f429fb86e59.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--31cf70c6-6ad3-4a39-8c88-8bea022fe501", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--22c780a8-8cb7-46fb-b53d-3f429fb86e59", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.149667Z", + "modified": "2024-10-22T00:37:12.149667Z", + "name": "CVE-2024-49887", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to don't panic system for no free segment fault injection\n\nf2fs: fix to don't panic system for no free segment fault injection\n\nsyzbot reports a f2fs bug as below:\n\nF2FS-fs (loop0): inject no free segment in get_new_segment of __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3167\nF2FS-fs (loop0): Stopped filesystem due to reason: 7\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/segment.c:2748!\nCPU: 0 UID: 0 PID: 5109 Comm: syz-executor304 Not tainted 6.11.0-rc6-syzkaller-00363-g89f5e14d05b4 #0\nRIP: 0010:get_new_segment fs/f2fs/segment.c:2748 [inline]\nRIP: 0010:new_curseg+0x1f61/0x1f70 fs/f2fs/segment.c:2836\nCall Trace:\n __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3167\n f2fs_allocate_new_section fs/f2fs/segment.c:3181 [inline]\n f2fs_allocate_pinning_section+0xfa/0x4e0 fs/f2fs/segment.c:3195\n f2fs_expand_inode_data+0x5d6/0xbb0 fs/f2fs/file.c:1799\n f2fs_fallocate+0x448/0x960 fs/f2fs/file.c:1903\n vfs_fallocate+0x553/0x6c0 fs/open.c:334\n do_vfs_ioctl+0x2592/0x2e50 fs/ioctl.c:886\n __do_sys_ioctl fs/ioctl.c:905 [inline]\n __se_sys_ioctl+0x81/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0010:get_new_segment fs/f2fs/segment.c:2748 [inline]\nRIP: 0010:new_curseg+0x1f61/0x1f70 fs/f2fs/segment.c:2836\n\nThe root cause is when we inject no free segment fault into f2fs,\nwe should not panic system, fix it.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49887" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--22fdec8d-b717-459e-ba81-544e11c8b915.json b/objects/vulnerability/vulnerability--22fdec8d-b717-459e-ba81-544e11c8b915.json new file mode 100644 index 00000000000..4a50d28b14b --- /dev/null +++ b/objects/vulnerability/vulnerability--22fdec8d-b717-459e-ba81-544e11c8b915.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0826cdeb-54ee-4dc0-818c-4b8a538b4ac8", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--22fdec8d-b717-459e-ba81-544e11c8b915", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.06557Z", + "modified": "2024-10-22T00:37:12.06557Z", + "name": "CVE-2024-49995", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: guard against string buffer overrun\n\nSmatch reports that copying media_name and if_name to name_parts may\noverwrite the destination.\n\n .../bearer.c:166 bearer_name_validate() error: strcpy() 'media_name' too large for 'name_parts->media_name' (32 vs 16)\n .../bearer.c:167 bearer_name_validate() error: strcpy() 'if_name' too large for 'name_parts->if_name' (1010102 vs 16)\n\nThis does seem to be the case so guard against this possibility by using\nstrscpy() and failing if truncation occurs.\n\nIntroduced by commit b97bf3fd8f6a (\"[TIPC] Initial merge\")\n\nCompile tested only.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49995" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--23386f52-66a3-4a95-8783-143a94c86bc6.json b/objects/vulnerability/vulnerability--23386f52-66a3-4a95-8783-143a94c86bc6.json new file mode 100644 index 00000000000..4f3f8be84da --- /dev/null +++ b/objects/vulnerability/vulnerability--23386f52-66a3-4a95-8783-143a94c86bc6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1a771e6d-da3c-4544-8ec4-3d5bca1cd39d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--23386f52-66a3-4a95-8783-143a94c86bc6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.015058Z", + "modified": "2024-10-22T00:37:12.015058Z", + "name": "CVE-2024-49876", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: fix UAF around queue destruction\n\nWe currently do stuff like queuing the final destruction step on a\nrandom system wq, which will outlive the driver instance. With bad\ntiming we can teardown the driver with one or more work workqueue still\nbeing alive leading to various UAF splats. Add a fini step to ensure\nuser queues are properly torn down. At this point GuC should already be\nnuked so queue itself should no longer be referenced from hw pov.\n\nv2 (Matt B)\n - Looks much safer to use a waitqueue and then just wait for the\n xa_array to become empty before triggering the drain.\n\n(cherry picked from commit 861108666cc0e999cffeab6aff17b662e68774e3)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49876" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2443ae1e-63d4-440b-9f2e-1325fba280ab.json b/objects/vulnerability/vulnerability--2443ae1e-63d4-440b-9f2e-1325fba280ab.json new file mode 100644 index 00000000000..8349f37ec87 --- /dev/null +++ b/objects/vulnerability/vulnerability--2443ae1e-63d4-440b-9f2e-1325fba280ab.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c79094d1-709d-4b55-b696-69f9bf343fb4", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2443ae1e-63d4-440b-9f2e-1325fba280ab", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.096004Z", + "modified": "2024-10-22T00:37:12.096004Z", + "name": "CVE-2024-49959", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error\n\nIn __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail()\nto recover some journal space. But if an error occurs while executing\njbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free\nspace right away, we try other branches, and if j_committing_transaction\nis NULL (i.e., the tid is 0), we will get the following complain:\n\n============================================\nJBD2: I/O error when updating journal superblock for sdd-8.\n__jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available\n__jbd2_log_wait_for_space: no way to get more journal space in sdd-8\n------------[ cut here ]------------\nWARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0\nModules linked in:\nCPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1\nRIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0\nCall Trace:\n \n add_transaction_credits+0x5d1/0x5e0\n start_this_handle+0x1ef/0x6a0\n jbd2__journal_start+0x18b/0x340\n ext4_dirty_inode+0x5d/0xb0\n __mark_inode_dirty+0xe4/0x5d0\n generic_update_time+0x60/0x70\n[...]\n============================================\n\nSo only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to\nclean up at the moment, continue to try to reclaim free space in other ways.\n\nNote that this fix relies on commit 6f6a6fda2945 (\"jbd2: fix ocfs2 corrupt\nwhen updating journal superblock fails\") to make jbd2_cleanup_journal_tail\nreturn the correct error code.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49959" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--24ae8173-4ea2-466d-a4eb-1a3494a9a598.json b/objects/vulnerability/vulnerability--24ae8173-4ea2-466d-a4eb-1a3494a9a598.json new file mode 100644 index 00000000000..892988d8d6e --- /dev/null +++ b/objects/vulnerability/vulnerability--24ae8173-4ea2-466d-a4eb-1a3494a9a598.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d6021d87-aa78-45b7-a80c-9ba714a6f664", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--24ae8173-4ea2-466d-a4eb-1a3494a9a598", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.840892Z", + "modified": "2024-10-22T00:37:10.840892Z", + "name": "CVE-2024-47717", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Don't zero-out PMU snapshot area before freeing data\n\nWith the latest Linux-6.11-rc3, the below NULL pointer crash is observed\nwhen SBI PMU snapshot is enabled for the guest and the guest is forcefully\npowered-off.\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000508\n Oops [#1]\n Modules linked in: kvm\n CPU: 0 UID: 0 PID: 61 Comm: term-poll Not tainted 6.11.0-rc3-00018-g44d7178dd77a #3\n Hardware name: riscv-virtio,qemu (DT)\n epc : __kvm_write_guest_page+0x94/0xa6 [kvm]\n ra : __kvm_write_guest_page+0x54/0xa6 [kvm]\n epc : ffffffff01590e98 ra : ffffffff01590e58 sp : ffff8f80001f39b0\n gp : ffffffff81512a60 tp : ffffaf80024872c0 t0 : ffffaf800247e000\n t1 : 00000000000007e0 t2 : 0000000000000000 s0 : ffff8f80001f39f0\n s1 : 00007fff89ac4000 a0 : ffffffff015dd7e8 a1 : 0000000000000086\n a2 : 0000000000000000 a3 : ffffaf8000000000 a4 : ffffaf80024882c0\n a5 : 0000000000000000 a6 : ffffaf800328d780 a7 : 00000000000001cc\n s2 : ffffaf800197bd00 s3 : 00000000000828c4 s4 : ffffaf800248c000\n s5 : ffffaf800247d000 s6 : 0000000000001000 s7 : 0000000000001000\n s8 : 0000000000000000 s9 : 00007fff861fd500 s10: 0000000000000001\n s11: 0000000000800000 t3 : 00000000000004d3 t4 : 00000000000004d3\n t5 : ffffffff814126e0 t6 : ffffffff81412700\n status: 0000000200000120 badaddr: 0000000000000508 cause: 000000000000000d\n [] __kvm_write_guest_page+0x94/0xa6 [kvm]\n [] kvm_vcpu_write_guest+0x56/0x90 [kvm]\n [] kvm_pmu_clear_snapshot_area+0x42/0x7e [kvm]\n [] kvm_riscv_vcpu_pmu_deinit.part.0+0xe0/0x14e [kvm]\n [] kvm_riscv_vcpu_pmu_deinit+0x1a/0x24 [kvm]\n [] kvm_arch_vcpu_destroy+0x28/0x4c [kvm]\n [] kvm_destroy_vcpus+0x5a/0xda [kvm]\n [] kvm_arch_destroy_vm+0x14/0x28 [kvm]\n [] kvm_destroy_vm+0x168/0x2a0 [kvm]\n [] kvm_put_kvm+0x3c/0x58 [kvm]\n [] kvm_vm_release+0x22/0x2e [kvm]\n\nClearly, the kvm_vcpu_write_guest() function is crashing because it is\nbeing called from kvm_pmu_clear_snapshot_area() upon guest tear down.\n\nTo address the above issue, simplify the kvm_pmu_clear_snapshot_area() to\nnot zero-out PMU snapshot area from kvm_pmu_clear_snapshot_area() because\nthe guest is anyway being tore down.\n\nThe kvm_pmu_clear_snapshot_area() is also called when guest changes\nPMU snapshot area of a VCPU but even in this case the previous PMU\nsnaphsot area must not be zeroed-out because the guest might have\nreclaimed the pervious PMU snapshot area for some other purpose.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47717" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--25548199-f49f-464e-b5f0-a982a29290c6.json b/objects/vulnerability/vulnerability--25548199-f49f-464e-b5f0-a982a29290c6.json new file mode 100644 index 00000000000..888d6f30825 --- /dev/null +++ b/objects/vulnerability/vulnerability--25548199-f49f-464e-b5f0-a982a29290c6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--cb1d9fb1-b85b-4c8a-8d36-62f4b85b7267", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--25548199-f49f-464e-b5f0-a982a29290c6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.648624Z", + "modified": "2024-10-22T00:37:11.648624Z", + "name": "CVE-2024-40090", + "description": "Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Information Disclosure. An information leak in the Boa webserver allows remote, unauthenticated attackers to leak memory addresses of uClibc and the stack via sending a GET request to the index page.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-40090" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2569bcf8-a72d-4ec4-a686-526f16ba731a.json b/objects/vulnerability/vulnerability--2569bcf8-a72d-4ec4-a686-526f16ba731a.json new file mode 100644 index 00000000000..479a4ce288f --- /dev/null +++ b/objects/vulnerability/vulnerability--2569bcf8-a72d-4ec4-a686-526f16ba731a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0f8d4850-2c8c-467c-ae42-c90f59e4a436", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2569bcf8-a72d-4ec4-a686-526f16ba731a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.110413Z", + "modified": "2024-10-22T00:37:12.110413Z", + "name": "CVE-2024-49994", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix integer overflow in BLKSECDISCARD\n\nI independently rediscovered\n\n\tcommit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155\n\tblock: fix overflow in blk_ioctl_discard()\n\nbut for secure erase.\n\nSame problem:\n\n\tuint64_t r[2] = {512, 18446744073709551104ULL};\n\tioctl(fd, BLKSECDISCARD, r);\n\nwill enter near infinite loop inside blkdev_issue_secure_erase():\n\n\ta.out: attempt to access beyond end of device\n\tloop0: rw=5, sector=3399043073, nr_sectors = 1024 limit=2048\n\tbio_check_eod: 3286214 callbacks suppressed", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49994" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--25784db7-ecdf-4506-a7bb-7be4f4bab62b.json b/objects/vulnerability/vulnerability--25784db7-ecdf-4506-a7bb-7be4f4bab62b.json new file mode 100644 index 00000000000..0773bf59cfe --- /dev/null +++ b/objects/vulnerability/vulnerability--25784db7-ecdf-4506-a7bb-7be4f4bab62b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--511bb5b2-c89e-48d7-99a5-9015813418d3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--25784db7-ecdf-4506-a7bb-7be4f4bab62b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.63029Z", + "modified": "2024-10-22T00:37:16.63029Z", + "name": "CVE-2022-48962", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hisilicon: Fix potential use-after-free in hisi_femac_rx()\n\nThe skb is delivered to napi_gro_receive() which may free it, after\ncalling this, dereferencing skb may trigger use-after-free.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48962" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2582d856-e8a2-44b4-a15f-1709066859d8.json b/objects/vulnerability/vulnerability--2582d856-e8a2-44b4-a15f-1709066859d8.json new file mode 100644 index 00000000000..a4f2c0bd94c --- /dev/null +++ b/objects/vulnerability/vulnerability--2582d856-e8a2-44b4-a15f-1709066859d8.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1609d397-77b0-4d75-bdd3-052990e293a6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2582d856-e8a2-44b4-a15f-1709066859d8", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.055825Z", + "modified": "2024-10-22T00:37:12.055825Z", + "name": "CVE-2024-49972", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Deallocate DML memory if allocation fails\n\n[Why]\nWhen DC state create DML memory allocation fails, memory is not\ndeallocated subsequently, resulting in uninitialized structure\nthat is not NULL.\n\n[How]\nDeallocate memory if DML memory allocation fails.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49972" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--25ecd17c-75ae-4c9d-b96e-d4df53b15c18.json b/objects/vulnerability/vulnerability--25ecd17c-75ae-4c9d-b96e-d4df53b15c18.json new file mode 100644 index 00000000000..6133869376f --- /dev/null +++ b/objects/vulnerability/vulnerability--25ecd17c-75ae-4c9d-b96e-d4df53b15c18.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e10321ed-82cd-405d-9796-a6d41635f8b8", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--25ecd17c-75ae-4c9d-b96e-d4df53b15c18", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.201896Z", + "modified": "2024-10-22T00:37:12.201896Z", + "name": "CVE-2024-49953", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice\n\nThe km.state is not checked in driver's delayed work. When\nxfrm_state_check_expire() is called, the state can be reset to\nXFRM_STATE_EXPIRED, even if it is XFRM_STATE_DEAD already. This\nhappens when xfrm state is deleted, but not freed yet. As\n__xfrm_state_delete() is called again in xfrm timer, the following\ncrash occurs.\n\nTo fix this issue, skip xfrm_state_check_expire() if km.state is not\nXFRM_STATE_VALID.\n\n Oops: general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP\n CPU: 5 UID: 0 PID: 7448 Comm: kworker/u102:2 Not tainted 6.11.0-rc2+ #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n Workqueue: mlx5e_ipsec: eth%d mlx5e_ipsec_handle_sw_limits [mlx5_core]\n RIP: 0010:__xfrm_state_delete+0x3d/0x1b0\n Code: 0f 84 8b 01 00 00 48 89 fd c6 87 c8 00 00 00 05 48 8d bb 40 10 00 00 e8 11 04 1a 00 48 8b 95 b8 00 00 00 48 8b 85 c0 00 00 00 <48> 89 42 08 48 89 10 48 8b 55 10 48 b8 00 01 00 00 00 00 ad de 48\n RSP: 0018:ffff88885f945ec8 EFLAGS: 00010246\n RAX: dead000000000122 RBX: ffffffff82afa940 RCX: 0000000000000036\n RDX: dead000000000100 RSI: 0000000000000000 RDI: ffffffff82afb980\n RBP: ffff888109a20340 R08: ffff88885f945ea0 R09: 0000000000000000\n R10: 0000000000000000 R11: ffff88885f945ff8 R12: 0000000000000246\n R13: ffff888109a20340 R14: ffff88885f95f420 R15: ffff88885f95f400\n FS: 0000000000000000(0000) GS:ffff88885f940000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f2163102430 CR3: 00000001128d6001 CR4: 0000000000370eb0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n \n ? die_addr+0x33/0x90\n ? exc_general_protection+0x1a2/0x390\n ? asm_exc_general_protection+0x22/0x30\n ? __xfrm_state_delete+0x3d/0x1b0\n ? __xfrm_state_delete+0x2f/0x1b0\n xfrm_timer_handler+0x174/0x350\n ? __xfrm_state_delete+0x1b0/0x1b0\n __hrtimer_run_queues+0x121/0x270\n hrtimer_run_softirq+0x88/0xd0\n handle_softirqs+0xcc/0x270\n do_softirq+0x3c/0x50\n \n \n __local_bh_enable_ip+0x47/0x50\n mlx5e_ipsec_handle_sw_limits+0x7d/0x90 [mlx5_core]\n process_one_work+0x137/0x2d0\n worker_thread+0x28d/0x3a0\n ? rescuer_thread+0x480/0x480\n kthread+0xb8/0xe0\n ? kthread_park+0x80/0x80\n ret_from_fork+0x2d/0x50\n ? kthread_park+0x80/0x80\n ret_from_fork_asm+0x11/0x20\n ", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49953" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--25fa4eb8-f7c8-4b06-9184-a1837120dd6b.json b/objects/vulnerability/vulnerability--25fa4eb8-f7c8-4b06-9184-a1837120dd6b.json new file mode 100644 index 00000000000..0fb43556f62 --- /dev/null +++ b/objects/vulnerability/vulnerability--25fa4eb8-f7c8-4b06-9184-a1837120dd6b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--814d005c-a477-46b6-b5d4-2ca214071339", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--25fa4eb8-f7c8-4b06-9184-a1837120dd6b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.001149Z", + "modified": "2024-10-22T00:37:12.001149Z", + "name": "CVE-2024-35286", + "description": "A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-35286" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--26120d79-9f19-494c-9e41-e9f485d605ad.json b/objects/vulnerability/vulnerability--26120d79-9f19-494c-9e41-e9f485d605ad.json new file mode 100644 index 00000000000..d155d5ce791 --- /dev/null +++ b/objects/vulnerability/vulnerability--26120d79-9f19-494c-9e41-e9f485d605ad.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4cabdfff-5d86-4775-b10b-afb31af46f16", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--26120d79-9f19-494c-9e41-e9f485d605ad", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.947803Z", + "modified": "2024-10-22T00:37:17.947803Z", + "name": "CVE-2022-49031", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: health: afe4403: Fix oob read in afe4403_read_raw\n\nKASAN report out-of-bounds read as follows:\n\nBUG: KASAN: global-out-of-bounds in afe4403_read_raw+0x42e/0x4c0\nRead of size 4 at addr ffffffffc02ac638 by task cat/279\n\nCall Trace:\n afe4403_read_raw\n iio_read_channel_info\n dev_attr_show\n\nThe buggy address belongs to the variable:\n afe4403_channel_leds+0x18/0xffffffffffffe9e0\n\nThis issue can be reproduced by singe command:\n\n $ cat /sys/bus/spi/devices/spi0.0/iio\\:device0/in_intensity6_raw\n\nThe array size of afe4403_channel_leds is less than channels, so access\nwith chan->address cause OOB read in afe4403_read_raw. Fix it by moving\naccess before use it.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49031" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--27b05989-f095-4719-be0b-fca1a94e0462.json b/objects/vulnerability/vulnerability--27b05989-f095-4719-be0b-fca1a94e0462.json new file mode 100644 index 00000000000..24ab658ffd9 --- /dev/null +++ b/objects/vulnerability/vulnerability--27b05989-f095-4719-be0b-fca1a94e0462.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8bb8225f-32a5-439c-8cf7-640cf0c7fc20", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--27b05989-f095-4719-be0b-fca1a94e0462", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.984067Z", + "modified": "2024-10-22T00:37:10.984067Z", + "name": "CVE-2024-50009", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: amd-pstate: add check for cpufreq_cpu_get's return value\n\ncpufreq_cpu_get may return NULL. To avoid NULL-dereference check it\nand return in case of error.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50009" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--27ea7961-b674-4278-b5c0-65ee43a4a2c6.json b/objects/vulnerability/vulnerability--27ea7961-b674-4278-b5c0-65ee43a4a2c6.json new file mode 100644 index 00000000000..873539c3ff0 --- /dev/null +++ b/objects/vulnerability/vulnerability--27ea7961-b674-4278-b5c0-65ee43a4a2c6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--334057af-5e68-4f68-b2f8-0c46e7ac5142", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--27ea7961-b674-4278-b5c0-65ee43a4a2c6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.022909Z", + "modified": "2024-10-22T00:37:12.022909Z", + "name": "CVE-2024-49885", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, slub: avoid zeroing kmalloc redzone\n\nSince commit 946fa0dbf2d8 (\"mm/slub: extend redzone check to extra\nallocated kmalloc space than requested\"), setting orig_size treats\nthe wasted space (object_size - orig_size) as a redzone. However with\ninit_on_free=1 we clear the full object->size, including the redzone.\n\nAdditionally we clear the object metadata, including the stored orig_size,\nmaking it zero, which makes check_object() treat the whole object as a\nredzone.\n\nThese issues lead to the following BUG report with \"slub_debug=FUZ\ninit_on_free=1\":\n\n[ 0.000000] =============================================================================\n[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten\n[ 0.000000] -----------------------------------------------------------------------------\n[ 0.000000]\n[ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc\n[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc\n[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)\n[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8\n[ 0.000000]\n[ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........\n[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........\n[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........\n[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............\n[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144\n[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)\n[ 0.000000] Call trace:\n[ 0.000000] dump_backtrace+0x90/0xe8\n[ 0.000000] show_stack+0x18/0x24\n[ 0.000000] dump_stack_lvl+0x74/0x8c\n[ 0.000000] dump_stack+0x18/0x24\n[ 0.000000] print_trailer+0x150/0x218\n[ 0.000000] check_object+0xe4/0x454\n[ 0.000000] free_to_partial_list+0x2f8/0x5ec\n\nTo address the issue, use orig_size to clear the used area. And restore\nthe value of orig_size after clear the remaining area.\n\nWhen CONFIG_SLUB_DEBUG not defined, (get_orig_size()' directly returns\ns->object_size. So when using memset to init the area, the size can simply\nbe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG not\nenabled. And orig_size can never be bigger than object_size.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49885" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--28a987d4-0d3a-4f46-89e3-22a8b7046b0c.json b/objects/vulnerability/vulnerability--28a987d4-0d3a-4f46-89e3-22a8b7046b0c.json new file mode 100644 index 00000000000..7085da8dd88 --- /dev/null +++ b/objects/vulnerability/vulnerability--28a987d4-0d3a-4f46-89e3-22a8b7046b0c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ef77a551-d586-4842-b12b-007ea6d3eaf1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--28a987d4-0d3a-4f46-89e3-22a8b7046b0c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.103888Z", + "modified": "2024-10-22T00:37:12.103888Z", + "name": "CVE-2024-49920", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before multiple uses\n\n[WHAT & HOW]\nPoniters, such as stream_enc and dc->bw_vbios, are null checked previously\nin the same function, so Coverity warns \"implies that stream_enc and\ndc->bw_vbios might be null\". They are used multiple times in the\nsubsequent code and need to be checked.\n\nThis fixes 10 FORWARD_NULL issues reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49920" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--28b2beb3-c3a2-49d1-9abe-30dd4e6cf74d.json b/objects/vulnerability/vulnerability--28b2beb3-c3a2-49d1-9abe-30dd4e6cf74d.json new file mode 100644 index 00000000000..7a910feb6c8 --- /dev/null +++ b/objects/vulnerability/vulnerability--28b2beb3-c3a2-49d1-9abe-30dd4e6cf74d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6dd85d0e-73ff-473a-91e5-1457b8fc223e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--28b2beb3-c3a2-49d1-9abe-30dd4e6cf74d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.05706Z", + "modified": "2024-10-22T00:37:12.05706Z", + "name": "CVE-2024-49905", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2)\n\nThis commit adds a null check for the 'afb' variable in the\namdgpu_dm_plane_handle_cursor_update function. Previously, 'afb' was\nassumed to be null, but was used later in the code without a null check.\nThis could potentially lead to a null pointer dereference.\n\nChanges since v1:\n- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1298 amdgpu_dm_plane_handle_cursor_update() error: we previously assumed 'afb' could be null (see line 1252)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49905" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2a48bef3-960f-4900-9f94-5fe351a09abd.json b/objects/vulnerability/vulnerability--2a48bef3-960f-4900-9f94-5fe351a09abd.json new file mode 100644 index 00000000000..c306a4758bf --- /dev/null +++ b/objects/vulnerability/vulnerability--2a48bef3-960f-4900-9f94-5fe351a09abd.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e61578bd-9c5e-4847-9301-49cf41d6e559", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2a48bef3-960f-4900-9f94-5fe351a09abd", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.9323Z", + "modified": "2024-10-22T00:37:17.9323Z", + "name": "CVE-2022-49008", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: can327: can327_feed_frame_to_netdev(): fix potential skb leak when netdev is down\n\nIn can327_feed_frame_to_netdev(), it did not free the skb when netdev\nis down, and all callers of can327_feed_frame_to_netdev() did not free\nallocated skb too. That would trigger skb leak.\n\nFix it by adding kfree_skb() in can327_feed_frame_to_netdev() when netdev\nis down. Not tested, just compiled.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49008" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2a742431-cad6-48f2-8fa0-432ed82676a1.json b/objects/vulnerability/vulnerability--2a742431-cad6-48f2-8fa0-432ed82676a1.json new file mode 100644 index 00000000000..9f1651fd1c4 --- /dev/null +++ b/objects/vulnerability/vulnerability--2a742431-cad6-48f2-8fa0-432ed82676a1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c5cee6c6-4aad-4dc4-a46d-c9297b47d135", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2a742431-cad6-48f2-8fa0-432ed82676a1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.165932Z", + "modified": "2024-10-22T00:37:12.165932Z", + "name": "CVE-2024-49936", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/xen-netback: prevent UAF in xenvif_flush_hash()\n\nDuring the list_for_each_entry_rcu iteration call of xenvif_flush_hash,\nkfree_rcu does not exist inside the rcu read critical section, so if\nkfree_rcu is called when the rcu grace period ends during the iteration,\nUAF occurs when accessing head->next after the entry becomes free.\n\nTherefore, to solve this, you need to change it to list_for_each_entry_safe.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49936" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2b275aa1-fabc-4fb5-b956-c8a1da08fc56.json b/objects/vulnerability/vulnerability--2b275aa1-fabc-4fb5-b956-c8a1da08fc56.json new file mode 100644 index 00000000000..5faff50b960 --- /dev/null +++ b/objects/vulnerability/vulnerability--2b275aa1-fabc-4fb5-b956-c8a1da08fc56.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5975dffc-ff03-4163-811b-20386e811242", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2b275aa1-fabc-4fb5-b956-c8a1da08fc56", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.080078Z", + "modified": "2024-10-22T00:37:12.080078Z", + "name": "CVE-2024-49981", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: fix use after free bug in venus_remove due to race condition\n\nin venus_probe, core->work is bound with venus_sys_error_handler, which is\nused to handle error. The code use core->sys_err_done to make sync work.\nThe core->work is started in venus_event_notify.\n\nIf we call venus_remove, there might be an unfished work. The possible\nsequence is as follows:\n\nCPU0 CPU1\n\n |venus_sys_error_handler\nvenus_remove |\nhfi_destroy\t \t\t |\nvenus_hfi_destroy\t |\nkfree(hdev);\t |\n |hfi_reinit\n\t\t\t\t\t |venus_hfi_queues_reinit\n |//use hdev\n\nFix it by canceling the work in venus_remove.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49981" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2c5deab1-d224-41fd-b308-ebaaed1df7a1.json b/objects/vulnerability/vulnerability--2c5deab1-d224-41fd-b308-ebaaed1df7a1.json new file mode 100644 index 00000000000..23e917e3829 --- /dev/null +++ b/objects/vulnerability/vulnerability--2c5deab1-d224-41fd-b308-ebaaed1df7a1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9a6fed15-d064-4e48-9d55-d1615cd49816", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2c5deab1-d224-41fd-b308-ebaaed1df7a1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.898143Z", + "modified": "2024-10-22T00:37:10.898143Z", + "name": "CVE-2024-47701", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid OOB when system.data xattr changes underneath the filesystem\n\nWhen looking up for an entry in an inlined directory, if e_value_offs is\nchanged underneath the filesystem by some change in the block device, it\nwill lead to an out-of-bounds access that KASAN detects as an UAF.\n\nEXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.\nloop0: detected capacity change from 2048 to 2047\n==================================================================\nBUG: KASAN: use-after-free in ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500\nRead of size 1 at addr ffff88803e91130f by task syz-executor269/5103\n\nCPU: 0 UID: 0 PID: 5103 Comm: syz-executor269 Not tainted 6.11.0-rc4-syzkaller #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nCall Trace:\n \n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500\n ext4_find_inline_entry+0x4be/0x5e0 fs/ext4/inline.c:1697\n __ext4_find_entry+0x2b4/0x1b30 fs/ext4/namei.c:1573\n ext4_lookup_entry fs/ext4/namei.c:1727 [inline]\n ext4_lookup+0x15f/0x750 fs/ext4/namei.c:1795\n lookup_one_qstr_excl+0x11f/0x260 fs/namei.c:1633\n filename_create+0x297/0x540 fs/namei.c:3980\n do_symlinkat+0xf9/0x3a0 fs/namei.c:4587\n __do_sys_symlinkat fs/namei.c:4610 [inline]\n __se_sys_symlinkat fs/namei.c:4607 [inline]\n __x64_sys_symlinkat+0x95/0xb0 fs/namei.c:4607\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f3e73ced469\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fff4d40c258 EFLAGS: 00000246 ORIG_RAX: 000000000000010a\nRAX: ffffffffffffffda RBX: 0032656c69662f2e RCX: 00007f3e73ced469\nRDX: 0000000020000200 RSI: 00000000ffffff9c RDI: 00000000200001c0\nRBP: 0000000000000000 R08: 00007fff4d40c290 R09: 00007fff4d40c290\nR10: 0023706f6f6c2f76 R11: 0000000000000246 R12: 00007fff4d40c27c\nR13: 0000000000000003 R14: 431bde82d7b634db R15: 00007fff4d40c2b0\n \n\nCalling ext4_xattr_ibody_find right after reading the inode with\next4_get_inode_loc will lead to a check of the validity of the xattrs,\navoiding this problem.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47701" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2c5dfce1-e0fb-4612-baee-edeeb2b09c33.json b/objects/vulnerability/vulnerability--2c5dfce1-e0fb-4612-baee-edeeb2b09c33.json new file mode 100644 index 00000000000..50ba7b3cc8c --- /dev/null +++ b/objects/vulnerability/vulnerability--2c5dfce1-e0fb-4612-baee-edeeb2b09c33.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3a5830cb-a90c-410f-af17-8cfee455ad6d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2c5dfce1-e0fb-4612-baee-edeeb2b09c33", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.031824Z", + "modified": "2024-10-22T00:37:12.031824Z", + "name": "CVE-2024-49976", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/timerlat: Drop interface_lock in stop_kthread()\n\nstop_kthread() is the offline callback for \"trace/osnoise:online\", since\ncommit 5bfbcd1ee57b (\"tracing/timerlat: Add interface_lock around clearing\nof kthread in stop_kthread()\"), the following ABBA deadlock scenario is\nintroduced:\n\nT1 | T2 [BP] | T3 [AP]\nosnoise_hotplug_workfn() | work_for_cpu_fn() | cpuhp_thread_fun()\n | _cpu_down() | osnoise_cpu_die()\n mutex_lock(&interface_lock) | | stop_kthread()\n | cpus_write_lock() | mutex_lock(&interface_lock)\n cpus_read_lock() | cpuhp_kick_ap() |\n\nAs the interface_lock here in just for protecting the \"kthread\" field of\nthe osn_var, use xchg() instead to fix this issue. Also use\nfor_each_online_cpu() back in stop_per_cpu_kthreads() as it can take\ncpu_read_lock() again.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49976" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2cc93928-9489-46bb-a77a-f61b97df42e9.json b/objects/vulnerability/vulnerability--2cc93928-9489-46bb-a77a-f61b97df42e9.json new file mode 100644 index 00000000000..d56ef448f4b --- /dev/null +++ b/objects/vulnerability/vulnerability--2cc93928-9489-46bb-a77a-f61b97df42e9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--399267e7-1f90-44bb-b405-2d00bfa7c62d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2cc93928-9489-46bb-a77a-f61b97df42e9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.869255Z", + "modified": "2024-10-22T00:37:10.869255Z", + "name": "CVE-2024-47681", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he\n\nFix the NULL pointer dereference in mt7996_mcu_sta_bfer_he\nroutine adding an sta interface to the mt7996 driver.\n\nFound by code review.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47681" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2d862f2a-8286-4a64-a26e-901c28d8fd6a.json b/objects/vulnerability/vulnerability--2d862f2a-8286-4a64-a26e-901c28d8fd6a.json new file mode 100644 index 00000000000..b3acfbb8595 --- /dev/null +++ b/objects/vulnerability/vulnerability--2d862f2a-8286-4a64-a26e-901c28d8fd6a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--640482f5-13b5-4700-8e9d-d0bebca9b168", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2d862f2a-8286-4a64-a26e-901c28d8fd6a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.012622Z", + "modified": "2024-10-22T00:37:12.012622Z", + "name": "CVE-2024-49990", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/hdcp: Check GSC structure validity\n\nSometimes xe_gsc is not initialized when checked at HDCP capability\ncheck. Add gsc structure check to avoid null pointer error.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49990" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2f0391c2-9cdb-46f2-9f54-2e233aaa5ac3.json b/objects/vulnerability/vulnerability--2f0391c2-9cdb-46f2-9f54-2e233aaa5ac3.json new file mode 100644 index 00000000000..16bb46d718b --- /dev/null +++ b/objects/vulnerability/vulnerability--2f0391c2-9cdb-46f2-9f54-2e233aaa5ac3.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--961da523-a40d-4af4-8592-5e2b1628b324", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2f0391c2-9cdb-46f2-9f54-2e233aaa5ac3", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.713168Z", + "modified": "2024-10-22T00:37:16.713168Z", + "name": "CVE-2022-48949", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Initialize mailbox message for VF reset\n\nWhen a MAC address is not assigned to the VF, that portion of the message\nsent to the VF is not set. The memory, however, is allocated from the\nstack meaning that information may be leaked to the VM. Initialize the\nmessage buffer to 0 so that no information is passed to the VM in this\ncase.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48949" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2f45f9aa-5fda-49c7-8ba9-23f1f8f108ba.json b/objects/vulnerability/vulnerability--2f45f9aa-5fda-49c7-8ba9-23f1f8f108ba.json new file mode 100644 index 00000000000..81baa483ec4 --- /dev/null +++ b/objects/vulnerability/vulnerability--2f45f9aa-5fda-49c7-8ba9-23f1f8f108ba.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--eb4449e7-4b6c-4445-8dd6-fba3fa20144e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2f45f9aa-5fda-49c7-8ba9-23f1f8f108ba", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.176601Z", + "modified": "2024-10-22T00:37:12.176601Z", + "name": "CVE-2024-49982", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naoe: fix the potential use-after-free problem in more places\n\nFor fixing CVE-2023-6270, f98364e92662 (\"aoe: fix the potential\nuse-after-free problem in aoecmd_cfg_pkts\") makes tx() calling dev_put()\ninstead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs\ninto use-after-free.\n\nThen Nicolai Stange found more places in aoe have potential use-after-free\nproblem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe()\nand aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push\npacket to tx queue. So they should also use dev_hold() to increase the\nrefcnt of skb->dev.\n\nOn the other hand, moving dev_put() to tx() causes that the refcnt of\nskb->dev be reduced to a negative value, because corresponding\ndev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(),\nprobe(), and aoecmd_cfg_rsp(). This patch fixed this issue.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49982" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--2fb9982f-96d0-46f2-a60d-4c27deca3b52.json b/objects/vulnerability/vulnerability--2fb9982f-96d0-46f2-a60d-4c27deca3b52.json new file mode 100644 index 00000000000..eccd46e14c3 --- /dev/null +++ b/objects/vulnerability/vulnerability--2fb9982f-96d0-46f2-a60d-4c27deca3b52.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--7ab53cdf-a2df-491a-aa4a-1afd2b5567ff", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--2fb9982f-96d0-46f2-a60d-4c27deca3b52", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.681104Z", + "modified": "2024-10-22T00:37:16.681104Z", + "name": "CVE-2022-48992", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: soc-pcm: Add NULL check in BE reparenting\n\nAdd NULL check in dpcm_be_reparent API, to handle\nkernel NULL pointer dereference error.\nThe issue occurred in fuzzing test.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48992" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--30e7c6eb-7a0f-4567-84a7-a90bb20e0ce5.json b/objects/vulnerability/vulnerability--30e7c6eb-7a0f-4567-84a7-a90bb20e0ce5.json new file mode 100644 index 00000000000..679f4d8bf03 --- /dev/null +++ b/objects/vulnerability/vulnerability--30e7c6eb-7a0f-4567-84a7-a90bb20e0ce5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4dc31782-3411-42f4-8d3d-39080a2f9c79", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--30e7c6eb-7a0f-4567-84a7-a90bb20e0ce5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.192744Z", + "modified": "2024-10-22T00:37:12.192744Z", + "name": "CVE-2024-49997", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: lantiq_etop: fix memory disclosure\n\nWhen applying padding, the buffer is not zeroed, which results in memory\ndisclosure. The mentioned data is observed on the wire. This patch uses\nskb_put_padto() to pad Ethernet frames properly. The mentioned function\nzeroes the expanded buffer.\n\nIn case the packet cannot be padded it is silently dropped. Statistics\nare also not incremented. This driver does not support statistics in the\nold 32-bit format or the new 64-bit format. These will be added in the\nfuture. In its current form, the patch should be easily backported to\nstable versions.\n\nEthernet MACs on Amazon-SE and Danube cannot do padding of the packets\nin hardware, so software padding must be applied.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49997" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3138d146-8eea-4d2b-a9da-fc0787a42f6e.json b/objects/vulnerability/vulnerability--3138d146-8eea-4d2b-a9da-fc0787a42f6e.json new file mode 100644 index 00000000000..a18bc403ecc --- /dev/null +++ b/objects/vulnerability/vulnerability--3138d146-8eea-4d2b-a9da-fc0787a42f6e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2778faeb-39c0-4d69-b8dc-0b3b1649eac9", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3138d146-8eea-4d2b-a9da-fc0787a42f6e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.002761Z", + "modified": "2024-10-22T00:37:11.002761Z", + "name": "CVE-2024-50006", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix i_data_sem unlock order in ext4_ind_migrate()\n\nFuzzing reports a possible deadlock in jbd2_log_wait_commit.\n\nThis issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require\nsynchronous updates because the file descriptor is opened with O_SYNC.\nThis can lead to the jbd2_journal_stop() function calling\njbd2_might_wait_for_commit(), potentially causing a deadlock if the\nEXT4_IOC_MIGRATE call races with a write(2) system call.\n\nThis problem only arises when CONFIG_PROVE_LOCKING is enabled. In this\ncase, the jbd2_might_wait_for_commit macro locks jbd2_handle in the\njbd2_journal_stop function while i_data_sem is locked. This triggers\nlockdep because the jbd2_journal_start function might also lock the same\njbd2_handle simultaneously.\n\nFound by Linux Verification Center (linuxtesting.org) with syzkaller.\n\nRule: add", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50006" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3158adcf-fd00-4ce6-bbca-276ce9ac94f6.json b/objects/vulnerability/vulnerability--3158adcf-fd00-4ce6-bbca-276ce9ac94f6.json new file mode 100644 index 00000000000..564ce121c55 --- /dev/null +++ b/objects/vulnerability/vulnerability--3158adcf-fd00-4ce6-bbca-276ce9ac94f6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--613ffbe1-5a64-4669-8692-518c6f325f5f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3158adcf-fd00-4ce6-bbca-276ce9ac94f6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.115384Z", + "modified": "2024-10-22T00:37:12.115384Z", + "name": "CVE-2024-49914", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in the\n`dcn20_program_pipe` function. The issue could occur when\n`pipe_ctx->plane_state` is null.\n\nThe fix adds a check to ensure `pipe_ctx->plane_state` is not null\nbefore accessing. This prevents a null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925 dcn20_program_pipe() error: we previously assumed 'pipe_ctx->plane_state' could be null (see line 1877)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49914" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--32d8e4b5-0808-44d5-885b-b45a3ffc0225.json b/objects/vulnerability/vulnerability--32d8e4b5-0808-44d5-885b-b45a3ffc0225.json new file mode 100644 index 00000000000..7518cb8624b --- /dev/null +++ b/objects/vulnerability/vulnerability--32d8e4b5-0808-44d5-885b-b45a3ffc0225.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5930c30c-5bfb-426e-a367-8a0092a4f080", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--32d8e4b5-0808-44d5-885b-b45a3ffc0225", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.859852Z", + "modified": "2024-10-22T00:37:10.859852Z", + "name": "CVE-2024-47692", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: return -EINVAL when namelen is 0\n\nWhen we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may\nresult in namelen being 0, which will cause memdup_user() to return\nZERO_SIZE_PTR.\nWhen we access the name.data that has been assigned the value of\nZERO_SIZE_PTR in nfs4_client_to_reclaim(), null pointer dereference is\ntriggered.\n\n[ T1205] ==================================================================\n[ T1205] BUG: KASAN: null-ptr-deref in nfs4_client_to_reclaim+0xe9/0x260\n[ T1205] Read of size 1 at addr 0000000000000010 by task nfsdcld/1205\n[ T1205]\n[ T1205] CPU: 11 PID: 1205 Comm: nfsdcld Not tainted 5.10.0-00003-g2c1423731b8d #406\n[ T1205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014\n[ T1205] Call Trace:\n[ T1205] dump_stack+0x9a/0xd0\n[ T1205] ? nfs4_client_to_reclaim+0xe9/0x260\n[ T1205] __kasan_report.cold+0x34/0x84\n[ T1205] ? nfs4_client_to_reclaim+0xe9/0x260\n[ T1205] kasan_report+0x3a/0x50\n[ T1205] nfs4_client_to_reclaim+0xe9/0x260\n[ T1205] ? nfsd4_release_lockowner+0x410/0x410\n[ T1205] cld_pipe_downcall+0x5ca/0x760\n[ T1205] ? nfsd4_cld_tracking_exit+0x1d0/0x1d0\n[ T1205] ? down_write_killable_nested+0x170/0x170\n[ T1205] ? avc_policy_seqno+0x28/0x40\n[ T1205] ? selinux_file_permission+0x1b4/0x1e0\n[ T1205] rpc_pipe_write+0x84/0xb0\n[ T1205] vfs_write+0x143/0x520\n[ T1205] ksys_write+0xc9/0x170\n[ T1205] ? __ia32_sys_read+0x50/0x50\n[ T1205] ? ktime_get_coarse_real_ts64+0xfe/0x110\n[ T1205] ? ktime_get_coarse_real_ts64+0xa2/0x110\n[ T1205] do_syscall_64+0x33/0x40\n[ T1205] entry_SYSCALL_64_after_hwframe+0x67/0xd1\n[ T1205] RIP: 0033:0x7fdbdb761bc7\n[ T1205] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 514\n[ T1205] RSP: 002b:00007fff8c4b7248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[ T1205] RAX: ffffffffffffffda RBX: 000000000000042b RCX: 00007fdbdb761bc7\n[ T1205] RDX: 000000000000042b RSI: 00007fff8c4b75f0 RDI: 0000000000000008\n[ T1205] RBP: 00007fdbdb761bb0 R08: 0000000000000000 R09: 0000000000000001\n[ T1205] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000042b\n[ T1205] R13: 0000000000000008 R14: 00007fff8c4b75f0 R15: 0000000000000000\n[ T1205] ==================================================================\n\nFix it by checking namelen.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47692" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3345946b-42b0-4b97-81e1-7e7493daa70d.json b/objects/vulnerability/vulnerability--3345946b-42b0-4b97-81e1-7e7493daa70d.json new file mode 100644 index 00000000000..cca569b45aa --- /dev/null +++ b/objects/vulnerability/vulnerability--3345946b-42b0-4b97-81e1-7e7493daa70d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--7c9ed6be-25eb-4799-a9b7-b4cc37750aed", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3345946b-42b0-4b97-81e1-7e7493daa70d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.98572Z", + "modified": "2024-10-22T00:37:10.98572Z", + "name": "CVE-2024-50031", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Stop the active perfmon before being destroyed\n\nWhen running `kmscube` with one or more performance monitors enabled\nvia `GALLIUM_HUD`, the following kernel panic can occur:\n\n[ 55.008324] Unable to handle kernel paging request at virtual address 00000000052004a4\n[ 55.008368] Mem abort info:\n[ 55.008377] ESR = 0x0000000096000005\n[ 55.008387] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 55.008402] SET = 0, FnV = 0\n[ 55.008412] EA = 0, S1PTW = 0\n[ 55.008421] FSC = 0x05: level 1 translation fault\n[ 55.008434] Data abort info:\n[ 55.008442] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n[ 55.008455] CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 55.008467] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 55.008481] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001046c6000\n[ 55.008497] [00000000052004a4] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n[ 55.008525] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\n[ 55.008542] Modules linked in: rfcomm [...] vc4 v3d snd_soc_hdmi_codec drm_display_helper\ngpu_sched drm_shmem_helper cec drm_dma_helper drm_kms_helper i2c_brcmstb\ndrm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight\n[ 55.008799] CPU: 2 PID: 166 Comm: v3d_bin Tainted: G C 6.6.47+rpt-rpi-v8 #1 Debian 1:6.6.47-1+rpt1\n[ 55.008824] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n[ 55.008838] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 55.008855] pc : __mutex_lock.constprop.0+0x90/0x608\n[ 55.008879] lr : __mutex_lock.constprop.0+0x58/0x608\n[ 55.008895] sp : ffffffc080673cf0\n[ 55.008904] x29: ffffffc080673cf0 x28: 0000000000000000 x27: ffffff8106188a28\n[ 55.008926] x26: ffffff8101e78040 x25: ffffff8101baa6c0 x24: ffffffd9d989f148\n[ 55.008947] x23: ffffffda1c2a4008 x22: 0000000000000002 x21: ffffffc080673d38\n[ 55.008968] x20: ffffff8101238000 x19: ffffff8104f83188 x18: 0000000000000000\n[ 55.008988] x17: 0000000000000000 x16: ffffffda1bd04d18 x15: 00000055bb08bc90\n[ 55.009715] x14: 0000000000000000 x13: 0000000000000000 x12: ffffffda1bd4cbb0\n[ 55.010433] x11: 00000000fa83b2da x10: 0000000000001a40 x9 : ffffffda1bd04d04\n[ 55.011162] x8 : ffffff8102097b80 x7 : 0000000000000000 x6 : 00000000030a5857\n[ 55.011880] x5 : 00ffffffffffffff x4 : 0300000005200470 x3 : 0300000005200470\n[ 55.012598] x2 : ffffff8101238000 x1 : 0000000000000021 x0 : 0300000005200470\n[ 55.013292] Call trace:\n[ 55.013959] __mutex_lock.constprop.0+0x90/0x608\n[ 55.014646] __mutex_lock_slowpath+0x1c/0x30\n[ 55.015317] mutex_lock+0x50/0x68\n[ 55.015961] v3d_perfmon_stop+0x40/0xe0 [v3d]\n[ 55.016627] v3d_bin_job_run+0x10c/0x2d8 [v3d]\n[ 55.017282] drm_sched_main+0x178/0x3f8 [gpu_sched]\n[ 55.017921] kthread+0x11c/0x128\n[ 55.018554] ret_from_fork+0x10/0x20\n[ 55.019168] Code: f9400260 f1001c1f 54001ea9 927df000 (b9403401)\n[ 55.019776] ---[ end trace 0000000000000000 ]---\n[ 55.020411] note: v3d_bin[166] exited with preempt_count 1\n\nThis issue arises because, upon closing the file descriptor (which happens\nwhen we interrupt `kmscube`), the active performance monitor is not\nstopped. Although all perfmons are destroyed in `v3d_perfmon_close_file()`,\nthe active performance monitor's pointer (`v3d->active_perfmon`) is still\nretained.\n\nIf `kmscube` is run again, the driver will attempt to stop the active\nperformance monitor using the stale pointer in `v3d->active_perfmon`.\nHowever, this pointer is no longer valid because the previous process has\nalready terminated, and all performance monitors associated with it have\nbeen destroyed and freed.\n\nTo fix this, when the active performance monitor belongs to a given\nprocess, explicitly stop it before destroying and freeing it.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50031" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3470d760-76bb-46b2-9ad2-6e3651f23797.json b/objects/vulnerability/vulnerability--3470d760-76bb-46b2-9ad2-6e3651f23797.json new file mode 100644 index 00000000000..6a834c2214b --- /dev/null +++ b/objects/vulnerability/vulnerability--3470d760-76bb-46b2-9ad2-6e3651f23797.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ee5930c2-dfd6-4a99-a298-95023ca62d52", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3470d760-76bb-46b2-9ad2-6e3651f23797", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.89703Z", + "modified": "2024-10-22T00:37:10.89703Z", + "name": "CVE-2024-47715", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix oops on non-dbdc mt7986\n\nmt7915_band_config() sets band_idx = 1 on the main phy for mt7986\nwith MT7975_ONE_ADIE or MT7976_ONE_ADIE.\n\nCommit 0335c034e726 (\"wifi: mt76: fix race condition related to\nchecking tx queue fill status\") introduced a dereference of the\nphys array indirectly indexed by band_idx via wcid->phy_idx in\nmt76_wcid_cleanup(). This caused the following Oops on affected\nmt7986 devices:\n\n Unable to handle kernel read from unreadable memory at virtual address 0000000000000024\n Mem abort info:\n ESR = 0x0000000096000005\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x05: level 1 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000005\n CM = 0, WnR = 0\n user pgtable: 4k pages, 39-bit VAs, pgdp=0000000042545000\n [0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n Internal error: Oops: 0000000096000005 [#1] SMP\n Modules linked in: ... mt7915e mt76_connac_lib mt76 mac80211 cfg80211 ...\n CPU: 2 PID: 1631 Comm: hostapd Not tainted 5.15.150 #0\n Hardware name: ZyXEL EX5700 (Telenor) (DT)\n pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : mt76_wcid_cleanup+0x84/0x22c [mt76]\n lr : mt76_wcid_cleanup+0x64/0x22c [mt76]\n sp : ffffffc00a803700\n x29: ffffffc00a803700 x28: ffffff80008f7300 x27: ffffff80003f3c00\n x26: ffffff80000a7880 x25: ffffffc008c26e00 x24: 0000000000000001\n x23: ffffffc000a68114 x22: 0000000000000000 x21: ffffff8004172cc8\n x20: ffffffc00a803748 x19: ffffff8004152020 x18: 0000000000000000\n x17: 00000000000017c0 x16: ffffffc008ef5000 x15: 0000000000000be0\n x14: ffffff8004172e28 x13: ffffff8004172e28 x12: 0000000000000000\n x11: 0000000000000000 x10: ffffff8004172e30 x9 : ffffff8004172e28\n x8 : 0000000000000000 x7 : ffffff8004156020 x6 : 0000000000000000\n x5 : 0000000000000031 x4 : 0000000000000000 x3 : 0000000000000001\n x2 : 0000000000000000 x1 : ffffff80008f7300 x0 : 0000000000000024\n Call trace:\n mt76_wcid_cleanup+0x84/0x22c [mt76]\n __mt76_sta_remove+0x70/0xbc [mt76]\n mt76_sta_state+0x8c/0x1a4 [mt76]\n mt7915_eeprom_get_power_delta+0x11e4/0x23a0 [mt7915e]\n drv_sta_state+0x144/0x274 [mac80211]\n sta_info_move_state+0x1cc/0x2a4 [mac80211]\n sta_set_sinfo+0xaf8/0xc24 [mac80211]\n sta_info_destroy_addr_bss+0x4c/0x6c [mac80211]\n\n ieee80211_color_change_finish+0x1c08/0x1e70 [mac80211]\n cfg80211_check_station_change+0x1360/0x4710 [cfg80211]\n genl_family_rcv_msg_doit+0xb4/0x110\n genl_rcv_msg+0xd0/0x1bc\n netlink_rcv_skb+0x58/0x120\n genl_rcv+0x34/0x50\n netlink_unicast+0x1f0/0x2ec\n netlink_sendmsg+0x198/0x3d0\n ____sys_sendmsg+0x1b0/0x210\n ___sys_sendmsg+0x80/0xf0\n __sys_sendmsg+0x44/0xa0\n __arm64_sys_sendmsg+0x20/0x30\n invoke_syscall.constprop.0+0x4c/0xe0\n do_el0_svc+0x40/0xd0\n el0_svc+0x14/0x4c\n el0t_64_sync_handler+0x100/0x110\n el0t_64_sync+0x15c/0x160\n Code: d2800002 910092c0 52800023 f9800011 (885f7c01)\n ---[ end trace 7e42dd9a39ed2281 ]---\n\nFix by using mt76_dev_phy() which will map band_idx to the correct phy\nfor all hardware combinations.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47715" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--34c06d8d-b031-49fa-b30c-7ff1639ad003.json b/objects/vulnerability/vulnerability--34c06d8d-b031-49fa-b30c-7ff1639ad003.json new file mode 100644 index 00000000000..e004239b7b4 --- /dev/null +++ b/objects/vulnerability/vulnerability--34c06d8d-b031-49fa-b30c-7ff1639ad003.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0df4caf9-85fa-438d-b52d-b98b1011e112", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--34c06d8d-b031-49fa-b30c-7ff1639ad003", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.666184Z", + "modified": "2024-10-22T00:37:16.666184Z", + "name": "CVE-2022-48958", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet: aeroflex: fix potential skb leak in greth_init_rings()\n\nThe greth_init_rings() function won't free the newly allocated skb when\ndma_mapping_error() returns error, so add dev_kfree_skb() to fix it.\n\nCompile tested only.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48958" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--34c1b672-6212-4c54-9e61-ff7448c0bfc0.json b/objects/vulnerability/vulnerability--34c1b672-6212-4c54-9e61-ff7448c0bfc0.json new file mode 100644 index 00000000000..0ad6fb8d121 --- /dev/null +++ b/objects/vulnerability/vulnerability--34c1b672-6212-4c54-9e61-ff7448c0bfc0.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--03390fbc-3652-4f2a-8f04-60bbf5a16c3b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--34c1b672-6212-4c54-9e61-ff7448c0bfc0", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.033312Z", + "modified": "2024-10-22T00:37:12.033312Z", + "name": "CVE-2024-49917", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn30_init_hw` function. The issue could occur when `dc->clk_mgr` or\n`dc->clk_mgr->funcs` is null.\n\nThe fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is\nnot null before accessing its functions. This prevents a potential null\npointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:789 dcn30_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 628)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49917" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3504572d-530d-4bd3-a31e-b3d77045c3c9.json b/objects/vulnerability/vulnerability--3504572d-530d-4bd3-a31e-b3d77045c3c9.json new file mode 100644 index 00000000000..0ef64959bb4 --- /dev/null +++ b/objects/vulnerability/vulnerability--3504572d-530d-4bd3-a31e-b3d77045c3c9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6b25ae3b-e71a-4635-a8ee-5ea27436ee21", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3504572d-530d-4bd3-a31e-b3d77045c3c9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.180616Z", + "modified": "2024-10-22T00:37:12.180616Z", + "name": "CVE-2024-49889", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid use-after-free in ext4_ext_show_leaf()\n\nIn ext4_find_extent(), path may be freed by error or be reallocated, so\nusing a previously saved *ppath may have been freed and thus may trigger\nuse-after-free, as follows:\n\next4_split_extent\n path = *ppath;\n ext4_split_extent_at(ppath)\n path = ext4_find_extent(ppath)\n ext4_split_extent_at(ppath)\n // ext4_find_extent fails to free path\n // but zeroout succeeds\n ext4_ext_show_leaf(inode, path)\n eh = path[depth].p_hdr\n // path use-after-free !!!\n\nSimilar to ext4_split_extent_at(), we use *ppath directly as an input to\next4_ext_show_leaf(). Fix a spelling error by the way.\n\nSame problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only\nused in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.\n\nThis issue is triggered only when EXT_DEBUG is defined and therefore does\nnot affect functionality.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49889" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--352494e2-d98c-4ed0-878b-7e424a8d4627.json b/objects/vulnerability/vulnerability--352494e2-d98c-4ed0-878b-7e424a8d4627.json new file mode 100644 index 00000000000..b375e324ab7 --- /dev/null +++ b/objects/vulnerability/vulnerability--352494e2-d98c-4ed0-878b-7e424a8d4627.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--887957da-7937-4318-8aa2-96aa8bafa688", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--352494e2-d98c-4ed0-878b-7e424a8d4627", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.638048Z", + "modified": "2024-10-22T00:37:11.638048Z", + "name": "CVE-2024-40088", + "description": "A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-40088" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3533e22d-3d43-4ba5-96df-e9f2b48d2b87.json b/objects/vulnerability/vulnerability--3533e22d-3d43-4ba5-96df-e9f2b48d2b87.json new file mode 100644 index 00000000000..13eae420a42 --- /dev/null +++ b/objects/vulnerability/vulnerability--3533e22d-3d43-4ba5-96df-e9f2b48d2b87.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ac10d053-da7d-4ef9-82dc-0503af7b4d6f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3533e22d-3d43-4ba5-96df-e9f2b48d2b87", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.928441Z", + "modified": "2024-10-22T00:37:10.928441Z", + "name": "CVE-2024-47708", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetkit: Assign missing bpf_net_context\n\nDuring the introduction of struct bpf_net_context handling for\nXDP-redirect, the netkit driver has been missed, which also requires it\nbecause NETKIT_REDIRECT invokes skb_do_redirect() which is accessing the\nper-CPU variables. Otherwise we see the following crash:\n\n\tBUG: kernel NULL pointer dereference, address: 0000000000000038\n\tbpf_redirect()\n\tnetkit_xmit()\n\tdev_hard_start_xmit()\n\nSet the bpf_net_context before invoking netkit_xmit() program within the\nnetkit driver.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47708" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--356db4cc-0f7c-4d49-9ed2-e6d87d6d4673.json b/objects/vulnerability/vulnerability--356db4cc-0f7c-4d49-9ed2-e6d87d6d4673.json new file mode 100644 index 00000000000..b8bb29a6fe8 --- /dev/null +++ b/objects/vulnerability/vulnerability--356db4cc-0f7c-4d49-9ed2-e6d87d6d4673.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--843ff7d1-3b0e-4ef1-a93d-2d2fc0c43204", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--356db4cc-0f7c-4d49-9ed2-e6d87d6d4673", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.82423Z", + "modified": "2024-10-22T00:37:10.82423Z", + "name": "CVE-2024-47716", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros\n\nFloating point instructions in userspace can crash some arm kernels\nbuilt with clang/LLD 17.0.6:\n\n BUG: unsupported FP instruction in kernel mode\n FPEXC == 0xc0000780\n Internal error: Oops - undefined instruction: 0 [#1] ARM\n CPU: 0 PID: 196 Comm: vfp-reproducer Not tainted 6.10.0 #1\n Hardware name: BCM2835\n PC is at vfp_support_entry+0xc8/0x2cc\n LR is at do_undefinstr+0xa8/0x250\n pc : [] lr : [] psr: a0000013\n sp : dc8d1f68 ip : 60000013 fp : bedea19c\n r10: ec532b17 r9 : 00000010 r8 : 0044766c\n r7 : c0000780 r6 : ec532b17 r5 : c1c13800 r4 : dc8d1fb0\n r3 : c10072c4 r2 : c0101c88 r1 : ec532b17 r0 : 0044766c\n Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none\n Control: 00c5387d Table: 0251c008 DAC: 00000051\n Register r0 information: non-paged memory\n Register r1 information: vmalloc memory\n Register r2 information: non-slab/vmalloc memory\n Register r3 information: non-slab/vmalloc memory\n Register r4 information: 2-page vmalloc region\n Register r5 information: slab kmalloc-cg-2k\n Register r6 information: vmalloc memory\n Register r7 information: non-slab/vmalloc memory\n Register r8 information: non-paged memory\n Register r9 information: zero-size pointer\n Register r10 information: vmalloc memory\n Register r11 information: non-paged memory\n Register r12 information: non-paged memory\n Process vfp-reproducer (pid: 196, stack limit = 0x61aaaf8b)\n Stack: (0xdc8d1f68 to 0xdc8d2000)\n 1f60: 0000081f b6f69300 0000000f c10073f4 c10072c4 dc8d1fb0\n 1f80: ec532b17 0c532b17 0044766c b6f9ccd8 00000000 c010a80c 00447670 60000010\n 1fa0: ffffffff c1c13800 00c5387d c0100f10 b6f68af8 00448fc0 00000000 bedea188\n 1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c\n 1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff 00000000 00000000\n Call trace:\n [] (vfp_support_entry) from [] (do_undefinstr+0xa8/0x250)\n [] (do_undefinstr) from [] (__und_usr+0x70/0x80)\n Exception stack(0xdc8d1fb0 to 0xdc8d1ff8)\n 1fa0: b6f68af8 00448fc0 00000000 bedea188\n 1fc0: bedea314 00000001 00448ebc b6f9d000 00447608 b6f9ccd8 00000000 bedea19c\n 1fe0: bede9198 bedea188 b6e1061c 0044766c 60000010 ffffffff\n Code: 0a000061 e3877202 e594003c e3a09010 (eef16a10)\n ---[ end trace 0000000000000000 ]---\n Kernel panic - not syncing: Fatal exception in interrupt\n ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---\n\nThis is a minimal userspace reproducer on a Raspberry Pi Zero W:\n\n #include \n #include \n\n int main(void)\n {\n double v = 1.0;\n printf(\"%fn\", NAN + *(volatile double *)&v);\n return 0;\n }\n\nAnother way to consistently trigger the oops is:\n\n calvin@raspberry-pi-zero-w ~$ python -c \"import json\"\n\nThe bug reproduces only when the kernel is built with DYNAMIC_DEBUG=n,\nbecause the pr_debug() calls act as barriers even when not activated.\n\nThis is the output from the same kernel source built with the same\ncompiler and DYNAMIC_DEBUG=y, where the userspace reproducer works as\nexpected:\n\n VFP: bounce: trigger ec532b17 fpexc c0000780\n VFP: emulate: INST=0xee377b06 SCR=0x00000000\n VFP: bounce: trigger eef1fa10 fpexc c0000780\n VFP: emulate: INST=0xeeb40b40 SCR=0x00000000\n VFP: raising exceptions 30000000\n\n calvin@raspberry-pi-zero-w ~$ ./vfp-reproducer\n nan\n\nCrudely grepping for vmsr/vmrs instructions in the otherwise nearly\nidential text for vfp_support_entry() makes the problem obvious:\n\n vmlinux.llvm.good [0xc0101cb8] <+48>: vmrs r7, fpexc\n vmlinux.llvm.good [0xc0101cd8] <+80>: vmsr fpexc, r0\n vmlinux.llvm.good [0xc0101d20\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47716" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--35fca495-0ced-4d3e-b0fc-9307b0f3aa1e.json b/objects/vulnerability/vulnerability--35fca495-0ced-4d3e-b0fc-9307b0f3aa1e.json new file mode 100644 index 00000000000..462403c9f3a --- /dev/null +++ b/objects/vulnerability/vulnerability--35fca495-0ced-4d3e-b0fc-9307b0f3aa1e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--85e52769-f497-41f8-83c4-fee07e4b9dfa", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--35fca495-0ced-4d3e-b0fc-9307b0f3aa1e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.038083Z", + "modified": "2024-10-22T00:37:12.038083Z", + "name": "CVE-2024-49998", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: improve shutdown sequence\n\nAlexander Sverdlin presents 2 problems during shutdown with the\nlan9303 driver. One is specific to lan9303 and the other just happens\nto reproduce there.\n\nThe first problem is that lan9303 is unique among DSA drivers in that it\ncalls dev_get_drvdata() at \"arbitrary runtime\" (not probe, not shutdown,\nnot remove):\n\nphy_state_machine()\n-> ...\n -> dsa_user_phy_read()\n -> ds->ops->phy_read()\n -> lan9303_phy_read()\n -> chip->ops->phy_read()\n -> lan9303_mdio_phy_read()\n -> dev_get_drvdata()\n\nBut we never stop the phy_state_machine(), so it may continue to run\nafter dsa_switch_shutdown(). Our common pattern in all DSA drivers is\nto set drvdata to NULL to suppress the remove() method that may come\nafterwards. But in this case it will result in an NPD.\n\nThe second problem is that the way in which we set\ndp->conduit->dsa_ptr = NULL; is concurrent with receive packet\nprocessing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL,\nbut afterwards, rather than continuing to use that non-NULL value,\ndev->dsa_ptr is dereferenced again and again without NULL checks:\ndsa_conduit_find_user() and many other places. In between dereferences,\nthere is no locking to ensure that what was valid once continues to be\nvalid.\n\nBoth problems have the common aspect that closing the conduit interface\nsolves them.\n\nIn the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN\nevent in dsa_user_netdevice_event() which closes user ports as well.\ndsa_port_disable_rt() calls phylink_stop(), which synchronously stops\nthe phylink state machine, and ds->ops->phy_read() will thus no longer\ncall into the driver after this point.\n\nIn the second case, dev_close(conduit) should do this, as per\nDocumentation/networking/driver.rst:\n\n| Quiescence\n| ----------\n|\n| After the ndo_stop routine has been called, the hardware must\n| not receive or transmit any data. All in flight packets must\n| be aborted. If necessary, poll or wait for completion of\n| any reset commands.\n\nSo it should be sufficient to ensure that later, when we zeroize\nconduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call\non this conduit.\n\nThe addition of the netif_device_detach() function is to ensure that\nioctls, rtnetlinks and ethtool requests on the user ports no longer\npropagate down to the driver - we're no longer prepared to handle them.\n\nThe race condition actually did not exist when commit 0650bf52b31f\n(\"net: dsa: be compatible with masters which unregister on shutdown\")\nfirst introduced dsa_switch_shutdown(). It was created later, when we\nstopped unregistering the user interfaces from a bad spot, and we just\nreplaced that sequence with a racy zeroization of conduit->dsa_ptr\n(one which doesn't ensure that the interfaces aren't up).", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49998" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--363ec57c-e6e0-4a3d-8d5e-825d2e3c2449.json b/objects/vulnerability/vulnerability--363ec57c-e6e0-4a3d-8d5e-825d2e3c2449.json new file mode 100644 index 00000000000..14e8829f797 --- /dev/null +++ b/objects/vulnerability/vulnerability--363ec57c-e6e0-4a3d-8d5e-825d2e3c2449.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ee517c74-4c10-4147-8d3c-86b949715b17", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--363ec57c-e6e0-4a3d-8d5e-825d2e3c2449", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.962035Z", + "modified": "2024-10-22T00:37:17.962035Z", + "name": "CVE-2022-49029", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails\n\nSmatch report warning as follows:\n\ndrivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn:\n '&data->list' not removed from list\n\nIf ibmpex_find_sensors() fails in ibmpex_register_bmc(), data will\nbe freed, but data->list will not be removed from driver_data.bmc_data,\nthen list traversal may cause UAF.\n\nFix by removeing it from driver_data.bmc_data before free().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49029" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--367f29a7-0480-46ff-807e-1f1de2500458.json b/objects/vulnerability/vulnerability--367f29a7-0480-46ff-807e-1f1de2500458.json new file mode 100644 index 00000000000..786392b548d --- /dev/null +++ b/objects/vulnerability/vulnerability--367f29a7-0480-46ff-807e-1f1de2500458.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ef889389-bc10-473c-8a2d-a3c306ff399f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--367f29a7-0480-46ff-807e-1f1de2500458", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.727653Z", + "modified": "2024-10-22T00:37:16.727653Z", + "name": "CVE-2022-48996", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: fix wrong empty schemes assumption under online tuning in damon_sysfs_set_schemes()\n\nCommit da87878010e5 (\"mm/damon/sysfs: support online inputs update\") made\n'damon_sysfs_set_schemes()' to be called for running DAMON context, which\ncould have schemes. In the case, DAMON sysfs interface is supposed to\nupdate, remove, or add schemes to reflect the sysfs files. However, the\ncode is assuming the DAMON context wouldn't have schemes at all, and\ntherefore creates and adds new schemes. As a result, the code doesn't\nwork as intended for online schemes tuning and could have more than\nexpected memory footprint. The schemes are all in the DAMON context, so\nit doesn't leak the memory, though.\n\nRemove the wrong asssumption (the DAMON context wouldn't have schemes) in\n'damon_sysfs_set_schemes()' to fix the bug.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48996" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--36c8db1a-47d0-4ca7-9ee2-6a11e1b437a4.json b/objects/vulnerability/vulnerability--36c8db1a-47d0-4ca7-9ee2-6a11e1b437a4.json new file mode 100644 index 00000000000..408eb26fcf7 --- /dev/null +++ b/objects/vulnerability/vulnerability--36c8db1a-47d0-4ca7-9ee2-6a11e1b437a4.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--7094a8ff-6ec5-426d-9cb2-734771bbd358", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--36c8db1a-47d0-4ca7-9ee2-6a11e1b437a4", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.94185Z", + "modified": "2024-10-22T00:37:10.94185Z", + "name": "CVE-2024-47694", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix UMR pd cleanup on error flow of driver init\n\nThe cited commit moves the pd allocation from function\nmlx5r_umr_resource_cleanup() to a new function mlx5r_umr_cleanup().\nSo the fix in commit [1] is broken. In error flow, will hit panic [2].\n\nFix it by checking pd pointer to avoid panic if it is NULL;\n\n[1] RDMA/mlx5: Fix UMR cleanup on error flow of driver init\n[2]\n [ 347.567063] infiniband mlx5_0: Couldn't register device with driver model\n [ 347.591382] BUG: kernel NULL pointer dereference, address: 0000000000000020\n [ 347.593438] #PF: supervisor read access in kernel mode\n [ 347.595176] #PF: error_code(0x0000) - not-present page\n [ 347.596962] PGD 0 P4D 0\n [ 347.601361] RIP: 0010:ib_dealloc_pd_user+0x12/0xc0 [ib_core]\n [ 347.604171] RSP: 0018:ffff888106293b10 EFLAGS: 00010282\n [ 347.604834] RAX: 0000000000000000 RBX: 000000000000000e RCX: 0000000000000000\n [ 347.605672] RDX: ffff888106293ad0 RSI: 0000000000000000 RDI: 0000000000000000\n [ 347.606529] RBP: 0000000000000000 R08: ffff888106293ae0 R09: ffff888106293ae0\n [ 347.607379] R10: 0000000000000a06 R11: 0000000000000000 R12: 0000000000000000\n [ 347.608224] R13: ffffffffa0704dc0 R14: 0000000000000001 R15: 0000000000000001\n [ 347.609067] FS: 00007fdc720cd9c0(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000\n [ 347.610094] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [ 347.610727] CR2: 0000000000000020 CR3: 0000000103012003 CR4: 0000000000370eb0\n [ 347.611421] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n [ 347.612113] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n [ 347.612804] Call Trace:\n [ 347.613130] \n [ 347.613417] ? __die+0x20/0x60\n [ 347.613793] ? page_fault_oops+0x150/0x3e0\n [ 347.614243] ? free_msg+0x68/0x80 [mlx5_core]\n [ 347.614840] ? cmd_exec+0x48f/0x11d0 [mlx5_core]\n [ 347.615359] ? exc_page_fault+0x74/0x130\n [ 347.615808] ? asm_exc_page_fault+0x22/0x30\n [ 347.616273] ? ib_dealloc_pd_user+0x12/0xc0 [ib_core]\n [ 347.616801] mlx5r_umr_cleanup+0x23/0x90 [mlx5_ib]\n [ 347.617365] mlx5_ib_stage_pre_ib_reg_umr_cleanup+0x36/0x40 [mlx5_ib]\n [ 347.618025] __mlx5_ib_add+0x96/0xd0 [mlx5_ib]\n [ 347.618539] mlx5r_probe+0xe9/0x310 [mlx5_ib]\n [ 347.619032] ? kernfs_add_one+0x107/0x150\n [ 347.619478] ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib]\n [ 347.619984] auxiliary_bus_probe+0x3e/0x90\n [ 347.620448] really_probe+0xc5/0x3a0\n [ 347.620857] __driver_probe_device+0x80/0x160\n [ 347.621325] driver_probe_device+0x1e/0x90\n [ 347.621770] __driver_attach+0xec/0x1c0\n [ 347.622213] ? __device_attach_driver+0x100/0x100\n [ 347.622724] bus_for_each_dev+0x71/0xc0\n [ 347.623151] bus_add_driver+0xed/0x240\n [ 347.623570] driver_register+0x58/0x100\n [ 347.623998] __auxiliary_driver_register+0x6a/0xc0\n [ 347.624499] ? driver_register+0xae/0x100\n [ 347.624940] ? 0xffffffffa0893000\n [ 347.625329] mlx5_ib_init+0x16a/0x1e0 [mlx5_ib]\n [ 347.625845] do_one_initcall+0x4a/0x2a0\n [ 347.626273] ? gcov_event+0x2e2/0x3a0\n [ 347.626706] do_init_module+0x8a/0x260\n [ 347.627126] init_module_from_file+0x8b/0xd0\n [ 347.627596] __x64_sys_finit_module+0x1ca/0x2f0\n [ 347.628089] do_syscall_64+0x4c/0x100", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47694" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3753b56d-61db-450e-ac53-f124708c789a.json b/objects/vulnerability/vulnerability--3753b56d-61db-450e-ac53-f124708c789a.json new file mode 100644 index 00000000000..41ed19f022f --- /dev/null +++ b/objects/vulnerability/vulnerability--3753b56d-61db-450e-ac53-f124708c789a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--16b074aa-775f-41a8-b746-925075cc9954", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3753b56d-61db-450e-ac53-f124708c789a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.8877Z", + "modified": "2024-10-22T00:37:10.8877Z", + "name": "CVE-2024-47691", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()\n\nsyzbot reports a f2fs bug as below:\n\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n print_report+0xe8/0x550 mm/kasan/report.c:491\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n instrument_atomic_read_write include/linux/instrumented.h:96 [inline]\n atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]\n __refcount_add include/linux/refcount.h:184 [inline]\n __refcount_inc include/linux/refcount.h:241 [inline]\n refcount_inc include/linux/refcount.h:258 [inline]\n get_task_struct include/linux/sched/task.h:118 [inline]\n kthread_stop+0xca/0x630 kernel/kthread.c:704\n f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210\n f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283\n f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline]\n __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is below race condition, it may cause use-after-free\nissue in sbi->gc_th pointer.\n\n- remount\n - f2fs_remount\n - f2fs_stop_gc_thread\n - kfree(gc_th)\n\t\t\t\t- f2fs_ioc_shutdown\n\t\t\t\t - f2fs_do_shutdown\n\t\t\t\t - f2fs_stop_gc_thread\n\t\t\t\t - kthread_stop(gc_th->f2fs_gc_task)\n : sbi->gc_thread = NULL;\n\nWe will call f2fs_do_shutdown() in two paths:\n- for f2fs_ioc_shutdown() path, we should grab sb->s_umount semaphore\nfor fixing.\n- for f2fs_shutdown() path, it's safe since caller has already grabbed\nsb->s_umount semaphore.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47691" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--37c66cf8-75d3-449e-82f8-ece43ec01ffc.json b/objects/vulnerability/vulnerability--37c66cf8-75d3-449e-82f8-ece43ec01ffc.json new file mode 100644 index 00000000000..ae2054d110a --- /dev/null +++ b/objects/vulnerability/vulnerability--37c66cf8-75d3-449e-82f8-ece43ec01ffc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ae2f31db-e2c7-436f-ba8e-858b88bf7f27", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--37c66cf8-75d3-449e-82f8-ece43ec01ffc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.189663Z", + "modified": "2024-10-22T00:37:12.189663Z", + "name": "CVE-2024-49867", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: wait for fixup workers before stopping cleaner kthread during umount\n\nDuring unmount, at close_ctree(), we have the following steps in this order:\n\n1) Park the cleaner kthread - this doesn't destroy the kthread, it basically\n halts its execution (wake ups against it work but do nothing);\n\n2) We stop the cleaner kthread - this results in freeing the respective\n struct task_struct;\n\n3) We call btrfs_stop_all_workers() which waits for any jobs running in all\n the work queues and then free the work queues.\n\nSyzbot reported a case where a fixup worker resulted in a crash when doing\na delayed iput on its inode while attempting to wake up the cleaner at\nbtrfs_add_delayed_iput(), because the task_struct of the cleaner kthread\nwas already freed. This can happen during unmount because we don't wait\nfor any fixup workers still running before we call kthread_stop() against\nthe cleaner kthread, which stops and free all its resources.\n\nFix this by waiting for any fixup workers at close_ctree() before we call\nkthread_stop() against the cleaner and run pending delayed iputs.\n\nThe stack traces reported by syzbot were the following:\n\n BUG: KASAN: slab-use-after-free in __lock_acquire+0x77/0x2050 kernel/locking/lockdep.c:5065\n Read of size 8 at addr ffff8880272a8a18 by task kworker/u8:3/52\n\n CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.12.0-rc1-syzkaller #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n Workqueue: btrfs-fixup btrfs_work_helper\n Call Trace:\n \n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n __lock_acquire+0x77/0x2050 kernel/locking/lockdep.c:5065\n lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162\n class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]\n try_to_wake_up+0xb0/0x1480 kernel/sched/core.c:4154\n btrfs_writepage_fixup_worker+0xc16/0xdf0 fs/btrfs/inode.c:2842\n btrfs_work_helper+0x390/0xc50 fs/btrfs/async-thread.c:314\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \n\n Allocated by task 2:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n unpoison_slab_object mm/kasan/common.c:319 [inline]\n __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345\n kasan_slab_alloc include/linux/kasan.h:247 [inline]\n slab_post_alloc_hook mm/slub.c:4086 [inline]\n slab_alloc_node mm/slub.c:4135 [inline]\n kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4187\n alloc_task_struct_node kernel/fork.c:180 [inline]\n dup_task_struct+0x57/0x8c0 kernel/fork.c:1107\n copy_process+0x5d1/0x3d50 kernel/fork.c:2206\n kernel_clone+0x223/0x880 kernel/fork.c:2787\n kernel_thread+0x1bc/0x240 kernel/fork.c:2849\n create_kthread kernel/kthread.c:412 [inline]\n kthreadd+0x60d/0x810 kernel/kthread.c:765\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\n Freed by task 61:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:230 [inline]\n slab_free_h\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49867" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--38192aa8-cf76-484e-bec0-c97747add806.json b/objects/vulnerability/vulnerability--38192aa8-cf76-484e-bec0-c97747add806.json new file mode 100644 index 00000000000..3ca89511fd6 --- /dev/null +++ b/objects/vulnerability/vulnerability--38192aa8-cf76-484e-bec0-c97747add806.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3b73e8df-dbe9-456e-a911-e560f40fa1c3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--38192aa8-cf76-484e-bec0-c97747add806", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.861462Z", + "modified": "2024-10-22T00:37:10.861462Z", + "name": "CVE-2024-47719", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Protect against overflow of ALIGN() during iova allocation\n\nUserspace can supply an iova and uptr such that the target iova alignment\nbecomes really big and ALIGN() overflows which corrupts the selected area\nrange during allocation. CONFIG_IOMMUFD_TEST can detect this:\n\n WARNING: CPU: 1 PID: 5092 at drivers/iommu/iommufd/io_pagetable.c:268 iopt_alloc_area_pages drivers/iommu/iommufd/io_pagetable.c:268 [inline]\n WARNING: CPU: 1 PID: 5092 at drivers/iommu/iommufd/io_pagetable.c:268 iopt_map_pages+0xf95/0x1050 drivers/iommu/iommufd/io_pagetable.c:352\n Modules linked in:\n CPU: 1 PID: 5092 Comm: syz-executor294 Not tainted 6.10.0-rc5-syzkaller-00294-g3ffea9a7a6f7 #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024\n RIP: 0010:iopt_alloc_area_pages drivers/iommu/iommufd/io_pagetable.c:268 [inline]\n RIP: 0010:iopt_map_pages+0xf95/0x1050 drivers/iommu/iommufd/io_pagetable.c:352\n Code: fc e9 a4 f3 ff ff e8 1a 8b 4c fc 41 be e4 ff ff ff e9 8a f3 ff ff e8 0a 8b 4c fc 90 0f 0b 90 e9 37 f5 ff ff e8 fc 8a 4c fc 90 <0f> 0b 90 e9 68 f3 ff ff 48 c7 c1 ec 82 ad 8f 80 e1 07 80 c1 03 38\n RSP: 0018:ffffc90003ebf9e0 EFLAGS: 00010293\n RAX: ffffffff85499fa4 RBX: 00000000ffffffef RCX: ffff888079b49e00\n RDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000\n RBP: ffffc90003ebfc50 R08: ffffffff85499b30 R09: ffffffff85499942\n R10: 0000000000000002 R11: ffff888079b49e00 R12: ffff8880228e0010\n R13: 0000000000000000 R14: 1ffff920007d7f68 R15: ffffc90003ebfd00\n FS: 000055557d760380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000005fdeb8 CR3: 000000007404a000 CR4: 00000000003506f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n \n iommufd_ioas_copy+0x610/0x7b0 drivers/iommu/iommufd/ioas.c:274\n iommufd_fops_ioctl+0x4d9/0x5a0 drivers/iommu/iommufd/main.c:421\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCap the automatic alignment to the huge page size, which is probably a\nbetter idea overall. Huge automatic alignments can fragment and chew up\nthe available IOVA space without any reason.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47719" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3851785d-8229-47cd-bb01-7072811aa65f.json b/objects/vulnerability/vulnerability--3851785d-8229-47cd-bb01-7072811aa65f.json new file mode 100644 index 00000000000..f093da9c2af --- /dev/null +++ b/objects/vulnerability/vulnerability--3851785d-8229-47cd-bb01-7072811aa65f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--bf234b76-f6e3-488b-9bee-4856e997991a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3851785d-8229-47cd-bb01-7072811aa65f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.878724Z", + "modified": "2024-10-22T00:37:10.878724Z", + "name": "CVE-2024-47728", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error\n\nFor all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input\narguments, zero the value for the case of an error as otherwise it could leak\nmemory. For tracing, it is not needed given CAP_PERFMON can already read all\nkernel memory anyway hence bpf_get_func_arg() and bpf_get_func_ret() is skipped\nin here.\n\nAlso, the MTU helpers mtu_len pointer value is being written but also read.\nTechnically, the MEM_UNINIT should not be there in order to always force init.\nRemoving MEM_UNINIT needs more verifier rework though: MEM_UNINIT right now\nimplies two things actually: i) write into memory, ii) memory does not have\nto be initialized. If we lift MEM_UNINIT, it then becomes: i) read into memory,\nii) memory must be initialized. This means that for bpf_*_check_mtu() we're\nreadding the issue we're trying to fix, that is, it would then be able to\nwrite back into things like .rodata BPF maps. Follow-up work will rework the\nMEM_UNINIT semantics such that the intent can be better expressed. For now\njust clear the *mtu_len on error path which can be lifted later again.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47728" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3989d8ce-af53-4b72-8782-f1b4c324b1e8.json b/objects/vulnerability/vulnerability--3989d8ce-af53-4b72-8782-f1b4c324b1e8.json new file mode 100644 index 00000000000..faff0980e81 --- /dev/null +++ b/objects/vulnerability/vulnerability--3989d8ce-af53-4b72-8782-f1b4c324b1e8.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d51323dc-c0d2-4d74-bd96-6413f5eed449", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3989d8ce-af53-4b72-8782-f1b4c324b1e8", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.935522Z", + "modified": "2024-10-22T00:37:10.935522Z", + "name": "CVE-2024-47749", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cxgb4: Added NULL check for lookup_atid\n\nThe lookup_atid() function can return NULL if the ATID is\ninvalid or does not exist in the identifier table, which\ncould lead to dereferencing a null pointer without a\ncheck in the `act_establish()` and `act_open_rpl()` functions.\nAdd a NULL check to prevent null pointer dereferencing.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47749" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3a12957e-c3e5-49a6-a123-6d21bad0a7b1.json b/objects/vulnerability/vulnerability--3a12957e-c3e5-49a6-a123-6d21bad0a7b1.json new file mode 100644 index 00000000000..dc1d51e4d29 --- /dev/null +++ b/objects/vulnerability/vulnerability--3a12957e-c3e5-49a6-a123-6d21bad0a7b1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--46b2b806-2890-4e9d-a71b-533376bd9180", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3a12957e-c3e5-49a6-a123-6d21bad0a7b1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.111546Z", + "modified": "2024-10-22T00:37:12.111546Z", + "name": "CVE-2024-49875", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: map the EBADMSG to nfserr_io to avoid warning\n\nExt4 will throw -EBADMSG through ext4_readdir when a checksum error\noccurs, resulting in the following WARNING.\n\nFix it by mapping EBADMSG to nfserr_io.\n\nnfsd_buffered_readdir\n iterate_dir // -EBADMSG -74\n ext4_readdir // .iterate_shared\n ext4_dx_readdir\n ext4_htree_fill_tree\n htree_dirblock_to_tree\n ext4_read_dirblock\n __ext4_read_dirblock\n ext4_dirblock_csum_verify\n warn_no_space_for_csum\n __warn_no_space_for_csum\n return ERR_PTR(-EFSBADCRC) // -EBADMSG -74\n nfserrno // WARNING\n\n[ 161.115610] ------------[ cut here ]------------\n[ 161.116465] nfsd: non-standard errno: -74\n[ 161.117315] WARNING: CPU: 1 PID: 780 at fs/nfsd/nfsproc.c:878 nfserrno+0x9d/0xd0\n[ 161.118596] Modules linked in:\n[ 161.119243] CPU: 1 PID: 780 Comm: nfsd Not tainted 5.10.0-00014-g79679361fd5d #138\n[ 161.120684] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qe\nmu.org 04/01/2014\n[ 161.123601] RIP: 0010:nfserrno+0x9d/0xd0\n[ 161.124676] Code: 0f 87 da 30 dd 00 83 e3 01 b8 00 00 00 05 75 d7 44 89 ee 48 c7 c7 c0 57 24 98 89 44 24 04 c6\n 05 ce 2b 61 03 01 e8 99 20 d8 00 <0f> 0b 8b 44 24 04 eb b5 4c 89 e6 48 c7 c7 a0 6d a4 99 e8 cc 15 33\n[ 161.127797] RSP: 0018:ffffc90000e2f9c0 EFLAGS: 00010286\n[ 161.128794] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[ 161.130089] RDX: 1ffff1103ee16f6d RSI: 0000000000000008 RDI: fffff520001c5f2a\n[ 161.131379] RBP: 0000000000000022 R08: 0000000000000001 R09: ffff8881f70c1827\n[ 161.132664] R10: ffffed103ee18304 R11: 0000000000000001 R12: 0000000000000021\n[ 161.133949] R13: 00000000ffffffb6 R14: ffff8881317c0000 R15: ffffc90000e2fbd8\n[ 161.135244] FS: 0000000000000000(0000) GS:ffff8881f7080000(0000) knlGS:0000000000000000\n[ 161.136695] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 161.137761] CR2: 00007fcaad70b348 CR3: 0000000144256006 CR4: 0000000000770ee0\n[ 161.139041] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 161.140291] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 161.141519] PKRU: 55555554\n[ 161.142076] Call Trace:\n[ 161.142575] ? __warn+0x9b/0x140\n[ 161.143229] ? nfserrno+0x9d/0xd0\n[ 161.143872] ? report_bug+0x125/0x150\n[ 161.144595] ? handle_bug+0x41/0x90\n[ 161.145284] ? exc_invalid_op+0x14/0x70\n[ 161.146009] ? asm_exc_invalid_op+0x12/0x20\n[ 161.146816] ? nfserrno+0x9d/0xd0\n[ 161.147487] nfsd_buffered_readdir+0x28b/0x2b0\n[ 161.148333] ? nfsd4_encode_dirent_fattr+0x380/0x380\n[ 161.149258] ? nfsd_buffered_filldir+0xf0/0xf0\n[ 161.150093] ? wait_for_concurrent_writes+0x170/0x170\n[ 161.151004] ? generic_file_llseek_size+0x48/0x160\n[ 161.151895] nfsd_readdir+0x132/0x190\n[ 161.152606] ? nfsd4_encode_dirent_fattr+0x380/0x380\n[ 161.153516] ? nfsd_unlink+0x380/0x380\n[ 161.154256] ? override_creds+0x45/0x60\n[ 161.155006] nfsd4_encode_readdir+0x21a/0x3d0\n[ 161.155850] ? nfsd4_encode_readlink+0x210/0x210\n[ 161.156731] ? write_bytes_to_xdr_buf+0x97/0xe0\n[ 161.157598] ? __write_bytes_to_xdr_buf+0xd0/0xd0\n[ 161.158494] ? lock_downgrade+0x90/0x90\n[ 161.159232] ? nfs4svc_decode_voidarg+0x10/0x10\n[ 161.160092] nfsd4_encode_operation+0x15a/0x440\n[ 161.160959] nfsd4_proc_compound+0x718/0xe90\n[ 161.161818] nfsd_dispatch+0x18e/0x2c0\n[ 161.162586] svc_process_common+0x786/0xc50\n[ 161.163403] ? nfsd_svc+0x380/0x380\n[ 161.164137] ? svc_printk+0x160/0x160\n[ 161.164846] ? svc_xprt_do_enqueue.part.0+0x365/0x380\n[ 161.165808] ? nfsd_svc+0x380/0x380\n[ 161.166523] ? rcu_is_watching+0x23/0x40\n[ 161.167309] svc_process+0x1a5/0x200\n[ 161.168019] nfsd+0x1f5/0x380\n[ 161.168663] ? nfsd_shutdown_threads+0x260/0x260\n[ 161.169554] kthread+0x1c4/0x210\n[ 161.170224] ? kthread_insert_work_sanity_check+0x80/0x80\n[ 161.171246] ret_from_fork+0x1f/0x30", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49875" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3bf76871-220d-4831-8d7f-4d4c319922bd.json b/objects/vulnerability/vulnerability--3bf76871-220d-4831-8d7f-4d4c319922bd.json new file mode 100644 index 00000000000..67eda2baa6a --- /dev/null +++ b/objects/vulnerability/vulnerability--3bf76871-220d-4831-8d7f-4d4c319922bd.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1a3c928b-1100-4990-b108-1204f8b4ec76", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3bf76871-220d-4831-8d7f-4d4c319922bd", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.916355Z", + "modified": "2024-10-22T00:37:17.916355Z", + "name": "CVE-2022-49012", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix server->active leak in afs_put_server\n\nThe atomic_read was accidentally replaced with atomic_inc_return,\nwhich prevents the server from getting cleaned up and causes rmmod\nto hang with a warning:\n\n Can't purge s=00000001", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49012" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3c62fe3f-548b-48cf-842c-f9e40028599d.json b/objects/vulnerability/vulnerability--3c62fe3f-548b-48cf-842c-f9e40028599d.json new file mode 100644 index 00000000000..9c2ee27f1c2 --- /dev/null +++ b/objects/vulnerability/vulnerability--3c62fe3f-548b-48cf-842c-f9e40028599d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--cf96dd1c-a8fa-4dcc-9cb2-5b70e70c3f60", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3c62fe3f-548b-48cf-842c-f9e40028599d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.889751Z", + "modified": "2024-10-22T00:37:10.889751Z", + "name": "CVE-2024-47739", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: use integer wrap around to prevent deadlock on seq_nr overflow\n\nWhen submitting more than 2^32 padata objects to padata_do_serial, the\ncurrent sorting implementation incorrectly sorts padata objects with\noverflowed seq_nr, causing them to be placed before existing objects in\nthe reorder list. This leads to a deadlock in the serialization process\nas padata_find_next cannot match padata->seq_nr and pd->processed\nbecause the padata instance with overflowed seq_nr will be selected\nnext.\n\nTo fix this, we use an unsigned integer wrap around to correctly sort\npadata objects in scenarios with integer overflow.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47739" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3d0adf41-40fd-4fd2-9505-5ef17bcc86c2.json b/objects/vulnerability/vulnerability--3d0adf41-40fd-4fd2-9505-5ef17bcc86c2.json new file mode 100644 index 00000000000..6928879dade --- /dev/null +++ b/objects/vulnerability/vulnerability--3d0adf41-40fd-4fd2-9505-5ef17bcc86c2.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--cb0337a7-9aa1-4428-a339-54aa252430ee", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3d0adf41-40fd-4fd2-9505-5ef17bcc86c2", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.961433Z", + "modified": "2024-10-22T00:37:11.961433Z", + "name": "CVE-2024-35285", + "description": "A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-35285" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3d3712cc-74b7-4e2f-9906-1b9f83810c5b.json b/objects/vulnerability/vulnerability--3d3712cc-74b7-4e2f-9906-1b9f83810c5b.json new file mode 100644 index 00000000000..25b65753b62 --- /dev/null +++ b/objects/vulnerability/vulnerability--3d3712cc-74b7-4e2f-9906-1b9f83810c5b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6e0ed1ae-92d1-4699-8d9b-36b7c9ed7c5d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3d3712cc-74b7-4e2f-9906-1b9f83810c5b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.077396Z", + "modified": "2024-10-22T00:37:12.077396Z", + "name": "CVE-2024-49932", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't readahead the relocation inode on RST\n\nOn relocation we're doing readahead on the relocation inode, but if the\nfilesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to\npreallocated extents not being mapped in the RST) from the lookup.\n\nBut readahead doesn't handle the error and submits invalid reads to the\ndevice, causing an assertion in the scatter-gather list code:\n\n BTRFS info (device nvme1n1): balance: start -d -m -s\n BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0\n BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0\n ------------[ cut here ]------------\n kernel BUG at include/linux/scatterlist.h:115!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\n CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567\n RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0\n Call Trace:\n \n ? __die_body.cold+0x14/0x25\n ? die+0x2e/0x50\n ? do_trap+0xca/0x110\n ? do_error_trap+0x65/0x80\n ? __blk_rq_map_sg+0x339/0x4a0\n ? exc_invalid_op+0x50/0x70\n ? __blk_rq_map_sg+0x339/0x4a0\n ? asm_exc_invalid_op+0x1a/0x20\n ? __blk_rq_map_sg+0x339/0x4a0\n nvme_prep_rq.part.0+0x9d/0x770\n nvme_queue_rq+0x7d/0x1e0\n __blk_mq_issue_directly+0x2a/0x90\n ? blk_mq_get_budget_and_tag+0x61/0x90\n blk_mq_try_issue_list_directly+0x56/0xf0\n blk_mq_flush_plug_list.part.0+0x52b/0x5d0\n __blk_flush_plug+0xc6/0x110\n blk_finish_plug+0x28/0x40\n read_pages+0x160/0x1c0\n page_cache_ra_unbounded+0x109/0x180\n relocate_file_extent_cluster+0x611/0x6a0\n ? btrfs_search_slot+0xba4/0xd20\n ? balance_dirty_pages_ratelimited_flags+0x26/0xb00\n relocate_data_extent.constprop.0+0x134/0x160\n relocate_block_group+0x3f2/0x500\n btrfs_relocate_block_group+0x250/0x430\n btrfs_relocate_chunk+0x3f/0x130\n btrfs_balance+0x71b/0xef0\n ? kmalloc_trace_noprof+0x13b/0x280\n btrfs_ioctl+0x2c2e/0x3030\n ? kvfree_call_rcu+0x1e6/0x340\n ? list_lru_add_obj+0x66/0x80\n ? mntput_no_expire+0x3a/0x220\n __x64_sys_ioctl+0x96/0xc0\n do_syscall_64+0x54/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7fcc04514f9b\n Code: Unable to access opcode bytes at 0x7fcc04514f71.\n RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b\n RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003\n RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001\n R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5\n R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0\n \n Modules linked in:\n ---[ end trace 0000000000000000 ]---\n RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0\n Kernel p\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49932" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3d805172-d853-4567-ac9f-eb597cf2db9f.json b/objects/vulnerability/vulnerability--3d805172-d853-4567-ac9f-eb597cf2db9f.json new file mode 100644 index 00000000000..e8b9da2d05b --- /dev/null +++ b/objects/vulnerability/vulnerability--3d805172-d853-4567-ac9f-eb597cf2db9f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e894447b-bea5-484b-a85b-11e45416c34a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3d805172-d853-4567-ac9f-eb597cf2db9f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.972432Z", + "modified": "2024-10-22T00:37:10.972432Z", + "name": "CVE-2024-50047", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF in async decryption\n\nDoing an async decryption (large read) crashes with a\nslab-use-after-free way down in the crypto API.\n\nReproducer:\n # mount.cifs -o ...,seal,esize=1 //srv/share /mnt\n # dd if=/mnt/largefile of=/dev/null\n ...\n [ 194.196391] ==================================================================\n [ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110\n [ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899\n [ 194.197707]\n [ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43\n [ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\n [ 194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs]\n [ 194.200032] Call Trace:\n [ 194.200191] \n [ 194.200327] dump_stack_lvl+0x4e/0x70\n [ 194.200558] ? gf128mul_4k_lle+0xc1/0x110\n [ 194.200809] print_report+0x174/0x505\n [ 194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n [ 194.201352] ? srso_return_thunk+0x5/0x5f\n [ 194.201604] ? __virt_addr_valid+0xdf/0x1c0\n [ 194.201868] ? gf128mul_4k_lle+0xc1/0x110\n [ 194.202128] kasan_report+0xc8/0x150\n [ 194.202361] ? gf128mul_4k_lle+0xc1/0x110\n [ 194.202616] gf128mul_4k_lle+0xc1/0x110\n [ 194.202863] ghash_update+0x184/0x210\n [ 194.203103] shash_ahash_update+0x184/0x2a0\n [ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10\n [ 194.203651] ? srso_return_thunk+0x5/0x5f\n [ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340\n [ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140\n [ 194.204434] crypt_message+0xec1/0x10a0 [cifs]\n [ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs]\n [ 194.208507] ? srso_return_thunk+0x5/0x5f\n [ 194.209205] ? srso_return_thunk+0x5/0x5f\n [ 194.209925] ? srso_return_thunk+0x5/0x5f\n [ 194.210443] ? srso_return_thunk+0x5/0x5f\n [ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs]\n [ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]\n [ 194.214670] ? srso_return_thunk+0x5/0x5f\n [ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs]\n\nThis is because TFM is being used in parallel.\n\nFix this by allocating a new AEAD TFM for async decryption, but keep\nthe existing one for synchronous READ cases (similar to what is done\nin smb3_calc_signature()).\n\nAlso remove the calls to aead_request_set_callback() and\ncrypto_wait_req() since it's always going to be a synchronous operation.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50047" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3dcabdfb-b8de-4aa8-bf1f-eb29bd8ca56c.json b/objects/vulnerability/vulnerability--3dcabdfb-b8de-4aa8-bf1f-eb29bd8ca56c.json new file mode 100644 index 00000000000..3e1b8df6ddc --- /dev/null +++ b/objects/vulnerability/vulnerability--3dcabdfb-b8de-4aa8-bf1f-eb29bd8ca56c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--687ef2b5-a8b7-43c6-ac45-8cf19a59bb3b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3dcabdfb-b8de-4aa8-bf1f-eb29bd8ca56c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.157264Z", + "modified": "2024-10-22T00:37:12.157264Z", + "name": "CVE-2024-49968", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: filesystems without casefold feature cannot be mounted with siphash\n\nWhen mounting the ext4 filesystem, if the default hash version is set to\nDX_HASH_SIPHASH but the casefold feature is not set, exit the mounting.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49968" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3e85e2d8-a85d-47fe-81e5-041f47e01d4e.json b/objects/vulnerability/vulnerability--3e85e2d8-a85d-47fe-81e5-041f47e01d4e.json new file mode 100644 index 00000000000..a4959f2ac1d --- /dev/null +++ b/objects/vulnerability/vulnerability--3e85e2d8-a85d-47fe-81e5-041f47e01d4e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d6ed4f23-7ece-4903-85ff-5ab1642c243a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3e85e2d8-a85d-47fe-81e5-041f47e01d4e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.835307Z", + "modified": "2024-10-22T00:37:10.835307Z", + "name": "CVE-2024-47912", + "description": "A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms. A successful exploit could allow an attacker to access and delete sensitive information.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47912" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3eb44ed1-cf2f-48ef-880e-a175a908d33e.json b/objects/vulnerability/vulnerability--3eb44ed1-cf2f-48ef-880e-a175a908d33e.json new file mode 100644 index 00000000000..eb8f2d59b7c --- /dev/null +++ b/objects/vulnerability/vulnerability--3eb44ed1-cf2f-48ef-880e-a175a908d33e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2ee4d651-585d-4628-8085-2bd653ec2b47", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3eb44ed1-cf2f-48ef-880e-a175a908d33e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.084342Z", + "modified": "2024-10-22T00:37:12.084342Z", + "name": "CVE-2024-49892", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Initialize get_bytes_per_element's default to 1\n\nVariables, used as denominators and maybe not assigned to other values,\nshould not be 0. bytes_per_element_y & bytes_per_element_c are\ninitialized by get_bytes_per_element() which should never return 0.\n\nThis fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49892" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--3f825f23-c54d-4d76-a86d-97b8a8262555.json b/objects/vulnerability/vulnerability--3f825f23-c54d-4d76-a86d-97b8a8262555.json new file mode 100644 index 00000000000..a6b6fe67020 --- /dev/null +++ b/objects/vulnerability/vulnerability--3f825f23-c54d-4d76-a86d-97b8a8262555.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--61f761f9-c5ef-4c0f-a935-fbc54976513a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--3f825f23-c54d-4d76-a86d-97b8a8262555", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.587719Z", + "modified": "2024-10-22T00:37:10.587719Z", + "name": "CVE-2024-30159", + "description": "A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-30159" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--401f24da-a52b-4340-8b07-79cdc9ca8fbc.json b/objects/vulnerability/vulnerability--401f24da-a52b-4340-8b07-79cdc9ca8fbc.json new file mode 100644 index 00000000000..35876bdba5d --- /dev/null +++ b/objects/vulnerability/vulnerability--401f24da-a52b-4340-8b07-79cdc9ca8fbc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4fa78c7e-0c0d-4922-8529-ffcafa604667", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--401f24da-a52b-4340-8b07-79cdc9ca8fbc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.700267Z", + "modified": "2024-10-22T00:37:16.700267Z", + "name": "CVE-2022-48964", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nravb: Fix potential use-after-free in ravb_rx_gbeth()\n\nThe skb is delivered to napi_gro_receive() which may free it, after calling this,\ndereferencing skb may trigger use-after-free.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48964" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--40ee18f9-9c6b-469e-bfaf-7253a66aa43d.json b/objects/vulnerability/vulnerability--40ee18f9-9c6b-469e-bfaf-7253a66aa43d.json new file mode 100644 index 00000000000..c8f59e63e07 --- /dev/null +++ b/objects/vulnerability/vulnerability--40ee18f9-9c6b-469e-bfaf-7253a66aa43d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d9b529b7-1efc-49aa-b2b2-841f25c7e70e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--40ee18f9-9c6b-469e-bfaf-7253a66aa43d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.938836Z", + "modified": "2024-10-22T00:37:17.938836Z", + "name": "CVE-2022-49006", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Free buffers when a used dynamic event is removed\n\nAfter 65536 dynamic events have been added and removed, the \"type\" field\nof the event then uses the first type number that is available (not\ncurrently used by other events). A type number is the identifier of the\nbinary blobs in the tracing ring buffer (known as events) to map them to\nlogic that can parse the binary blob.\n\nThe issue is that if a dynamic event (like a kprobe event) is traced and\nis in the ring buffer, and then that event is removed (because it is\ndynamic, which means it can be created and destroyed), if another dynamic\nevent is created that has the same number that new event's logic on\nparsing the binary blob will be used.\n\nTo show how this can be an issue, the following can crash the kernel:\n\n # cd /sys/kernel/tracing\n # for i in `seq 65536`; do\n echo 'p:kprobes/foo do_sys_openat2 $arg1:u32' > kprobe_events\n # done\n\nFor every iteration of the above, the writing to the kprobe_events will\nremove the old event and create a new one (with the same format) and\nincrease the type number to the next available on until the type number\nreaches over 65535 which is the max number for the 16 bit type. After it\nreaches that number, the logic to allocate a new number simply looks for\nthe next available number. When an dynamic event is removed, that number\nis then available to be reused by the next dynamic event created. That is,\nonce the above reaches the max number, the number assigned to the event in\nthat loop will remain the same.\n\nNow that means deleting one dynamic event and created another will reuse\nthe previous events type number. This is where bad things can happen.\nAfter the above loop finishes, the kprobes/foo event which reads the\ndo_sys_openat2 function call's first parameter as an integer.\n\n # echo 1 > kprobes/foo/enable\n # cat /etc/passwd > /dev/null\n # cat trace\n cat-2211 [005] .... 2007.849603: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n cat-2211 [005] .... 2007.849620: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n cat-2211 [005] .... 2007.849838: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n cat-2211 [005] .... 2007.849880: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n # echo 0 > kprobes/foo/enable\n\nNow if we delete the kprobe and create a new one that reads a string:\n\n # echo 'p:kprobes/foo do_sys_openat2 +0($arg2):string' > kprobe_events\n\nAnd now we can the trace:\n\n # cat trace\n sendmail-1942 [002] ..... 530.136320: foo: (do_sys_openat2+0x0/0x240) arg1= cat-2046 [004] ..... 530.930817: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n cat-2046 [004] ..... 530.930961: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n cat-2046 [004] ..... 530.934278: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n cat-2046 [004] ..... 530.934563: foo: (do_sys_openat2+0x0/0x240) arg1=\"���������������������������������������\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49006" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4145a104-c88d-476d-b718-67ecebd89eeb.json b/objects/vulnerability/vulnerability--4145a104-c88d-476d-b718-67ecebd89eeb.json new file mode 100644 index 00000000000..9bfa8fee087 --- /dev/null +++ b/objects/vulnerability/vulnerability--4145a104-c88d-476d-b718-67ecebd89eeb.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f4efe164-73c3-4730-a655-d39a9da5c3f8", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4145a104-c88d-476d-b718-67ecebd89eeb", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.036852Z", + "modified": "2024-10-22T00:37:12.036852Z", + "name": "CVE-2024-49956", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix double destroy_workqueue error\n\nWhen gfs2_fill_super() fails, destroy_workqueue() is called within\ngfs2_gl_hash_clear(), and the subsequent code path calls\ndestroy_workqueue() on the same work queue again.\n\nThis issue can be fixed by setting the work queue pointer to NULL after\nthe first destroy_workqueue() call and checking for a NULL pointer\nbefore attempting to destroy the work queue again.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49956" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--429b82f2-8513-4ae8-b089-d990503504f2.json b/objects/vulnerability/vulnerability--429b82f2-8513-4ae8-b089-d990503504f2.json new file mode 100644 index 00000000000..2e3e14e8adc --- /dev/null +++ b/objects/vulnerability/vulnerability--429b82f2-8513-4ae8-b089-d990503504f2.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b25e57c3-3fbd-4632-9fcc-34677ea775c8", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--429b82f2-8513-4ae8-b089-d990503504f2", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.724667Z", + "modified": "2024-10-22T00:37:16.724667Z", + "name": "CVE-2022-48972", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()\n\nKernel fault injection test reports null-ptr-deref as follows:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nRIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114\nCall Trace:\n \n raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87\n call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944\n unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982\n unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879\n register_netdevice+0x9a8/0xb90 net/core/dev.c:10083\n ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659\n ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229\n mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316\n\nieee802154_if_add() allocates wpan_dev as netdev's private data, but not\ninit the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage\nthe list when device register/unregister, and may lead to null-ptr-deref.\n\nUse INIT_LIST_HEAD() on it to initialize it correctly.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48972" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--43300332-1edd-48bd-9965-5f02239a83a0.json b/objects/vulnerability/vulnerability--43300332-1edd-48bd-9965-5f02239a83a0.json new file mode 100644 index 00000000000..0311e66e89d --- /dev/null +++ b/objects/vulnerability/vulnerability--43300332-1edd-48bd-9965-5f02239a83a0.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3dc277aa-bcab-4ee1-947c-746666cf902c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--43300332-1edd-48bd-9965-5f02239a83a0", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:20.68318Z", + "modified": "2024-10-22T00:37:20.68318Z", + "name": "CVE-2023-52917", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()\n\nThe debugfs_create_dir() function returns error pointers.\nIt never returns NULL. So use IS_ERR() to check it.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2023-52917" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4435affd-ab6e-4ca4-b122-8b5bde733f7f.json b/objects/vulnerability/vulnerability--4435affd-ab6e-4ca4-b122-8b5bde733f7f.json new file mode 100644 index 00000000000..bf847b92888 --- /dev/null +++ b/objects/vulnerability/vulnerability--4435affd-ab6e-4ca4-b122-8b5bde733f7f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a0ecb139-8675-40ae-9ec2-5de4cf67a114", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4435affd-ab6e-4ca4-b122-8b5bde733f7f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.950996Z", + "modified": "2024-10-22T00:37:10.950996Z", + "name": "CVE-2024-47695", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds\n\nIn the function init_conns(), after the create_con() and create_cm() for\nloop if something fails. In the cleanup for loop after the destroy tag, we\naccess out of bound memory because cid is set to clt_path->s.con_num.\n\nThis commits resets the cid to clt_path->s.con_num - 1, to stay in bounds\nin the cleanup loop later.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47695" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4481e262-ad5e-4a2f-98bb-abff37e5cf5e.json b/objects/vulnerability/vulnerability--4481e262-ad5e-4a2f-98bb-abff37e5cf5e.json new file mode 100644 index 00000000000..08ead11b968 --- /dev/null +++ b/objects/vulnerability/vulnerability--4481e262-ad5e-4a2f-98bb-abff37e5cf5e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--53486f82-6b70-43ce-af62-c9e448603d27", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4481e262-ad5e-4a2f-98bb-abff37e5cf5e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.929467Z", + "modified": "2024-10-22T00:37:10.929467Z", + "name": "CVE-2024-47710", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsock_map: Add a cond_resched() in sock_hash_free()\n\nSeveral syzbot soft lockup reports all have in common sock_hash_free()\n\nIf a map with a large number of buckets is destroyed, we need to yield\nthe cpu when needed.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47710" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--448f3403-6387-4596-8d74-7cfe2d13e1c6.json b/objects/vulnerability/vulnerability--448f3403-6387-4596-8d74-7cfe2d13e1c6.json new file mode 100644 index 00000000000..027e6e7777f --- /dev/null +++ b/objects/vulnerability/vulnerability--448f3403-6387-4596-8d74-7cfe2d13e1c6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c94db395-468b-4c48-8c11-f842b70eda0a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--448f3403-6387-4596-8d74-7cfe2d13e1c6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.129863Z", + "modified": "2024-10-22T00:37:12.129863Z", + "name": "CVE-2024-49967", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: no need to continue when the number of entries is 1", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49967" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--453fc0e4-27f9-4a7c-94e7-4112f14da2ec.json b/objects/vulnerability/vulnerability--453fc0e4-27f9-4a7c-94e7-4112f14da2ec.json new file mode 100644 index 00000000000..f844776ac3a --- /dev/null +++ b/objects/vulnerability/vulnerability--453fc0e4-27f9-4a7c-94e7-4112f14da2ec.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2132597e-6ee4-4122-9e92-0bc278ebd1dd", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--453fc0e4-27f9-4a7c-94e7-4112f14da2ec", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.0073Z", + "modified": "2024-10-22T00:37:11.0073Z", + "name": "CVE-2024-50049", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointer before dereferencing se\n\n[WHAT & HOW]\nse is null checked previously in the same function, indicating\nit might be null; therefore, it must be checked when used again.\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50049" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--46b45cc9-6335-4c8e-a6cf-37c83d128555.json b/objects/vulnerability/vulnerability--46b45cc9-6335-4c8e-a6cf-37c83d128555.json new file mode 100644 index 00000000000..f95a841d034 --- /dev/null +++ b/objects/vulnerability/vulnerability--46b45cc9-6335-4c8e-a6cf-37c83d128555.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--21885025-6cef-4dfd-9046-b9a804cf9d7a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--46b45cc9-6335-4c8e-a6cf-37c83d128555", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.919188Z", + "modified": "2024-10-22T00:37:10.919188Z", + "name": "CVE-2024-47745", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\n\nThe remap_file_pages syscall handler calls do_mmap() directly, which\ndoesn't contain the LSM security check. And if the process has called\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\nRW pages, this will actually result in remapping the pages to RWX,\nbypassing a W^X policy enforced by SELinux.\n\nSo we should check prot by security_mmap_file LSM hook in the\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\npotentially permits an attacker to bypass a W^X policy enforced by\nSELinux.\n\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\nAIO and can be found in [1].\n\nThe PoC:\n\n$ cat > test.c\n\nint main(void) {\n\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\n\tint mfd = syscall(SYS_memfd_create, \"test\", 0);\n\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\n\t\tMAP_SHARED, mfd, 0);\n\tunsigned int old = syscall(SYS_personality, 0xffffffff);\n\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\n\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\n\tsyscall(SYS_personality, old);\n\t// show the RWX page exists even if W^X policy is enforced\n\tint fd = open(\"/proc/self/maps\", O_RDONLY);\n\tunsigned char buf2[1024];\n\twhile (1) {\n\t\tint ret = read(fd, buf2, 1024);\n\t\tif (ret <= 0) break;\n\t\twrite(1, buf2, ret);\n\t}\n\tclose(fd);\n}\n\n$ gcc test.c -o test\n$ ./test | grep rwx\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\n\n[PM: subject line tweaks]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47745" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--46b5a0ed-7087-4ef7-a8f7-e250b01b8919.json b/objects/vulnerability/vulnerability--46b5a0ed-7087-4ef7-a8f7-e250b01b8919.json new file mode 100644 index 00000000000..855dcd71274 --- /dev/null +++ b/objects/vulnerability/vulnerability--46b5a0ed-7087-4ef7-a8f7-e250b01b8919.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--fd183ce9-955f-4bae-81e9-e16f57bc9f25", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--46b5a0ed-7087-4ef7-a8f7-e250b01b8919", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.045981Z", + "modified": "2024-10-22T00:37:12.045981Z", + "name": "CVE-2024-49907", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before using dc->clk_mgr\n\n[WHY & HOW]\ndc->clk_mgr is null checked previously in the same function, indicating\nit might be null.\n\nPassing \"dc\" to \"dc->hwss.apply_idle_power_optimizations\", which\ndereferences null \"dc->clk_mgr\". (The function pointer resolves to\n\"dcn35_apply_idle_power_optimizations\".)\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49907" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--47c6d90b-a254-4019-a02d-41512703580a.json b/objects/vulnerability/vulnerability--47c6d90b-a254-4019-a02d-41512703580a.json new file mode 100644 index 00000000000..119e306b8fc --- /dev/null +++ b/objects/vulnerability/vulnerability--47c6d90b-a254-4019-a02d-41512703580a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6c4f24d3-5f6f-426a-b7c0-31514c2dd189", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--47c6d90b-a254-4019-a02d-41512703580a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.651974Z", + "modified": "2024-10-22T00:37:11.651974Z", + "name": "CVE-2024-40089", + "description": "A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-40089" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4806c7e4-43ce-49c8-ad89-c560786ef6b2.json b/objects/vulnerability/vulnerability--4806c7e4-43ce-49c8-ad89-c560786ef6b2.json new file mode 100644 index 00000000000..d1e7a8de35c --- /dev/null +++ b/objects/vulnerability/vulnerability--4806c7e4-43ce-49c8-ad89-c560786ef6b2.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--88921294-281a-4048-80ce-249366f76bea", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4806c7e4-43ce-49c8-ad89-c560786ef6b2", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.930316Z", + "modified": "2024-10-22T00:37:17.930316Z", + "name": "CVE-2022-49005", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Fix bounds check for _sx controls\n\nFor _sx controls the semantics of the max field is not the usual one, max\nis the number of steps rather than the maximum value. This means that our\ncheck in snd_soc_put_volsw_sx() needs to just check against the maximum\nvalue.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49005" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--484afbbd-3393-44fe-8152-8a95de35918d.json b/objects/vulnerability/vulnerability--484afbbd-3393-44fe-8152-8a95de35918d.json new file mode 100644 index 00000000000..3332c46cd0f --- /dev/null +++ b/objects/vulnerability/vulnerability--484afbbd-3393-44fe-8152-8a95de35918d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--12f6ba4f-80fc-48bc-8506-45c2196e7e18", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--484afbbd-3393-44fe-8152-8a95de35918d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.031166Z", + "modified": "2024-10-22T00:37:11.031166Z", + "name": "CVE-2024-50059", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition\n\nIn the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev\nfunction, then &sndev->check_link_status_work is bound with\ncheck_link_status_work. switchtec_ntb_link_notification may be called\nto start the work.\n\nIf we remove the module which will call switchtec_ntb_remove to make\ncleanup, it will free sndev through kfree(sndev), while the work\nmentioned above will be used. The sequence of operations that may lead\nto a UAF bug is as follows:\n\nCPU0 CPU1\n\n | check_link_status_work\nswitchtec_ntb_remove |\nkfree(sndev); |\n | if (sndev->link_force_down)\n | // use sndev\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in switchtec_ntb_remove.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50059" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--48f3f6e3-3e59-4fb9-a6bd-861455b7244c.json b/objects/vulnerability/vulnerability--48f3f6e3-3e59-4fb9-a6bd-861455b7244c.json new file mode 100644 index 00000000000..6c138a5fc6f --- /dev/null +++ b/objects/vulnerability/vulnerability--48f3f6e3-3e59-4fb9-a6bd-861455b7244c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e787795a-d4df-4f58-82e7-6595c4ddeb0b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--48f3f6e3-3e59-4fb9-a6bd-861455b7244c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.931997Z", + "modified": "2024-10-22T00:37:10.931997Z", + "name": "CVE-2024-47742", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: Block path traversal\n\nMost firmware names are hardcoded strings, or are constructed from fairly\nconstrained format strings where the dynamic parts are just some hex\nnumbers or such.\n\nHowever, there are a couple codepaths in the kernel where firmware file\nnames contain string components that are passed through from a device or\nsemi-privileged userspace; the ones I could find (not counting interfaces\nthat require root privileges) are:\n\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\n filename from \"ModelName\", a string that was previously parsed out of\n some descriptor (\"Vital Product Data\") in lpfc_fill_vpd()\n - nfp_net_fw_find() seems to construct a firmware filename from a model\n name coming from nfp_hwinfo_lookup(pf->hwinfo, \"nffw.partno\"), which I\n think parses some descriptor that was read from the device.\n (But this case likely isn't exploitable because the format string looks\n like \"netronome/nic_%s\", and there shouldn't be any *folders* starting\n with \"netronome/nic_\". The previous case was different because there,\n the \"%s\" is *at the start* of the format string.)\n - module_flash_fw_schedule() is reachable from the\n ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\n GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\n enough to pass the privilege check), and takes a userspace-provided\n firmware name.\n (But I think to reach this case, you need to have CAP_NET_ADMIN over a\n network namespace that a special kind of ethernet device is mapped into,\n so I think this is not a viable attack path in practice.)\n\nFix it by rejecting any firmware names containing \"..\" path components.\n\nFor what it's worth, I went looking and haven't found any USB device\ndrivers that use the firmware loader dangerously.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47742" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4905e21b-caba-4c23-9549-3dceae36c378.json b/objects/vulnerability/vulnerability--4905e21b-caba-4c23-9549-3dceae36c378.json new file mode 100644 index 00000000000..3f9ac75879e --- /dev/null +++ b/objects/vulnerability/vulnerability--4905e21b-caba-4c23-9549-3dceae36c378.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--bc3722c7-e75b-4735-9db8-386a26d5e92d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4905e21b-caba-4c23-9549-3dceae36c378", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.058751Z", + "modified": "2024-10-22T00:37:12.058751Z", + "name": "CVE-2024-49215", + "description": "An issue was discovered in Sangoma Asterisk through 18.20.0, 19.x and 20.x through 20.5.0, and 21.x through 21.0.0, and Certified Asterisk through 18.9-cert5. In manager.c, the functions action_getconfig() and action_getconfigJson() do not process the input file path, resulting in a path traversal vulnerability. In versions without the restrictedFile() function, no processing is done on the input path. In versions with the restrictedFile() function, path traversal is not processed.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49215" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4995e6f6-81f7-4391-ad73-e6f6492148c0.json b/objects/vulnerability/vulnerability--4995e6f6-81f7-4391-ad73-e6f6492148c0.json new file mode 100644 index 00000000000..c5fe92e6f88 --- /dev/null +++ b/objects/vulnerability/vulnerability--4995e6f6-81f7-4391-ad73-e6f6492148c0.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--fc031313-b071-446b-9f66-93d65f77744d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4995e6f6-81f7-4391-ad73-e6f6492148c0", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.708456Z", + "modified": "2024-10-22T00:37:16.708456Z", + "name": "CVE-2022-48973", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: amd8111: Fix PCI device reference count leak\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() after the 'out' label. Since pci_dev_put() can handle NULL\ninput parameter, there is no problem for the 'Device not found' branch.\nFor the normal path, add pci_dev_put() in amd_gpio_exit().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48973" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--499b7883-5482-4b97-91ae-902d0d7c3ff4.json b/objects/vulnerability/vulnerability--499b7883-5482-4b97-91ae-902d0d7c3ff4.json new file mode 100644 index 00000000000..7d17ac31e47 --- /dev/null +++ b/objects/vulnerability/vulnerability--499b7883-5482-4b97-91ae-902d0d7c3ff4.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4f405f14-6ceb-4c0f-924c-bbada44e76c7", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--499b7883-5482-4b97-91ae-902d0d7c3ff4", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.711662Z", + "modified": "2024-10-22T00:37:16.711662Z", + "name": "CVE-2022-48959", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions()\n\nWhen dsa_devlink_region_create failed in sja1105_setup_devlink_regions(),\npriv->regions is not released.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48959" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--49eedf14-4a28-4e2c-9fbc-55b37c4aa2e6.json b/objects/vulnerability/vulnerability--49eedf14-4a28-4e2c-9fbc-55b37c4aa2e6.json new file mode 100644 index 00000000000..6e62ca6f9e1 --- /dev/null +++ b/objects/vulnerability/vulnerability--49eedf14-4a28-4e2c-9fbc-55b37c4aa2e6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0db8f7af-1075-45fc-9f12-1b027a598cff", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--49eedf14-4a28-4e2c-9fbc-55b37c4aa2e6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.693425Z", + "modified": "2024-10-22T00:37:16.693425Z", + "name": "CVE-2022-48955", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: thunderbolt: fix memory leak in tbnet_open()\n\nWhen tb_ring_alloc_rx() failed in tbnet_open(), ida that allocated in\ntb_xdomain_alloc_out_hopid() is not released. Add\ntb_xdomain_release_out_hopid() to the error path to release ida.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48955" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4a32caed-55ca-42b1-aadf-bf27b0d9e7c5.json b/objects/vulnerability/vulnerability--4a32caed-55ca-42b1-aadf-bf27b0d9e7c5.json new file mode 100644 index 00000000000..3d312bc2c5f --- /dev/null +++ b/objects/vulnerability/vulnerability--4a32caed-55ca-42b1-aadf-bf27b0d9e7c5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2c37b361-6ab5-4172-9df6-52d732975222", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4a32caed-55ca-42b1-aadf-bf27b0d9e7c5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.132471Z", + "modified": "2024-10-22T00:37:12.132471Z", + "name": "CVE-2024-49991", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer\n\nPass pointer reference to amdgpu_bo_unref to clear the correct pointer,\notherwise amdgpu_bo_unref clear the local variable, the original pointer\nnot set to NULL, this could cause use-after-free bug.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49991" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4ac68d94-9842-48d3-b6ba-1586e3cae94b.json b/objects/vulnerability/vulnerability--4ac68d94-9842-48d3-b6ba-1586e3cae94b.json new file mode 100644 index 00000000000..fa4a15f5cf5 --- /dev/null +++ b/objects/vulnerability/vulnerability--4ac68d94-9842-48d3-b6ba-1586e3cae94b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--034f83de-8eab-44e7-aa18-792af69b85cb", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4ac68d94-9842-48d3-b6ba-1586e3cae94b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.979083Z", + "modified": "2024-10-22T00:37:10.979083Z", + "name": "CVE-2024-50065", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: Change to non-blocking allocation in ntfs_d_hash\n\nd_hash is done while under \"rcu-walk\" and should not sleep.\n__get_name() allocates using GFP_KERNEL, having the possibility\nto sleep when under memory pressure. Change the allocation to\nGFP_NOWAIT.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50065" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4addc2e6-db8b-463a-943d-0f033872977a.json b/objects/vulnerability/vulnerability--4addc2e6-db8b-463a-943d-0f033872977a.json new file mode 100644 index 00000000000..5caca202ced --- /dev/null +++ b/objects/vulnerability/vulnerability--4addc2e6-db8b-463a-943d-0f033872977a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--dba4bcb8-4bef-41f8-bf15-8bba4808e361", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4addc2e6-db8b-463a-943d-0f033872977a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.926989Z", + "modified": "2024-10-22T00:37:10.926989Z", + "name": "CVE-2024-47683", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip Recompute DSC Params if no Stream on Link\n\n[why]\nEncounter NULL pointer dereference uner mst + dsc setup.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2\n Hardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022\n RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper]\n Code: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 <48> 8>\n RSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293\n RAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224\n RDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280\n RBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850\n R10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000\n R13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224\n FS: 00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0\n Call Trace:\n\n ? __die+0x23/0x70\n ? page_fault_oops+0x171/0x4e0\n ? plist_add+0xbe/0x100\n ? exc_page_fault+0x7c/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n ? drm_dp_atomic_find_time_slots+0x28/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n ? fill_plane_buffer_attributes+0x419/0x510 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n compute_mst_dsc_configs_for_state+0x1e1/0x250 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n amdgpu_dm_atomic_check+0xecd/0x1190 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n drm_atomic_check_only+0x5c5/0xa40\n drm_mode_atomic_ioctl+0x76e/0xbc0\n\n[how]\ndsc recompute should be skipped if no mode change detected on the new\nrequest. If detected, keep checking whether the stream is already on\ncurrent state or not.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47683" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4d50275f-07c0-4eb6-85ab-eb208f87e8bf.json b/objects/vulnerability/vulnerability--4d50275f-07c0-4eb6-85ab-eb208f87e8bf.json new file mode 100644 index 00000000000..2c81a455fa9 --- /dev/null +++ b/objects/vulnerability/vulnerability--4d50275f-07c0-4eb6-85ab-eb208f87e8bf.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--417ce4d7-32a5-46d0-9272-8efcefd4eea9", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4d50275f-07c0-4eb6-85ab-eb208f87e8bf", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.646385Z", + "modified": "2024-10-22T00:37:16.646385Z", + "name": "CVE-2022-48975", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpiolib: fix memory leak in gpiochip_setup_dev()\n\nHere is a backtrace report about memory leak detected in\ngpiochip_setup_dev():\n\nunreferenced object 0xffff88810b406400 (size 512):\n comm \"python3\", pid 1682, jiffies 4295346908 (age 24.090s)\n backtrace:\n kmalloc_trace\n device_add\t\tdevice_private_init at drivers/base/core.c:3361\n\t\t\t(inlined by) device_add at drivers/base/core.c:3411\n cdev_device_add\n gpiolib_cdev_register\n gpiochip_setup_dev\n gpiochip_add_data_with_key\n\ngcdev_register() & gcdev_unregister() would call device_add() &\ndevice_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to\nregister/unregister device.\n\nHowever, if device_add() succeeds, some resource (like\nstruct device_private allocated by device_private_init())\nis not released by device_del().\n\nTherefore, after device_add() succeeds by gcdev_register(), it\nneeds to call put_device() to release resource in the error handle\npath.\n\nHere we move forward the register of release function, and let it\nrelease every piece of resource by put_device() instead of kfree().\n\nWhile at it, fix another subtle issue, i.e. when gc->ngpio is equal\nto 0, we still call kcalloc() and, in case of further error, kfree()\non the ZERO_PTR pointer, which is not NULL. It's not a bug per se,\nbut rather waste of the resources and potentially wrong expectation\nabout contents of the gdev->descs variable.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48975" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4dc11d23-a3e5-4f66-8382-cc73443f8cdd.json b/objects/vulnerability/vulnerability--4dc11d23-a3e5-4f66-8382-cc73443f8cdd.json new file mode 100644 index 00000000000..fc2c0d6db66 --- /dev/null +++ b/objects/vulnerability/vulnerability--4dc11d23-a3e5-4f66-8382-cc73443f8cdd.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--135a786a-4395-40eb-b63c-bcfebf1e747f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4dc11d23-a3e5-4f66-8382-cc73443f8cdd", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.871559Z", + "modified": "2024-10-22T00:37:10.871559Z", + "name": "CVE-2024-47741", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race setting file private on concurrent lseek using same fd\n\nWhen doing concurrent lseek(2) system calls against the same file\ndescriptor, using multiple threads belonging to the same process, we have\na short time window where a race happens and can result in a memory leak.\n\nThe race happens like this:\n\n1) A program opens a file descriptor for a file and then spawns two\n threads (with the pthreads library for example), lets call them\n task A and task B;\n\n2) Task A calls lseek with SEEK_DATA or SEEK_HOLE and ends up at\n file.c:find_desired_extent() while holding a read lock on the inode;\n\n3) At the start of find_desired_extent(), it extracts the file's\n private_data pointer into a local variable named 'private', which has\n a value of NULL;\n\n4) Task B also calls lseek with SEEK_DATA or SEEK_HOLE, locks the inode\n in shared mode and enters file.c:find_desired_extent(), where it also\n extracts file->private_data into its local variable 'private', which\n has a NULL value;\n\n5) Because it saw a NULL file private, task A allocates a private\n structure and assigns to the file structure;\n\n6) Task B also saw a NULL file private so it also allocates its own file\n private and then assigns it to the same file structure, since both\n tasks are using the same file descriptor.\n\n At this point we leak the private structure allocated by task A.\n\nBesides the memory leak, there's also the detail that both tasks end up\nusing the same cached state record in the private structure (struct\nbtrfs_file_private::llseek_cached_state), which can result in a\nuse-after-free problem since one task can free it while the other is\nstill using it (only one task took a reference count on it). Also, sharing\nthe cached state is not a good idea since it could result in incorrect\nresults in the future - right now it should not be a problem because it\nend ups being used only in extent-io-tree.c:count_range_bits() where we do\nrange validation before using the cached state.\n\nFix this by protecting the private assignment and check of a file while\nholding the inode's spinlock and keep track of the task that allocated\nthe private, so that it's used only by that task in order to prevent\nuser-after-free issues with the cached state record as well as potentially\nusing it incorrectly in the future.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47741" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4dc95988-9665-4a6c-a13b-172982f05528.json b/objects/vulnerability/vulnerability--4dc95988-9665-4a6c-a13b-172982f05528.json new file mode 100644 index 00000000000..aad08b680e5 --- /dev/null +++ b/objects/vulnerability/vulnerability--4dc95988-9665-4a6c-a13b-172982f05528.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--abdff7ef-3dfc-40d4-8a10-26c6e9ec0049", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4dc95988-9665-4a6c-a13b-172982f05528", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.943591Z", + "modified": "2024-10-22T00:37:10.943591Z", + "name": "CVE-2024-47693", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/core: Fix ib_cache_setup_one error flow cleanup\n\nWhen ib_cache_update return an error, we exit ib_cache_setup_one\ninstantly with no proper cleanup, even though before this we had\nalready successfully done gid_table_setup_one, that results in\nthe kernel WARN below.\n\nDo proper cleanup using gid_table_cleanup_one before returning\nthe err in order to fix the issue.\n\nWARNING: CPU: 4 PID: 922 at drivers/infiniband/core/cache.c:806 gid_table_release_one+0x181/0x1a0\nModules linked in:\nCPU: 4 UID: 0 PID: 922 Comm: c_repro Not tainted 6.11.0-rc1+ #3\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:gid_table_release_one+0x181/0x1a0\nCode: 44 8b 38 75 0c e8 2f cb 34 ff 4d 8b b5 28 05 00 00 e8 23 cb 34 ff 44 89 f9 89 da 4c 89 f6 48 c7 c7 d0 58 14 83 e8 4f de 21 ff <0f> 0b 4c 8b 75 30 e9 54 ff ff ff 48 8 3 c4 10 5b 5d 41 5c 41 5d 41\nRSP: 0018:ffffc90002b835b0 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c8527\nRDX: 0000000000000000 RSI: ffffffff811c8534 RDI: 0000000000000001\nRBP: ffff8881011b3d00 R08: ffff88810b3abe00 R09: 205d303839303631\nR10: 666572207972746e R11: 72746e6520444947 R12: 0000000000000001\nR13: ffff888106390000 R14: ffff8881011f2110 R15: 0000000000000001\nFS: 00007fecc3b70800(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000340 CR3: 000000010435a001 CR4: 00000000003706b0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n ? show_regs+0x94/0xa0\n ? __warn+0x9e/0x1c0\n ? gid_table_release_one+0x181/0x1a0\n ? report_bug+0x1f9/0x340\n ? gid_table_release_one+0x181/0x1a0\n ? handle_bug+0xa2/0x110\n ? exc_invalid_op+0x31/0xa0\n ? asm_exc_invalid_op+0x16/0x20\n ? __warn_printk+0xc7/0x180\n ? __warn_printk+0xd4/0x180\n ? gid_table_release_one+0x181/0x1a0\n ib_device_release+0x71/0xe0\n ? __pfx_ib_device_release+0x10/0x10\n device_release+0x44/0xd0\n kobject_put+0x135/0x3d0\n put_device+0x20/0x30\n rxe_net_add+0x7d/0xa0\n rxe_newlink+0xd7/0x190\n nldev_newlink+0x1b0/0x2a0\n ? __pfx_nldev_newlink+0x10/0x10\n rdma_nl_rcv_msg+0x1ad/0x2e0\n rdma_nl_rcv_skb.constprop.0+0x176/0x210\n netlink_unicast+0x2de/0x400\n netlink_sendmsg+0x306/0x660\n __sock_sendmsg+0x110/0x120\n ____sys_sendmsg+0x30e/0x390\n ___sys_sendmsg+0x9b/0xf0\n ? kstrtouint+0x6e/0xa0\n ? kstrtouint_from_user+0x7c/0xb0\n ? get_pid_task+0xb0/0xd0\n ? proc_fail_nth_write+0x5b/0x140\n ? __fget_light+0x9a/0x200\n ? preempt_count_add+0x47/0xa0\n __sys_sendmsg+0x61/0xd0\n do_syscall_64+0x50/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47693" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4ea93b60-a8ff-4c07-965c-aa3f89e41417.json b/objects/vulnerability/vulnerability--4ea93b60-a8ff-4c07-965c-aa3f89e41417.json new file mode 100644 index 00000000000..1fd9e984a8e --- /dev/null +++ b/objects/vulnerability/vulnerability--4ea93b60-a8ff-4c07-965c-aa3f89e41417.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--30b8dd40-d73e-4d78-9103-b47a4d9093d4", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4ea93b60-a8ff-4c07-965c-aa3f89e41417", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.973802Z", + "modified": "2024-10-22T00:37:10.973802Z", + "name": "CVE-2024-50012", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: Avoid a bad reference count on CPU node\n\nIn the parse_perf_domain function, if the call to\nof_parse_phandle_with_args returns an error, then the reference to the\nCPU device node that was acquired at the start of the function would not\nbe properly decremented.\n\nAddress this by declaring the variable with the __free(device_node)\ncleanup attribute.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50012" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4edd9d32-e32b-407e-a329-1e3151cb63d8.json b/objects/vulnerability/vulnerability--4edd9d32-e32b-407e-a329-1e3151cb63d8.json new file mode 100644 index 00000000000..9fef71532e0 --- /dev/null +++ b/objects/vulnerability/vulnerability--4edd9d32-e32b-407e-a329-1e3151cb63d8.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--dc8a51fc-4a7e-4c99-90b6-c09c189bc4df", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4edd9d32-e32b-407e-a329-1e3151cb63d8", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.955403Z", + "modified": "2024-10-22T00:37:17.955403Z", + "name": "CVE-2022-49018", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix sleep in atomic at close time\n\nMatt reported a splat at msk close time:\n\n BUG: sleeping function called from invalid context at net/mptcp/protocol.c:2877\n in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 155, name: packetdrill\n preempt_count: 201, expected: 0\n RCU nest depth: 0, expected: 0\n 4 locks held by packetdrill/155:\n #0: ffff888001536990 (&sb->s_type->i_mutex_key#6){+.+.}-{3:3}, at: __sock_release (net/socket.c:650)\n #1: ffff88800b498130 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close (net/mptcp/protocol.c:2973)\n #2: ffff88800b49a130 (sk_lock-AF_INET/1){+.+.}-{0:0}, at: __mptcp_close_ssk (net/mptcp/protocol.c:2363)\n #3: ffff88800b49a0b0 (slock-AF_INET){+...}-{2:2}, at: __lock_sock_fast (include/net/sock.h:1820)\n Preemption disabled at:\n 0x0\n CPU: 1 PID: 155 Comm: packetdrill Not tainted 6.1.0-rc5 #365\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n Call Trace:\n \n dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))\n __might_resched.cold (kernel/sched/core.c:9891)\n __mptcp_destroy_sock (include/linux/kernel.h:110)\n __mptcp_close (net/mptcp/protocol.c:2959)\n mptcp_subflow_queue_clean (include/net/sock.h:1777)\n __mptcp_close_ssk (net/mptcp/protocol.c:2363)\n mptcp_destroy_common (net/mptcp/protocol.c:3170)\n mptcp_destroy (include/net/sock.h:1495)\n __mptcp_destroy_sock (net/mptcp/protocol.c:2886)\n __mptcp_close (net/mptcp/protocol.c:2959)\n mptcp_close (net/mptcp/protocol.c:2974)\n inet_release (net/ipv4/af_inet.c:432)\n __sock_release (net/socket.c:651)\n sock_close (net/socket.c:1367)\n __fput (fs/file_table.c:320)\n task_work_run (kernel/task_work.c:181 (discriminator 1))\n exit_to_user_mode_prepare (include/linux/resume_user_mode.h:49)\n syscall_exit_to_user_mode (kernel/entry/common.c:130)\n do_syscall_64 (arch/x86/entry/common.c:87)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)\n\nWe can't call mptcp_close under the 'fast' socket lock variant, replace\nit with a sock_lock_nested() as the relevant code is already under the\nlistening msk socket lock protection.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49018" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4efcb7c9-c49a-46d1-a995-fd1b72a04142.json b/objects/vulnerability/vulnerability--4efcb7c9-c49a-46d1-a995-fd1b72a04142.json new file mode 100644 index 00000000000..99c084cd073 --- /dev/null +++ b/objects/vulnerability/vulnerability--4efcb7c9-c49a-46d1-a995-fd1b72a04142.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e7a6f719-1ab3-46d7-936b-f2113a90a6b0", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4efcb7c9-c49a-46d1-a995-fd1b72a04142", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.161665Z", + "modified": "2024-10-22T00:37:12.161665Z", + "name": "CVE-2024-49915", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn32_init_hw` function. The issue could occur when `dc->clk_mgr` is\nnull.\n\nThe fix adds a check to ensure `dc->clk_mgr` is not null before\naccessing its functions. This prevents a potential null pointer\ndereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 782)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49915" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--4f30fffa-db00-4134-815e-4af70e90d27a.json b/objects/vulnerability/vulnerability--4f30fffa-db00-4134-815e-4af70e90d27a.json new file mode 100644 index 00000000000..ae89f93faab --- /dev/null +++ b/objects/vulnerability/vulnerability--4f30fffa-db00-4134-815e-4af70e90d27a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--299b8d85-8f93-4628-aa9b-bed157cb3e04", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--4f30fffa-db00-4134-815e-4af70e90d27a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.088686Z", + "modified": "2024-10-22T00:37:12.088686Z", + "name": "CVE-2024-49900", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uninit-value access of new_ea in ea_buffer\n\nsyzbot reports that lzo1x_1_do_compress is using uninit-value:\n\n=====================================================\nBUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178\n\n...\n\nUninit was stored to memory at:\n ea_put fs/jfs/xattr.c:639 [inline]\n\n...\n\nLocal variable ea_buf created at:\n __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662\n __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934\n\n=====================================================\n\nThe reason is ea_buf->new_ea is not initialized properly.\n\nFix this by using memset to empty its content at the beginning\nin ea_get().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49900" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--508a18f6-3068-4969-94b6-579c5885837c.json b/objects/vulnerability/vulnerability--508a18f6-3068-4969-94b6-579c5885837c.json new file mode 100644 index 00000000000..12c0e283323 --- /dev/null +++ b/objects/vulnerability/vulnerability--508a18f6-3068-4969-94b6-579c5885837c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2cfbca55-5b8f-420e-8067-9d8d54ec3e15", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--508a18f6-3068-4969-94b6-579c5885837c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.827969Z", + "modified": "2024-10-22T00:37:10.827969Z", + "name": "CVE-2024-47738", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't use rate mask for offchannel TX either\n\nLike the commit ab9177d83c04 (\"wifi: mac80211: don't use rate mask for\nscanning\"), ignore incorrect settings to avoid no supported rate warning\nreported by syzbot.\n\nThe syzbot did bisect and found cause is commit 9df66d5b9f45 (\"cfg80211:\nfix default HE tx bitrate mask in 2G band\"), which however corrects\nbitmask of HE MCS and recognizes correctly settings of empty legacy rate\nplus HE MCS rate instead of returning -EINVAL.\n\nAs suggestions [1], follow the change of SCAN TX to consider this case of\noffchannel TX as well.\n\n[1] https://lore.kernel.org/linux-wireless/6ab2dc9c3afe753ca6fdcdd1421e7a1f47e87b84.camel@sipsolutions.net/T/#m2ac2a6d2be06a37c9c47a3d8a44b4f647ed4f024", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47738" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5181d5ae-9b3f-4c19-a3ab-00a63b1d67b4.json b/objects/vulnerability/vulnerability--5181d5ae-9b3f-4c19-a3ab-00a63b1d67b4.json new file mode 100644 index 00000000000..8b84ef1e0ca --- /dev/null +++ b/objects/vulnerability/vulnerability--5181d5ae-9b3f-4c19-a3ab-00a63b1d67b4.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--921bc961-da3e-44d9-bcb1-9cd47fdfcb24", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5181d5ae-9b3f-4c19-a3ab-00a63b1d67b4", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.939073Z", + "modified": "2024-10-22T00:37:10.939073Z", + "name": "CVE-2024-47687", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa/mlx5: Fix invalid mr resource destroy\n\nCertain error paths from mlx5_vdpa_dev_add() can end up releasing mr\nresources which never got initialized in the first place.\n\nThis patch adds the missing check in mlx5_vdpa_destroy_mr_resources()\nto block releasing non-initialized mr resources.\n\nReference trace:\n\n mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) warning: No mac address provisioned?\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 140216067 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 8 PID: 2700 Comm: vdpa Kdump: loaded Not tainted 5.14.0-496.el9.x86_64 #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\n Code: [...]\n RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246\n RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000\n RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670\n R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000\n R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea\n FS: 00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 0000000104d90001 CR4: 0000000000771ef0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n\n ? show_trace_log_lvl+0x1c4/0x2df\n ? show_trace_log_lvl+0x1c4/0x2df\n ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\n ? __die_body.cold+0x8/0xd\n ? page_fault_oops+0x134/0x170\n ? __irq_work_queue_local+0x2b/0xc0\n ? irq_work_queue+0x2c/0x50\n ? exc_page_fault+0x62/0x150\n ? asm_exc_page_fault+0x22/0x30\n ? __pfx_mlx5_vdpa_free+0x10/0x10 [mlx5_vdpa]\n ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb]\n mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa]\n vdpa_release_dev+0x1e/0x50 [vdpa]\n device_release+0x31/0x90\n kobject_cleanup+0x37/0x130\n mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa]\n vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa]\n genl_family_rcv_msg_doit+0xd9/0x130\n genl_family_rcv_msg+0x14d/0x220\n ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa]\n ? _copy_to_user+0x1a/0x30\n ? move_addr_to_user+0x4b/0xe0\n genl_rcv_msg+0x47/0xa0\n ? __import_iovec+0x46/0x150\n ? __pfx_genl_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x54/0x100\n genl_rcv+0x24/0x40\n netlink_unicast+0x245/0x370\n netlink_sendmsg+0x206/0x440\n __sys_sendto+0x1dc/0x1f0\n ? do_read_fault+0x10c/0x1d0\n ? do_pte_missing+0x10d/0x190\n __x64_sys_sendto+0x20/0x30\n do_syscall_64+0x5c/0xf0\n ? __count_memcg_events+0x4f/0xb0\n ? mm_account_fault+0x6c/0x100\n ? handle_mm_fault+0x116/0x270\n ? do_user_addr_fault+0x1d6/0x6a0\n ? do_syscall_64+0x6b/0xf0\n ? clear_bhb_loop+0x25/0x80\n ? clear_bhb_loop+0x25/0x80\n ? clear_bhb_loop+0x25/0x80\n ? clear_bhb_loop+0x25/0x80\n ? clear_bhb_loop+0x25/0x80\n entry_SYSCALL_64_after_hwframe+0x78/0x80", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47687" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--51c42a4b-e101-46bf-9dc9-f69d7c2b2e53.json b/objects/vulnerability/vulnerability--51c42a4b-e101-46bf-9dc9-f69d7c2b2e53.json new file mode 100644 index 00000000000..bac78586491 --- /dev/null +++ b/objects/vulnerability/vulnerability--51c42a4b-e101-46bf-9dc9-f69d7c2b2e53.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8f78170a-eebf-4dae-a6a9-0c1e0256c165", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--51c42a4b-e101-46bf-9dc9-f69d7c2b2e53", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.483626Z", + "modified": "2024-10-22T00:37:12.483626Z", + "name": "CVE-2024-46239", + "description": "Multiple cross-site scripting vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /doctor/edit-profile.php and adminremark parameter in /admin/query-details.php.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-46239" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--523af5da-df3d-417a-98df-b36703056c9e.json b/objects/vulnerability/vulnerability--523af5da-df3d-417a-98df-b36703056c9e.json new file mode 100644 index 00000000000..ab46b4e3c1f --- /dev/null +++ b/objects/vulnerability/vulnerability--523af5da-df3d-417a-98df-b36703056c9e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--912075a0-2278-4cbb-87b5-c4ef1a974946", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--523af5da-df3d-417a-98df-b36703056c9e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.557781Z", + "modified": "2024-10-22T00:37:10.557781Z", + "name": "CVE-2024-48509", + "description": "Learning with Texts (LWT) 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. By exploiting this vulnerability, an attacker could gain unauthorized access to the database, retrieve sensitive information, modify or delete data, and execute arbitrary commands.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-48509" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5395460a-efbf-49b7-9411-a12d5aad47d9.json b/objects/vulnerability/vulnerability--5395460a-efbf-49b7-9411-a12d5aad47d9.json new file mode 100644 index 00000000000..91506bb15ea --- /dev/null +++ b/objects/vulnerability/vulnerability--5395460a-efbf-49b7-9411-a12d5aad47d9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--45d2e5c8-c11f-435c-8541-5f6e66afd05e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5395460a-efbf-49b7-9411-a12d5aad47d9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.07231Z", + "modified": "2024-10-22T00:37:12.07231Z", + "name": "CVE-2024-49978", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngso: fix udp gso fraglist segmentation after pull from frag_list\n\nDetect gso fraglist skbs with corrupted geometry (see below) and\npass these to skb_segment instead of skb_segment_list, as the first\ncan segment them correctly.\n\nValid SKB_GSO_FRAGLIST skbs\n- consist of two or more segments\n- the head_skb holds the protocol headers plus first gso_size\n- one or more frag_list skbs hold exactly one segment\n- all but the last must be gso_size\n\nOptional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can\nmodify these skbs, breaking these invariants.\n\nIn extreme cases they pull all data into skb linear. For UDP, this\ncauses a NULL ptr deref in __udpv4_gso_segment_list_csum at\nudp_hdr(seg->next)->dest.\n\nDetect invalid geometry due to pull, by checking head_skb size.\nDon't just drop, as this may blackhole a destination. Convert to be\nable to pass to regular skb_segment.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49978" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5398b2fc-4309-40c5-9e6d-3348541fc396.json b/objects/vulnerability/vulnerability--5398b2fc-4309-40c5-9e6d-3348541fc396.json new file mode 100644 index 00000000000..ff20d8ac3e2 --- /dev/null +++ b/objects/vulnerability/vulnerability--5398b2fc-4309-40c5-9e6d-3348541fc396.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4d1d635c-485e-4deb-8120-67ebf1f09867", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5398b2fc-4309-40c5-9e6d-3348541fc396", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.063561Z", + "modified": "2024-10-22T00:37:12.063561Z", + "name": "CVE-2024-49890", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: ensure the fw_info is not null before using it\n\nThis resolves the dereference null return value warning\nreported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49890" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--53d5f88f-2bac-4d31-8899-da777dec5b9a.json b/objects/vulnerability/vulnerability--53d5f88f-2bac-4d31-8899-da777dec5b9a.json new file mode 100644 index 00000000000..59bdeec3fef --- /dev/null +++ b/objects/vulnerability/vulnerability--53d5f88f-2bac-4d31-8899-da777dec5b9a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--cba5ec65-ed07-4171-a4a3-d5382c5515d3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--53d5f88f-2bac-4d31-8899-da777dec5b9a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.965454Z", + "modified": "2024-10-22T00:37:10.965454Z", + "name": "CVE-2024-50037", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/fbdev-dma: Only cleanup deferred I/O if necessary\n\nCommit 5a498d4d06d6 (\"drm/fbdev-dma: Only install deferred I/O if\nnecessary\") initializes deferred I/O only if it is used.\ndrm_fbdev_dma_fb_destroy() however calls fb_deferred_io_cleanup()\nunconditionally with struct fb_info.fbdefio == NULL. KASAN with the\nout-of-tree Apple silicon display driver posts following warning from\n__flush_work() of a random struct work_struct instead of the expected\nNULL pointer derefs.\n\n[ 22.053799] ------------[ cut here ]------------\n[ 22.054832] WARNING: CPU: 2 PID: 1 at kernel/workqueue.c:4177 __flush_work+0x4d8/0x580\n[ 22.056597] Modules linked in: uhid bnep uinput nls_ascii ip6_tables ip_tables i2c_dev loop fuse dm_multipath nfnetlink zram hid_magicmouse btrfs xor xor_neon brcmfmac_wcc raid6_pq hci_bcm4377 bluetooth brcmfmac hid_apple brcmutil nvmem_spmi_mfd simple_mfd_spmi dockchannel_hid cfg80211 joydev regmap_spmi nvme_apple ecdh_generic ecc macsmc_hid rfkill dwc3 appledrm snd_soc_macaudio macsmc_power nvme_core apple_isp phy_apple_atc apple_sart apple_rtkit_helper apple_dockchannel tps6598x macsmc_hwmon snd_soc_cs42l84 videobuf2_v4l2 spmi_apple_controller nvmem_apple_efuses videobuf2_dma_sg apple_z2 videobuf2_memops spi_nor panel_summit videobuf2_common asahi videodev pwm_apple apple_dcp snd_soc_apple_mca apple_admac spi_apple clk_apple_nco i2c_pasemi_platform snd_pcm_dmaengine mc i2c_pasemi_core mux_core ofpart adpdrm drm_dma_helper apple_dart apple_soc_cpufreq leds_pwm phram\n[ 22.073768] CPU: 2 UID: 0 PID: 1 Comm: systemd-shutdow Not tainted 6.11.2-asahi+ #asahi-dev\n[ 22.075612] Hardware name: Apple MacBook Pro (13-inch, M2, 2022) (DT)\n[ 22.077032] pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 22.078567] pc : __flush_work+0x4d8/0x580\n[ 22.079471] lr : __flush_work+0x54/0x580\n[ 22.080345] sp : ffffc000836ef820\n[ 22.081089] x29: ffffc000836ef880 x28: 0000000000000000 x27: ffff80002ddb7128\n[ 22.082678] x26: dfffc00000000000 x25: 1ffff000096f0c57 x24: ffffc00082d3e358\n[ 22.084263] x23: ffff80004b7862b8 x22: dfffc00000000000 x21: ffff80005aa1d470\n[ 22.085855] x20: ffff80004b786000 x19: ffff80004b7862a0 x18: 0000000000000000\n[ 22.087439] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000005\n[ 22.089030] x14: 1ffff800106ddf0a x13: 0000000000000000 x12: 0000000000000000\n[ 22.090618] x11: ffffb800106ddf0f x10: dfffc00000000000 x9 : 1ffff800106ddf0e\n[ 22.092206] x8 : 0000000000000000 x7 : aaaaaaaaaaaaaaaa x6 : 0000000000000001\n[ 22.093790] x5 : ffffc000836ef728 x4 : 0000000000000000 x3 : 0000000000000020\n[ 22.095368] x2 : 0000000000000008 x1 : 00000000000000aa x0 : 0000000000000000\n[ 22.096955] Call trace:\n[ 22.097505] __flush_work+0x4d8/0x580\n[ 22.098330] flush_delayed_work+0x80/0xb8\n[ 22.099231] fb_deferred_io_cleanup+0x3c/0x130\n[ 22.100217] drm_fbdev_dma_fb_destroy+0x6c/0xe0 [drm_dma_helper]\n[ 22.101559] unregister_framebuffer+0x210/0x2f0\n[ 22.102575] drm_fb_helper_unregister_info+0x48/0x60\n[ 22.103683] drm_fbdev_dma_client_unregister+0x4c/0x80 [drm_dma_helper]\n[ 22.105147] drm_client_dev_unregister+0x1cc/0x230\n[ 22.106217] drm_dev_unregister+0x58/0x570\n[ 22.107125] apple_drm_unbind+0x50/0x98 [appledrm]\n[ 22.108199] component_del+0x1f8/0x3a8\n[ 22.109042] dcp_platform_shutdown+0x24/0x38 [apple_dcp]\n[ 22.110357] platform_shutdown+0x70/0x90\n[ 22.111219] device_shutdown+0x368/0x4d8\n[ 22.112095] kernel_restart+0x6c/0x1d0\n[ 22.112946] __arm64_sys_reboot+0x1c8/0x328\n[ 22.113868] invoke_syscall+0x78/0x1a8\n[ 22.114703] do_el0_svc+0x124/0x1a0\n[ 22.115498] el0_svc+0x3c/0xe0\n[ 22.116181] el0t_64_sync_handler+0x70/0xc0\n[ 22.117110] el0t_64_sync+0x190/0x198\n[ 22.117931] ---[ end trace 0000000000000000 ]---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50037" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--549ac671-c542-47c0-abe6-d7a1e3d2eaef.json b/objects/vulnerability/vulnerability--549ac671-c542-47c0-abe6-d7a1e3d2eaef.json new file mode 100644 index 00000000000..6c2c32c448c --- /dev/null +++ b/objects/vulnerability/vulnerability--549ac671-c542-47c0-abe6-d7a1e3d2eaef.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--bb2112c1-6592-4509-8d7d-9c6a0ac286a5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--549ac671-c542-47c0-abe6-d7a1e3d2eaef", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.707019Z", + "modified": "2024-10-22T00:37:16.707019Z", + "name": "CVE-2022-48979", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix array index out of bound error in DCN32 DML\n\n[Why&How]\nLinkCapacitySupport array is indexed with the number of voltage states and\nnot the number of max DPPs. Fix the error by changing the array\ndeclaration to use the correct (larger) array size of total number of\nvoltage states.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48979" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--54b771cc-ebf1-45f9-878f-6f6bb369cf10.json b/objects/vulnerability/vulnerability--54b771cc-ebf1-45f9-878f-6f6bb369cf10.json new file mode 100644 index 00000000000..e84af38d207 --- /dev/null +++ b/objects/vulnerability/vulnerability--54b771cc-ebf1-45f9-878f-6f6bb369cf10.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b8c85eca-bdba-4be4-98c1-8249ca9513ad", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--54b771cc-ebf1-45f9-878f-6f6bb369cf10", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.5443Z", + "modified": "2024-10-22T00:37:10.5443Z", + "name": "CVE-2024-48930", + "description": "secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In `elliptic`-based version, `loadUncompressedPublicKey` has a check that the public key is on the curve. Prior to versions 5.0.1, 4.0.4, and 3.8.1, however, `loadCompressedPublicKey` is missing that check. That allows the attacker to use public keys on low-cardinality curves to extract enough information to fully restore the private key from as little as 11 ECDH sessions, and very cheaply on compute power. Other operations on public keys are also affected, including e.g. `publicKeyVerify()` incorrectly returning `true` on those invalid keys, and e.g. `publicKeyTweakMul()` also returning predictable outcomes allowing to restore the tweak. Versions 5.0.1, 4.0.4, and 3.8.1 contain a fix for the issue.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-48930" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--54d4a8d3-01e5-4b84-b5d0-7fd9f4bc6824.json b/objects/vulnerability/vulnerability--54d4a8d3-01e5-4b84-b5d0-7fd9f4bc6824.json new file mode 100644 index 00000000000..fcf00df6347 --- /dev/null +++ b/objects/vulnerability/vulnerability--54d4a8d3-01e5-4b84-b5d0-7fd9f4bc6824.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--752f88a2-9a61-4edc-8588-7e869667fc0a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--54d4a8d3-01e5-4b84-b5d0-7fd9f4bc6824", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.729649Z", + "modified": "2024-10-22T00:37:16.729649Z", + "name": "CVE-2022-48990", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix use-after-free during gpu recovery\n\n[Why]\n [ 754.862560] refcount_t: underflow; use-after-free.\n [ 754.862898] Call Trace:\n [ 754.862903] \n [ 754.862913] amdgpu_job_free_cb+0xc2/0xe1 [amdgpu]\n [ 754.863543] drm_sched_main.cold+0x34/0x39 [amd_sched]\n\n[How]\n The fw_fence may be not init, check whether dma_fence_init\n is performed before job free", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48990" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--558b25c6-df67-481a-ab1f-c22da919ed6b.json b/objects/vulnerability/vulnerability--558b25c6-df67-481a-ab1f-c22da919ed6b.json new file mode 100644 index 00000000000..c93f7a33b53 --- /dev/null +++ b/objects/vulnerability/vulnerability--558b25c6-df67-481a-ab1f-c22da919ed6b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--39414b5c-a745-45b0-98ac-dbae614f1e38", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--558b25c6-df67-481a-ab1f-c22da919ed6b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.882679Z", + "modified": "2024-10-22T00:37:10.882679Z", + "name": "CVE-2024-47747", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition\n\nIn the ether3_probe function, a timer is initialized with a callback\nfunction ether3_ledoff, bound to &prev(dev)->timer. Once the timer is\nstarted, there is a risk of a race condition if the module or device\nis removed, triggering the ether3_remove function to perform cleanup.\nThe sequence of operations that may lead to a UAF bug is as follows:\n\nCPU0 CPU1\n\n | ether3_ledoff\nether3_remove |\n free_netdev(dev); |\n put_devic |\n kfree(dev); |\n | ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);\n | // use dev\n\nFix it by ensuring that the timer is canceled before proceeding with\nthe cleanup in ether3_remove.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47747" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--55e0a38c-10c3-4b6c-91bb-782f74bd6cb2.json b/objects/vulnerability/vulnerability--55e0a38c-10c3-4b6c-91bb-782f74bd6cb2.json new file mode 100644 index 00000000000..7cf2614dd50 --- /dev/null +++ b/objects/vulnerability/vulnerability--55e0a38c-10c3-4b6c-91bb-782f74bd6cb2.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a729b358-6484-4e65-a098-c733d9ee34e6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--55e0a38c-10c3-4b6c-91bb-782f74bd6cb2", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.687982Z", + "modified": "2024-10-22T00:37:16.687982Z", + "name": "CVE-2022-48952", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: mt7621: Add sentinel to quirks table\n\nCurrent driver is missing a sentinel in the struct soc_device_attribute\narray, which causes an oops when assessed by the\nsoc_device_match(mt7621_pcie_quirks_match) call.\n\nThis was only exposed once the CONFIG_SOC_MT7621 mt7621 soc_dev_attr\nwas fixed to register the SOC as a device, in:\n\ncommit 7c18b64bba3b (\"mips: ralink: mt7621: do not use kzalloc too early\")\n\nFix it by adding the required sentinel.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48952" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--55f9ad4b-95b4-4129-991c-5c6219d39344.json b/objects/vulnerability/vulnerability--55f9ad4b-95b4-4129-991c-5c6219d39344.json new file mode 100644 index 00000000000..9dd46421bbb --- /dev/null +++ b/objects/vulnerability/vulnerability--55f9ad4b-95b4-4129-991c-5c6219d39344.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--acddd4f1-ac5f-4ee0-98d1-77f8dbb3e247", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--55f9ad4b-95b4-4129-991c-5c6219d39344", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.895918Z", + "modified": "2024-10-22T00:37:10.895918Z", + "name": "CVE-2024-47744", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock\n\nUse a dedicated mutex to guard kvm_usage_count to fix a potential deadlock\non x86 due to a chain of locks and SRCU synchronizations. Translating the\nbelow lockdep splat, CPU1 #6 will wait on CPU0 #1, CPU0 #8 will wait on\nCPU2 #3, and CPU2 #7 will wait on CPU1 #4 (if there's a writer, due to the\nfairness of r/w semaphores).\n\n CPU0 CPU1 CPU2\n1 lock(&kvm->slots_lock);\n2 lock(&vcpu->mutex);\n3 lock(&kvm->srcu);\n4 lock(cpu_hotplug_lock);\n5 lock(kvm_lock);\n6 lock(&kvm->slots_lock);\n7 lock(cpu_hotplug_lock);\n8 sync(&kvm->srcu);\n\nNote, there are likely more potential deadlocks in KVM x86, e.g. the same\npattern of taking cpu_hotplug_lock outside of kvm_lock likely exists with\n__kvmclock_cpufreq_notifier():\n\n cpuhp_cpufreq_online()\n |\n -> cpufreq_online()\n |\n -> cpufreq_gov_performance_limits()\n |\n -> __cpufreq_driver_target()\n |\n -> __target_index()\n |\n -> cpufreq_freq_transition_begin()\n |\n -> cpufreq_notify_transition()\n |\n -> ... __kvmclock_cpufreq_notifier()\n\nBut, actually triggering such deadlocks is beyond rare due to the\ncombination of dependencies and timings involved. E.g. the cpufreq\nnotifier is only used on older CPUs without a constant TSC, mucking with\nthe NX hugepage mitigation while VMs are running is very uncommon, and\ndoing so while also onlining/offlining a CPU (necessary to generate\ncontention on cpu_hotplug_lock) would be even more unusual.\n\nThe most robust solution to the general cpu_hotplug_lock issue is likely\nto switch vm_list to be an RCU-protected list, e.g. so that x86's cpufreq\nnotifier doesn't to take kvm_lock. For now, settle for fixing the most\nblatant deadlock, as switching to an RCU-protected list is a much more\ninvolved change, but add a comment in locking.rst to call out that care\nneeds to be taken when walking holding kvm_lock and walking vm_list.\n\n ======================================================\n WARNING: possible circular locking dependency detected\n 6.10.0-smp--c257535a0c9d-pip #330 Tainted: G S O\n ------------------------------------------------------\n tee/35048 is trying to acquire lock:\n ff6a80eced71e0a8 (&kvm->slots_lock){+.+.}-{3:3}, at: set_nx_huge_pages+0x179/0x1e0 [kvm]\n\n but task is already holding lock:\n ffffffffc07abb08 (kvm_lock){+.+.}-{3:3}, at: set_nx_huge_pages+0x14a/0x1e0 [kvm]\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -> #3 (kvm_lock){+.+.}-{3:3}:\n __mutex_lock+0x6a/0xb40\n mutex_lock_nested+0x1f/0x30\n kvm_dev_ioctl+0x4fb/0xe50 [kvm]\n __se_sys_ioctl+0x7b/0xd0\n __x64_sys_ioctl+0x21/0x30\n x64_sys_call+0x15d0/0x2e60\n do_syscall_64+0x83/0x160\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n -> #2 (cpu_hotplug_lock){++++}-{0:0}:\n cpus_read_lock+0x2e/0xb0\n static_key_slow_inc+0x16/0x30\n kvm_lapic_set_base+0x6a/0x1c0 [kvm]\n kvm_set_apic_base+0x8f/0xe0 [kvm]\n kvm_set_msr_common+0x9ae/0xf80 [kvm]\n vmx_set_msr+0xa54/0xbe0 [kvm_intel]\n __kvm_set_msr+0xb6/0x1a0 [kvm]\n kvm_arch_vcpu_ioctl+0xeca/0x10c0 [kvm]\n kvm_vcpu_ioctl+0x485/0x5b0 [kvm]\n __se_sys_ioctl+0x7b/0xd0\n __x64_sys_ioctl+0x21/0x30\n x64_sys_call+0x15d0/0x2e60\n do_syscall_64+0x83/0x160\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n -> #1 (&kvm->srcu){.+.+}-{0:0}:\n __synchronize_srcu+0x44/0x1a0\n \n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47744" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5611c669-9f95-4406-9ad4-18c43a5b15ba.json b/objects/vulnerability/vulnerability--5611c669-9f95-4406-9ad4-18c43a5b15ba.json new file mode 100644 index 00000000000..de03c0090d0 --- /dev/null +++ b/objects/vulnerability/vulnerability--5611c669-9f95-4406-9ad4-18c43a5b15ba.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3fc99276-bca8-445e-8e55-ce0bcb68a28e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5611c669-9f95-4406-9ad4-18c43a5b15ba", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.690842Z", + "modified": "2024-10-22T00:37:16.690842Z", + "name": "CVE-2022-48983", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: Fix a null-ptr-deref in io_tctx_exit_cb()\n\nSyzkaller reports a NULL deref bug as follows:\n\n BUG: KASAN: null-ptr-deref in io_tctx_exit_cb+0x53/0xd3\n Read of size 4 at addr 0000000000000138 by task file1/1955\n\n CPU: 1 PID: 1955 Comm: file1 Not tainted 6.1.0-rc7-00103-gef4d3ea40565 #75\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\n Call Trace:\n \n dump_stack_lvl+0xcd/0x134\n ? io_tctx_exit_cb+0x53/0xd3\n kasan_report+0xbb/0x1f0\n ? io_tctx_exit_cb+0x53/0xd3\n kasan_check_range+0x140/0x190\n io_tctx_exit_cb+0x53/0xd3\n task_work_run+0x164/0x250\n ? task_work_cancel+0x30/0x30\n get_signal+0x1c3/0x2440\n ? lock_downgrade+0x6e0/0x6e0\n ? lock_downgrade+0x6e0/0x6e0\n ? exit_signals+0x8b0/0x8b0\n ? do_raw_read_unlock+0x3b/0x70\n ? do_raw_spin_unlock+0x50/0x230\n arch_do_signal_or_restart+0x82/0x2470\n ? kmem_cache_free+0x260/0x4b0\n ? putname+0xfe/0x140\n ? get_sigframe_size+0x10/0x10\n ? do_execveat_common.isra.0+0x226/0x710\n ? lockdep_hardirqs_on+0x79/0x100\n ? putname+0xfe/0x140\n ? do_execveat_common.isra.0+0x238/0x710\n exit_to_user_mode_prepare+0x15f/0x250\n syscall_exit_to_user_mode+0x19/0x50\n do_syscall_64+0x42/0xb0\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n RIP: 0023:0x0\n Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIG_RAX: 000000000000000b\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n \n Kernel panic - not syncing: panic_on_warn set ...\n\nThis happens because the adding of task_work from io_ring_exit_work()\nisn't synchronized with canceling all work items from eg exec. The\nexecution of the two are ordered in that they are both run by the task\nitself, but if io_tctx_exit_cb() is queued while we're canceling all\nwork items off exec AND gets executed when the task exits to userspace\nrather than in the main loop in io_uring_cancel_generic(), then we can\nfind current->io_uring == NULL and hit the above crash.\n\nIt's safe to add this NULL check here, because the execution of the two\npaths are done by the task itself.\n\n[axboe: add code comment and also put an explanation in the commit msg]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48983" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--56e35438-1832-4c72-933e-01d0f66a8c0b.json b/objects/vulnerability/vulnerability--56e35438-1832-4c72-933e-01d0f66a8c0b.json new file mode 100644 index 00000000000..2d6fd651c43 --- /dev/null +++ b/objects/vulnerability/vulnerability--56e35438-1832-4c72-933e-01d0f66a8c0b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--25823ce3-cb27-48da-bad8-5fb4845cc576", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--56e35438-1832-4c72-933e-01d0f66a8c0b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.92785Z", + "modified": "2024-10-22T00:37:17.92785Z", + "name": "CVE-2022-49001", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fix race when vmap stack overflow\n\nCurrently, when detecting vmap stack overflow, riscv firstly switches\nto the so called shadow stack, then use this shadow stack to call the\nget_overflow_stack() to get the overflow stack. However, there's\na race here if two or more harts use the same shadow stack at the same\ntime.\n\nTo solve this race, we introduce spin_shadow_stack atomic var, which\nwill be swap between its own address and 0 in atomic way, when the\nvar is set, it means the shadow_stack is being used; when the var\nis cleared, it means the shadow_stack isn't being used.\n\n[Palmer: Add AQ to the swap, and also some comments.]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49001" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--57ec1619-655a-4c8f-b6bb-bee32b106af2.json b/objects/vulnerability/vulnerability--57ec1619-655a-4c8f-b6bb-bee32b106af2.json new file mode 100644 index 00000000000..1c9b889ee5e --- /dev/null +++ b/objects/vulnerability/vulnerability--57ec1619-655a-4c8f-b6bb-bee32b106af2.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4b39ab0f-ce1b-430b-bd35-256b38f0d976", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--57ec1619-655a-4c8f-b6bb-bee32b106af2", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.013803Z", + "modified": "2024-10-22T00:37:12.013803Z", + "name": "CVE-2024-49904", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add list empty check to avoid null pointer issue\n\nAdd list empty check to avoid null pointer issues in some corner cases.\n- list_for_each_entry_safe()", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49904" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--580d789e-eda1-48d2-8ea9-5aa7dc33d388.json b/objects/vulnerability/vulnerability--580d789e-eda1-48d2-8ea9-5aa7dc33d388.json new file mode 100644 index 00000000000..58956d0067d --- /dev/null +++ b/objects/vulnerability/vulnerability--580d789e-eda1-48d2-8ea9-5aa7dc33d388.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a26ecf88-c2e4-4198-90ec-a0e29478322d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--580d789e-eda1-48d2-8ea9-5aa7dc33d388", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.133695Z", + "modified": "2024-10-22T00:37:12.133695Z", + "name": "CVE-2024-49866", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/timerlat: Fix a race during cpuhp processing\n\nThere is another found exception that the \"timerlat/1\" thread was\nscheduled on CPU0, and lead to timer corruption finally:\n\n```\nODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220\nWARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0\nModules linked in:\nCPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:debug_print_object+0x7d/0xb0\n...\nCall Trace:\n \n ? __warn+0x7c/0x110\n ? debug_print_object+0x7d/0xb0\n ? report_bug+0xf1/0x1d0\n ? prb_read_valid+0x17/0x20\n ? handle_bug+0x3f/0x70\n ? exc_invalid_op+0x13/0x60\n ? asm_exc_invalid_op+0x16/0x20\n ? debug_print_object+0x7d/0xb0\n ? debug_print_object+0x7d/0xb0\n ? __pfx_timerlat_irq+0x10/0x10\n __debug_object_init+0x110/0x150\n hrtimer_init+0x1d/0x60\n timerlat_main+0xab/0x2d0\n ? __pfx_timerlat_main+0x10/0x10\n kthread+0xb7/0xe0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2d/0x40\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n```\n\nAfter tracing the scheduling event, it was discovered that the migration\nof the \"timerlat/1\" thread was performed during thread creation. Further\nanalysis confirmed that it is because the CPU online processing for\nosnoise is implemented through workers, which is asynchronous with the\noffline processing. When the worker was scheduled to create a thread, the\nCPU may has already been removed from the cpu_online_mask during the offline\nprocess, resulting in the inability to select the right CPU:\n\nT1 | T2\n[CPUHP_ONLINE] | cpu_device_down()\nosnoise_hotplug_workfn() |\n | cpus_write_lock()\n | takedown_cpu(1)\n | cpus_write_unlock()\n[CPUHP_OFFLINE] |\n cpus_read_lock() |\n start_kthread(1) |\n cpus_read_unlock() |\n\nTo fix this, skip online processing if the CPU is already offline.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49866" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5854d566-c89f-4463-ad06-f572237f8c88.json b/objects/vulnerability/vulnerability--5854d566-c89f-4463-ad06-f572237f8c88.json new file mode 100644 index 00000000000..e4b336f37e8 --- /dev/null +++ b/objects/vulnerability/vulnerability--5854d566-c89f-4463-ad06-f572237f8c88.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--06b140a1-488d-4a56-9a52-7fe835e658c6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5854d566-c89f-4463-ad06-f572237f8c88", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.943969Z", + "modified": "2024-10-22T00:37:17.943969Z", + "name": "CVE-2022-49030", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibbpf: Handle size overflow for ringbuf mmap\n\nThe maximum size of ringbuf is 2GB on x86-64 host, so 2 * max_entries\nwill overflow u32 when mapping producer page and data pages. Only\ncasting max_entries to size_t is not enough, because for 32-bits\napplication on 64-bits kernel the size of read-only mmap region\nalso could overflow size_t.\n\nSo fixing it by casting the size of read-only mmap region into a __u64\nand checking whether or not there will be overflow during mmap.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49030" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--587462e3-d85a-4fa1-99e4-6dd007235c69.json b/objects/vulnerability/vulnerability--587462e3-d85a-4fa1-99e4-6dd007235c69.json new file mode 100644 index 00000000000..c5afbf0282b --- /dev/null +++ b/objects/vulnerability/vulnerability--587462e3-d85a-4fa1-99e4-6dd007235c69.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--34d91b50-aa81-4882-8582-8528fec74602", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--587462e3-d85a-4fa1-99e4-6dd007235c69", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.116656Z", + "modified": "2024-10-22T00:37:12.116656Z", + "name": "CVE-2024-49851", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Clean up TPM space after command failure\n\ntpm_dev_transmit prepares the TPM space before attempting command\ntransmission. However if the command fails no rollback of this\npreparation is done. This can result in transient handles being leaked\nif the device is subsequently closed with no further commands performed.\n\nFix this by flushing the space in the event of command transmission\nfailure.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49851" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--588a39cd-5294-4568-a7c6-f50a8b1e2350.json b/objects/vulnerability/vulnerability--588a39cd-5294-4568-a7c6-f50a8b1e2350.json new file mode 100644 index 00000000000..ca95be21512 --- /dev/null +++ b/objects/vulnerability/vulnerability--588a39cd-5294-4568-a7c6-f50a8b1e2350.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4c8f8a56-bace-4bd2-8f4d-febe6564adcb", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--588a39cd-5294-4568-a7c6-f50a8b1e2350", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.864892Z", + "modified": "2024-10-22T00:37:10.864892Z", + "name": "CVE-2024-47740", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: Require FMODE_WRITE for atomic write ioctls\n\nThe F2FS ioctls for starting and committing atomic writes check for\ninode_owner_or_capable(), but this does not give LSMs like SELinux or\nLandlock an opportunity to deny the write access - if the caller's FSUID\nmatches the inode's UID, inode_owner_or_capable() immediately returns true.\n\nThere are scenarios where LSMs want to deny a process the ability to write\nparticular files, even files that the FSUID of the process owns; but this\ncan currently partially be bypassed using atomic write ioctls in two ways:\n\n - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can\n truncate an inode to size 0\n - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert\n changes another process concurrently made to a file\n\nFix it by requiring FMODE_WRITE for these operations, just like for\nF2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these\nioctls when intending to write into the file, that seems unlikely to break\nanything.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47740" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5893961f-8d27-47e2-878d-c607014b9694.json b/objects/vulnerability/vulnerability--5893961f-8d27-47e2-878d-c607014b9694.json new file mode 100644 index 00000000000..4f26806d9fa --- /dev/null +++ b/objects/vulnerability/vulnerability--5893961f-8d27-47e2-878d-c607014b9694.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--eeb95b0b-2fb9-4feb-a46a-4fbe008673cc", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5893961f-8d27-47e2-878d-c607014b9694", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.697108Z", + "modified": "2024-10-22T00:37:10.697108Z", + "name": "CVE-2024-10199", + "description": "A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /manage_medicine.php of the component Manage Medicines Page. The manipulation of the argument name/address/doctor_address/suppliers_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting files to be affected.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-10199" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--594cbc1c-3b44-401b-907f-858ed6f25336.json b/objects/vulnerability/vulnerability--594cbc1c-3b44-401b-907f-858ed6f25336.json new file mode 100644 index 00000000000..dd870a8dcef --- /dev/null +++ b/objects/vulnerability/vulnerability--594cbc1c-3b44-401b-907f-858ed6f25336.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--710cec68-4faf-4719-aff9-fb3bdfc491b6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--594cbc1c-3b44-401b-907f-858ed6f25336", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.024178Z", + "modified": "2024-10-22T00:37:12.024178Z", + "name": "CVE-2024-49911", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the dcn20_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for null at line 1030, but then it\nwas being dereferenced without any null check at line 1048. This could\npotentially lead to a null pointer dereference error if set_output_gamma\nis null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a null check for set_output_gamma\nbefore the call to set_output_gamma at line 1048.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49911" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--59bbc091-8e78-4125-8bf6-bb87d663cef1.json b/objects/vulnerability/vulnerability--59bbc091-8e78-4125-8bf6-bb87d663cef1.json new file mode 100644 index 00000000000..207cea1b61f --- /dev/null +++ b/objects/vulnerability/vulnerability--59bbc091-8e78-4125-8bf6-bb87d663cef1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--cb6b1bf8-21cd-4c9d-a405-50e9df19cab5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--59bbc091-8e78-4125-8bf6-bb87d663cef1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.147559Z", + "modified": "2024-10-22T00:37:12.147559Z", + "name": "CVE-2024-49963", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: bcm2835: Fix timeout during suspend mode\n\nDuring noirq suspend phase the Raspberry Pi power driver suffer of\nfirmware property timeouts. The reason is that the IRQ of the underlying\nBCM2835 mailbox is disabled and rpi_firmware_property_list() will always\nrun into a timeout [1].\n\nSince the VideoCore side isn't consider as a wakeup source, set the\nIRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled\nduring suspend-resume cycle.\n\n[1]\nPM: late suspend of devices complete after 1.754 msecs\nWARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128\n rpi_firmware_property_list+0x204/0x22c\nFirmware transaction 0x00028001 timeout\nModules linked in:\nCPU: 0 PID: 438 Comm: bash Tainted: G C 6.9.3-dirty #17\nHardware name: BCM2835\nCall trace:\nunwind_backtrace from show_stack+0x18/0x1c\nshow_stack from dump_stack_lvl+0x34/0x44\ndump_stack_lvl from __warn+0x88/0xec\n__warn from warn_slowpath_fmt+0x7c/0xb0\nwarn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c\nrpi_firmware_property_list from rpi_firmware_property+0x68/0x8c\nrpi_firmware_property from rpi_firmware_set_power+0x54/0xc0\nrpi_firmware_set_power from _genpd_power_off+0xe4/0x148\n_genpd_power_off from genpd_sync_power_off+0x7c/0x11c\ngenpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0\ngenpd_finish_suspend from dpm_run_callback+0x78/0xd0\ndpm_run_callback from device_suspend_noirq+0xc0/0x238\ndevice_suspend_noirq from dpm_suspend_noirq+0xb0/0x168\ndpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac\nsuspend_devices_and_enter from pm_suspend+0x254/0x2e4\npm_suspend from state_store+0xa8/0xd4\nstate_store from kernfs_fop_write_iter+0x154/0x1a0\nkernfs_fop_write_iter from vfs_write+0x12c/0x184\nvfs_write from ksys_write+0x78/0xc0\nksys_write from ret_fast_syscall+0x0/0x54\nException stack(0xcc93dfa8 to 0xcc93dff0)\n[...]\nPM: noirq suspend of devices complete after 3095.584 msecs", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49963" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--59d8ff85-06a4-4c59-9d20-28018a5a68b4.json b/objects/vulnerability/vulnerability--59d8ff85-06a4-4c59-9d20-28018a5a68b4.json new file mode 100644 index 00000000000..7e5e3a1f51f --- /dev/null +++ b/objects/vulnerability/vulnerability--59d8ff85-06a4-4c59-9d20-28018a5a68b4.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9b1629f8-ef03-480b-8f90-8046f8cb9a7e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--59d8ff85-06a4-4c59-9d20-28018a5a68b4", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.708956Z", + "modified": "2024-10-22T00:37:10.708956Z", + "name": "CVE-2024-10202", + "description": "Administrative Management System from Wellchoose has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-10202" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5a96ee3c-8296-47b3-b863-520279907078.json b/objects/vulnerability/vulnerability--5a96ee3c-8296-47b3-b863-520279907078.json new file mode 100644 index 00000000000..d67fb25ec09 --- /dev/null +++ b/objects/vulnerability/vulnerability--5a96ee3c-8296-47b3-b863-520279907078.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--96e58c22-4412-4c29-8170-0d781a0b142a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5a96ee3c-8296-47b3-b863-520279907078", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.160136Z", + "modified": "2024-10-22T00:37:12.160136Z", + "name": "CVE-2024-49965", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: remove unreasonable unlock in ocfs2_read_blocks\n\nPatch series \"Misc fixes for ocfs2_read_blocks\", v5.\n\nThis series contains 2 fixes for ocfs2_read_blocks(). The first patch fix\nthe issue reported by syzbot, which detects bad unlock balance in\nocfs2_read_blocks(). The second patch fixes an issue reported by Heming\nZhao when reviewing above fix.\n\n\nThis patch (of 2):\n\nThere was a lock release before exiting, so remove the unreasonable unlock.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49965" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5a9ea1ad-57d0-4f8b-a737-a963c8c5c23c.json b/objects/vulnerability/vulnerability--5a9ea1ad-57d0-4f8b-a737-a963c8c5c23c.json new file mode 100644 index 00000000000..b5c13400e95 --- /dev/null +++ b/objects/vulnerability/vulnerability--5a9ea1ad-57d0-4f8b-a737-a963c8c5c23c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d9f76c0d-3c5e-4687-9697-dc20b7792712", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5a9ea1ad-57d0-4f8b-a737-a963c8c5c23c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.867635Z", + "modified": "2024-10-22T00:37:10.867635Z", + "name": "CVE-2024-47677", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: resolve memory leak from exfat_create_upcase_table()\n\nIf exfat_load_upcase_table reaches end and returns -EINVAL,\nallocated memory doesn't get freed and while\nexfat_load_default_upcase_table allocates more memory, leading to a\nmemory leak.\n\nHere's link to syzkaller crash report illustrating this issue:\nhttps://syzkaller.appspot.com/text?tag=CrashReport&x=1406c201980000", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47677" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5c2ed68e-499c-47cc-bf2f-7b5f144a0d5f.json b/objects/vulnerability/vulnerability--5c2ed68e-499c-47cc-bf2f-7b5f144a0d5f.json new file mode 100644 index 00000000000..b2e3985c4b5 --- /dev/null +++ b/objects/vulnerability/vulnerability--5c2ed68e-499c-47cc-bf2f-7b5f144a0d5f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--03b0ddf9-ed52-4143-a227-e63d22863d2d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5c2ed68e-499c-47cc-bf2f-7b5f144a0d5f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.003876Z", + "modified": "2024-10-22T00:37:11.003876Z", + "name": "CVE-2024-50011", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: soc-acpi-intel-rpl-match: add missing empty item\n\nThere is no links_num in struct snd_soc_acpi_mach {}, and we test\n!link->num_adr as a condition to end the loop in hda_sdw_machine_select().\nSo an empty item in struct snd_soc_acpi_link_adr array is required.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50011" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5cfc7a14-efe2-443e-ba0a-d792653d4803.json b/objects/vulnerability/vulnerability--5cfc7a14-efe2-443e-ba0a-d792653d4803.json new file mode 100644 index 00000000000..7d125bbcba3 --- /dev/null +++ b/objects/vulnerability/vulnerability--5cfc7a14-efe2-443e-ba0a-d792653d4803.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--841d32da-e894-4d4f-9140-cbc435c7b0a5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5cfc7a14-efe2-443e-ba0a-d792653d4803", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.499728Z", + "modified": "2024-10-22T00:37:12.499728Z", + "name": "CVE-2024-46236", + "description": "CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the address parameter in add_members.php and edit_member.php.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-46236" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5d0b7691-408d-4de8-bbbb-b441141f501b.json b/objects/vulnerability/vulnerability--5d0b7691-408d-4de8-bbbb-b441141f501b.json new file mode 100644 index 00000000000..ccfd1347d0d --- /dev/null +++ b/objects/vulnerability/vulnerability--5d0b7691-408d-4de8-bbbb-b441141f501b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c7a5a3e6-a167-4790-8476-e94cbc48d650", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5d0b7691-408d-4de8-bbbb-b441141f501b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.017659Z", + "modified": "2024-10-22T00:37:11.017659Z", + "name": "CVE-2024-50033", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nslip: make slhc_remember() more robust against malicious packets\n\nsyzbot found that slhc_remember() was missing checks against\nmalicious packets [1].\n\nslhc_remember() only checked the size of the packet was at least 20,\nwhich is not good enough.\n\nWe need to make sure the packet includes the IPv4 and TCP header\nthat are supposed to be carried.\n\nAdd iph and th pointers to make the code more readable.\n\n[1]\n\nBUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666\n slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666\n ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455\n ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline]\n ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212\n ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327\n pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379\n sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113\n __release_sock+0x1da/0x330 net/core/sock.c:3072\n release_sock+0x6b/0x250 net/core/sock.c:3626\n pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903\n sock_sendmsg_nosec net/socket.c:729 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:744\n ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n __do_sys_sendmmsg net/socket.c:2771 [inline]\n __se_sys_sendmmsg net/socket.c:2768 [inline]\n __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4091 [inline]\n slab_alloc_node mm/slub.c:4134 [inline]\n kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\n __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\n alloc_skb include/linux/skbuff.h:1322 [inline]\n sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732\n pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867\n sock_sendmsg_nosec net/socket.c:729 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:744\n ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n __do_sys_sendmmsg net/socket.c:2771 [inline]\n __se_sys_sendmmsg net/socket.c:2768 [inline]\n __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50033" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5d550c97-a218-4113-abe0-86e89394e8db.json b/objects/vulnerability/vulnerability--5d550c97-a218-4113-abe0-86e89394e8db.json new file mode 100644 index 00000000000..e8a41598ec8 --- /dev/null +++ b/objects/vulnerability/vulnerability--5d550c97-a218-4113-abe0-86e89394e8db.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5ed8d537-3b41-41ba-a5c5-ad9a82f9196b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5d550c97-a218-4113-abe0-86e89394e8db", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.941485Z", + "modified": "2024-10-22T00:37:17.941485Z", + "name": "CVE-2022-49015", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: Fix potential use-after-free\n\nThe skb is delivered to netif_rx() which may free it, after calling this,\ndereferencing skb may trigger use-after-free.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49015" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5df9c615-ad45-45a0-a3c9-a201d4703d33.json b/objects/vulnerability/vulnerability--5df9c615-ad45-45a0-a3c9-a201d4703d33.json new file mode 100644 index 00000000000..3f050d00e99 --- /dev/null +++ b/objects/vulnerability/vulnerability--5df9c615-ad45-45a0-a3c9-a201d4703d33.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c81bd23d-ab2b-4bf7-96c0-fed444a75489", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5df9c615-ad45-45a0-a3c9-a201d4703d33", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.122904Z", + "modified": "2024-10-22T00:37:12.122904Z", + "name": "CVE-2024-49930", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix array out-of-bound access in SoC stats\n\nCurrently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a\nmaximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx()\nfunction access ath11k_soc_dp_stats::hal_reo_error using the REO\ndestination SRNG ring ID, which is incorrect. SRNG ring ID differ from\nnormal ring ID, and this usage leads to out-of-bounds array access. To fix\nthis issue, modify ath11k_dp_process_rx() to use the normal ring ID\ndirectly instead of the SRNG ring ID to avoid out-of-bounds array access.\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49930" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5f112a7f-5945-42d4-9a76-681e05e9b32e.json b/objects/vulnerability/vulnerability--5f112a7f-5945-42d4-9a76-681e05e9b32e.json new file mode 100644 index 00000000000..0a0a2bd3090 --- /dev/null +++ b/objects/vulnerability/vulnerability--5f112a7f-5945-42d4-9a76-681e05e9b32e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8b8d3ae5-b71b-483e-8d49-04236107bdbc", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5f112a7f-5945-42d4-9a76-681e05e9b32e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.014485Z", + "modified": "2024-10-22T00:37:11.014485Z", + "name": "CVE-2024-50058", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: protect uart_port_dtr_rts() in uart_shutdown() too\n\nCommit af224ca2df29 (serial: core: Prevent unsafe uart port access, part\n3) added few uport == NULL checks. It added one to uart_shutdown(), so\nthe commit assumes, uport can be NULL in there. But right after that\nprotection, there is an unprotected \"uart_port_dtr_rts(uport, false);\"\ncall. That is invoked only if HUPCL is set, so I assume that is the\nreason why we do not see lots of these reports.\n\nOr it cannot be NULL at this point at all for some reason :P.\n\nUntil the above is investigated, stay on the safe side and move this\ndereference to the if too.\n\nI got this inconsistency from Coverity under CID 1585130. Thanks.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50058" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5f2c1d51-f101-4b71-a921-91291da883df.json b/objects/vulnerability/vulnerability--5f2c1d51-f101-4b71-a921-91291da883df.json new file mode 100644 index 00000000000..3e1786610b5 --- /dev/null +++ b/objects/vulnerability/vulnerability--5f2c1d51-f101-4b71-a921-91291da883df.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e955817d-696f-4fc7-9518-6321993e8195", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5f2c1d51-f101-4b71-a921-91291da883df", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.028702Z", + "modified": "2024-10-22T00:37:11.028702Z", + "name": "CVE-2024-50007", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: asihpi: Fix potential OOB array access\n\nASIHPI driver stores some values in the static array upon a response\nfrom the driver, and its index depends on the firmware. We shouldn't\ntrust it blindly.\n\nThis patch adds a sanity check of the array index to fit in the array\nsize.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50007" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5f6b45be-4c02-4d6b-9b09-b5ac6aa6e06d.json b/objects/vulnerability/vulnerability--5f6b45be-4c02-4d6b-9b09-b5ac6aa6e06d.json new file mode 100644 index 00000000000..f5e39afa080 --- /dev/null +++ b/objects/vulnerability/vulnerability--5f6b45be-4c02-4d6b-9b09-b5ac6aa6e06d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3595837a-b76c-417d-baa9-1db8dbdd6a1f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5f6b45be-4c02-4d6b-9b09-b5ac6aa6e06d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.150872Z", + "modified": "2024-10-22T00:37:12.150872Z", + "name": "CVE-2024-49945", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ncsi: Disable the ncsi work before freeing the associated structure\n\nThe work function can run after the ncsi device is freed, resulting\nin use-after-free bugs or kernel panic.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49945" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5f7d5803-78d8-4855-ac32-b3fb7be6f2ad.json b/objects/vulnerability/vulnerability--5f7d5803-78d8-4855-ac32-b3fb7be6f2ad.json new file mode 100644 index 00000000000..62cdea9c109 --- /dev/null +++ b/objects/vulnerability/vulnerability--5f7d5803-78d8-4855-ac32-b3fb7be6f2ad.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f2950ef4-ff7c-4bf4-b091-61cfed4b812e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5f7d5803-78d8-4855-ac32-b3fb7be6f2ad", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.086648Z", + "modified": "2024-10-22T00:37:12.086648Z", + "name": "CVE-2024-49321", + "description": "Missing Authorization vulnerability in Colorlib Simple Custom Post Order allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Custom Post Order: from n/a through 2.5.7.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49321" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--5ff9e4b0-8b6e-473a-9987-f594370de228.json b/objects/vulnerability/vulnerability--5ff9e4b0-8b6e-473a-9987-f594370de228.json new file mode 100644 index 00000000000..1bed0ab4010 --- /dev/null +++ b/objects/vulnerability/vulnerability--5ff9e4b0-8b6e-473a-9987-f594370de228.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4821e796-a89b-40ed-8886-e7a29c34ed81", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--5ff9e4b0-8b6e-473a-9987-f594370de228", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.934448Z", + "modified": "2024-10-22T00:37:17.934448Z", + "name": "CVE-2022-49024", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods\n\nIn m_can_pci_remove() and error handling path of m_can_pci_probe(),\nm_can_class_free_dev() should be called to free resource allocated by\nm_can_class_allocate_dev(), otherwise there will be memleak.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49024" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6006555e-913c-4d28-aedc-18406c09122c.json b/objects/vulnerability/vulnerability--6006555e-913c-4d28-aedc-18406c09122c.json new file mode 100644 index 00000000000..0fd640d1008 --- /dev/null +++ b/objects/vulnerability/vulnerability--6006555e-913c-4d28-aedc-18406c09122c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--752369cb-ed3f-46e4-8c71-b2f60f06f0ce", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6006555e-913c-4d28-aedc-18406c09122c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.029063Z", + "modified": "2024-10-22T00:37:12.029063Z", + "name": "CVE-2024-49903", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uaf in dbFreeBits\n\n[syzbot reported]\n==================================================================\nBUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline]\nBUG: KASAN: slab-use-after-free in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752\nRead of size 8 at addr ffff8880229254b0 by task syz-executor357/5216\n\nCPU: 0 UID: 0 PID: 5216 Comm: syz-executor357 Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024\nCall Trace:\n \n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n __mutex_lock_common kernel/locking/mutex.c:587 [inline]\n __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752\n dbFreeBits+0x7ea/0xd90 fs/jfs/jfs_dmap.c:2390\n dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline]\n dbFree+0x35b/0x680 fs/jfs/jfs_dmap.c:409\n dbDiscardAG+0x8a9/0xa20 fs/jfs/jfs_dmap.c:1650\n jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100\n jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n\nFreed by task 5218:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n poison_slab_object+0xe0/0x150 mm/kasan/common.c:240\n __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256\n kasan_slab_free include/linux/kasan.h:184 [inline]\n slab_free_hook mm/slub.c:2252 [inline]\n slab_free mm/slub.c:4473 [inline]\n kfree+0x149/0x360 mm/slub.c:4594\n dbUnmount+0x11d/0x190 fs/jfs/jfs_dmap.c:278\n jfs_mount_rw+0x4ac/0x6a0 fs/jfs/jfs_mount.c:247\n jfs_remount+0x3d1/0x6b0 fs/jfs/super.c:454\n reconfigure_super+0x445/0x880 fs/super.c:1083\n vfs_cmd_reconfigure fs/fsopen.c:263 [inline]\n vfs_fsconfig_locked fs/fsopen.c:292 [inline]\n __do_sys_fsconfig fs/fsopen.c:473 [inline]\n __se_sys_fsconfig+0xb6e/0xf80 fs/fsopen.c:345\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[Analysis]\nThere are two paths (dbUnmount and jfs_ioc_trim) that generate race\ncondition when accessing bmap, which leads to the occurrence of uaf.\n\nUse the lock s_umount to synchronize them, in order to avoid uaf caused\nby race condition.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49903" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--60940d9d-f6ee-4d74-b92f-4c08e1487a2a.json b/objects/vulnerability/vulnerability--60940d9d-f6ee-4d74-b92f-4c08e1487a2a.json new file mode 100644 index 00000000000..904d4466c3d --- /dev/null +++ b/objects/vulnerability/vulnerability--60940d9d-f6ee-4d74-b92f-4c08e1487a2a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8e073e7b-b4f4-4ab2-b207-6c55085a6010", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--60940d9d-f6ee-4d74-b92f-4c08e1487a2a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.677277Z", + "modified": "2024-10-22T00:37:16.677277Z", + "name": "CVE-2022-48994", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event\n\nWith clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),\nindirect call targets are validated against the expected function\npointer prototype to make sure the call target is valid to help mitigate\nROP attacks. If they are not identical, there is a failure at run time,\nwhich manifests as either a kernel panic or thread getting killed.\n\nseq_copy_in_user() and seq_copy_in_kernel() did not have prototypes\nmatching snd_seq_dump_func_t. Adjust this and remove the casts. There\nare not resulting binary output differences.\n\nThis was found as a result of Clang's new -Wcast-function-type-strict\nflag, which is more sensitive than the simpler -Wcast-function-type,\nwhich only checks for type width mismatches.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48994" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--609f2ff5-2007-411d-b730-8ad120ea28c5.json b/objects/vulnerability/vulnerability--609f2ff5-2007-411d-b730-8ad120ea28c5.json new file mode 100644 index 00000000000..8288e6fbd70 --- /dev/null +++ b/objects/vulnerability/vulnerability--609f2ff5-2007-411d-b730-8ad120ea28c5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b5d87ee7-1e2b-40be-8630-053a78cb7a05", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--609f2ff5-2007-411d-b730-8ad120ea28c5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.067882Z", + "modified": "2024-10-22T00:37:12.067882Z", + "name": "CVE-2024-49954", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstatic_call: Replace pointless WARN_ON() in static_call_module_notify()\n\nstatic_call_module_notify() triggers a WARN_ON(), when memory allocation\nfails in __static_call_add_module().\n\nThat's not really justified, because the failure case must be correctly\nhandled by the well known call chain and the error code is passed\nthrough to the initiating userspace application.\n\nA memory allocation fail is not a fatal problem, but the WARN_ON() takes\nthe machine out when panic_on_warn is set.\n\nReplace it with a pr_warn().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49954" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--60d8d50a-f69e-491d-a75a-3ba7d5f8ea74.json b/objects/vulnerability/vulnerability--60d8d50a-f69e-491d-a75a-3ba7d5f8ea74.json new file mode 100644 index 00000000000..4dce100a6de --- /dev/null +++ b/objects/vulnerability/vulnerability--60d8d50a-f69e-491d-a75a-3ba7d5f8ea74.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--50848bb6-cdf7-4052-92f3-8e7f61dc19ea", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--60d8d50a-f69e-491d-a75a-3ba7d5f8ea74", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.126643Z", + "modified": "2024-10-22T00:37:12.126643Z", + "name": "CVE-2024-49955", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: battery: Fix possible crash when unregistering a battery hook\n\nWhen a battery hook returns an error when adding a new battery, then\nthe battery hook is automatically unregistered.\nHowever the battery hook provider cannot know that, so it will later\ncall battery_hook_unregister() on the already unregistered battery\nhook, resulting in a crash.\n\nFix this by using the list head to mark already unregistered battery\nhooks as already being unregistered so that they can be ignored by\nbattery_hook_unregister().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49955" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--622ecc3d-9e28-4b32-90b2-b04ca70d6cdc.json b/objects/vulnerability/vulnerability--622ecc3d-9e28-4b32-90b2-b04ca70d6cdc.json new file mode 100644 index 00000000000..8a2ae4dd749 --- /dev/null +++ b/objects/vulnerability/vulnerability--622ecc3d-9e28-4b32-90b2-b04ca70d6cdc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3afa0aea-3f85-46ff-b5c3-7c601b35970c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--622ecc3d-9e28-4b32-90b2-b04ca70d6cdc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.101519Z", + "modified": "2024-10-22T00:37:12.101519Z", + "name": "CVE-2024-49999", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix the setting of the server responding flag\n\nIn afs_wait_for_operation(), we set transcribe the call responded flag to\nthe server record that we used after doing the fileserver iteration loop -\nbut it's possible to exit the loop having had a response from the server\nthat we've discarded (e.g. it returned an abort or we started receiving\ndata, but the call didn't complete).\n\nThis means that op->server might be NULL, but we don't check that before\nattempting to set the server flag.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49999" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--62c52c69-2a12-4ff9-84ec-1a5c25124d45.json b/objects/vulnerability/vulnerability--62c52c69-2a12-4ff9-84ec-1a5c25124d45.json new file mode 100644 index 00000000000..2023fb9aed1 --- /dev/null +++ b/objects/vulnerability/vulnerability--62c52c69-2a12-4ff9-84ec-1a5c25124d45.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ed5d331f-6226-4d25-8fd2-8b5dd1d943fd", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--62c52c69-2a12-4ff9-84ec-1a5c25124d45", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.89476Z", + "modified": "2024-10-22T00:37:10.89476Z", + "name": "CVE-2024-47729", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Use reserved copy engine for user binds on faulting devices\n\nUser binds map to engines with can fault, faults depend on user binds\ncompletion, thus we can deadlock. Avoid this by using reserved copy\nengine for user binds on faulting devices.\n\nWhile we are here, normalize bind queue creation with a helper.\n\nv2:\n - Pass in extensions to bind queue creation (CI)\nv3:\n - s/resevered/reserved (Lucas)\n - Fix NULL hwe check (Jonathan)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47729" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--62f3d640-51dd-4682-897c-b0e1c134d734.json b/objects/vulnerability/vulnerability--62f3d640-51dd-4682-897c-b0e1c134d734.json new file mode 100644 index 00000000000..49a30bbcf83 --- /dev/null +++ b/objects/vulnerability/vulnerability--62f3d640-51dd-4682-897c-b0e1c134d734.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--89cfa9d9-d8ba-4780-9c8a-395a4ab23a9b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--62f3d640-51dd-4682-897c-b0e1c134d734", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.71446Z", + "modified": "2024-10-22T00:37:16.71446Z", + "name": "CVE-2022-48978", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: fix shift-out-of-bounds in hid_report_raw_event\n\nSyzbot reported shift-out-of-bounds in hid_report_raw_event.\n\nmicrosoft 0003:045E:07DA.0001: hid_field_extract() called with n (128) >\n32! (swapper/0)\n======================================================================\nUBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:1323:20\nshift exponent 127 is too large for 32-bit type 'int'\nCPU: 0 PID: 0 Comm: swapper/0 Not tainted\n6.1.0-rc4-syzkaller-00159-g4bbf3422df78 #0\nHardware name: Google Compute Engine/Google Compute Engine, BIOS\nGoogle 10/26/2022\nCall Trace:\n \n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:151 [inline]\n __ubsan_handle_shift_out_of_bounds+0x3a6/0x420 lib/ubsan.c:322\n snto32 drivers/hid/hid-core.c:1323 [inline]\n hid_input_fetch_field drivers/hid/hid-core.c:1572 [inline]\n hid_process_report drivers/hid/hid-core.c:1665 [inline]\n hid_report_raw_event+0xd56/0x18b0 drivers/hid/hid-core.c:1998\n hid_input_report+0x408/0x4f0 drivers/hid/hid-core.c:2066\n hid_irq_in+0x459/0x690 drivers/hid/usbhid/hid-core.c:284\n __usb_hcd_giveback_urb+0x369/0x530 drivers/usb/core/hcd.c:1671\n dummy_timer+0x86b/0x3110 drivers/usb/gadget/udc/dummy_hcd.c:1988\n call_timer_fn+0xf5/0x210 kernel/time/timer.c:1474\n expire_timers kernel/time/timer.c:1519 [inline]\n __run_timers+0x76a/0x980 kernel/time/timer.c:1790\n run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803\n __do_softirq+0x277/0x75b kernel/softirq.c:571\n __irq_exit_rcu+0xec/0x170 kernel/softirq.c:650\n irq_exit_rcu+0x5/0x20 kernel/softirq.c:662\n sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1107\n======================================================================\n\nIf the size of the integer (unsigned n) is bigger than 32 in snto32(),\nshift exponent will be too large for 32-bit type 'int', resulting in a\nshift-out-of-bounds bug.\nFix this by adding a check on the size of the integer (unsigned n) in\nsnto32(). To add support for n greater than 32 bits, set n to 32, if n\nis greater than 32.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48978" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--63a37ac8-21d7-47d8-8f5d-83eed7944204.json b/objects/vulnerability/vulnerability--63a37ac8-21d7-47d8-8f5d-83eed7944204.json new file mode 100644 index 00000000000..146f3aaf584 --- /dev/null +++ b/objects/vulnerability/vulnerability--63a37ac8-21d7-47d8-8f5d-83eed7944204.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--10595353-6e17-4aec-bfbf-739e5d4ed6c5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--63a37ac8-21d7-47d8-8f5d-83eed7944204", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.015515Z", + "modified": "2024-10-22T00:37:11.015515Z", + "name": "CVE-2024-50064", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: free secondary algorithms names\n\nWe need to kfree() secondary algorithms names when reset zram device that\nhad multi-streams, otherwise we leak memory.\n\n[senozhatsky@chromium.org: kfree(NULL) is legal]\n Link: https://lkml.kernel.org/r/20240917013021.868769-1-senozhatsky@chromium.org", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50064" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--63e212e1-4c82-4bc7-bfb4-d5e3751e4dcc.json b/objects/vulnerability/vulnerability--63e212e1-4c82-4bc7-bfb4-d5e3751e4dcc.json new file mode 100644 index 00000000000..4549f118409 --- /dev/null +++ b/objects/vulnerability/vulnerability--63e212e1-4c82-4bc7-bfb4-d5e3751e4dcc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--cff0e445-d498-45a3-8272-c1517e7df425", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--63e212e1-4c82-4bc7-bfb4-d5e3751e4dcc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.15205Z", + "modified": "2024-10-22T00:37:12.15205Z", + "name": "CVE-2024-49877", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate\n\nWhen doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger\nNULL pointer dereference in the following ocfs2_set_buffer_uptodate() if\nbh is NULL.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49877" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6562d7b5-603e-4983-98dc-9adf494cc427.json b/objects/vulnerability/vulnerability--6562d7b5-603e-4983-98dc-9adf494cc427.json new file mode 100644 index 00000000000..281d54851ff --- /dev/null +++ b/objects/vulnerability/vulnerability--6562d7b5-603e-4983-98dc-9adf494cc427.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--587662b0-34a1-48d3-beff-ce39884d6db6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6562d7b5-603e-4983-98dc-9adf494cc427", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:13.070268Z", + "modified": "2024-10-22T00:37:13.070268Z", + "name": "CVE-2024-43689", + "description": "Stack-based buffer overflow vulnerability exists in WAB-I1750-PS and WAB-S1167-PS. By processing a specially crafted HTTP request, arbitrary code may be executed.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-43689" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--65e3d5fb-4f72-4d29-9519-ba5580e13fef.json b/objects/vulnerability/vulnerability--65e3d5fb-4f72-4d29-9519-ba5580e13fef.json new file mode 100644 index 00000000000..a086a33c3dd --- /dev/null +++ b/objects/vulnerability/vulnerability--65e3d5fb-4f72-4d29-9519-ba5580e13fef.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6a74f7e9-cf83-4ce4-956a-d77e2cb4787b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--65e3d5fb-4f72-4d29-9519-ba5580e13fef", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.706758Z", + "modified": "2024-10-22T00:37:10.706758Z", + "name": "CVE-2024-10200", + "description": "Administrative Management System from Wellchoose has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to download arbitrary files on the server.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-10200" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--660eeb31-eec8-463f-8fa8-18a0c3372c43.json b/objects/vulnerability/vulnerability--660eeb31-eec8-463f-8fa8-18a0c3372c43.json new file mode 100644 index 00000000000..dd754e49cd3 --- /dev/null +++ b/objects/vulnerability/vulnerability--660eeb31-eec8-463f-8fa8-18a0c3372c43.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0d808a1c-4cae-4420-9435-b54407c3c1a0", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--660eeb31-eec8-463f-8fa8-18a0c3372c43", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.831559Z", + "modified": "2024-10-22T00:37:10.831559Z", + "name": "CVE-2024-47825", + "description": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47825" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--666138f7-3cc7-4bfb-a31d-eb3746dd1ed0.json b/objects/vulnerability/vulnerability--666138f7-3cc7-4bfb-a31d-eb3746dd1ed0.json new file mode 100644 index 00000000000..c1c058393e0 --- /dev/null +++ b/objects/vulnerability/vulnerability--666138f7-3cc7-4bfb-a31d-eb3746dd1ed0.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--dbcfc22c-f9f0-4d6b-8079-fa18c95cd2f5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--666138f7-3cc7-4bfb-a31d-eb3746dd1ed0", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.283666Z", + "modified": "2024-10-22T00:37:12.283666Z", + "name": "CVE-2024-49873", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/filemap: fix filemap_get_folios_contig THP panic\n\nPatch series \"memfd-pin huge page fixes\".\n\nFix multiple bugs that occur when using memfd_pin_folios with hugetlb\npages and THP. The hugetlb bugs only bite when the page is not yet\nfaulted in when memfd_pin_folios is called. The THP bug bites when the\nstarting offset passed to memfd_pin_folios is not huge page aligned. See\nthe commit messages for details.\n\n\nThis patch (of 5):\n\nmemfd_pin_folios on memory backed by THP panics if the requested start\noffset is not huge page aligned:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000036\nRIP: 0010:filemap_get_folios_contig+0xdf/0x290\nRSP: 0018:ffffc9002092fbe8 EFLAGS: 00010202\nRAX: 0000000000000002 RBX: 0000000000000002 RCX: 0000000000000002\n\nThe fault occurs here, because xas_load returns a folio with value 2:\n\n filemap_get_folios_contig()\n for (folio = xas_load(&xas); folio && xas.xa_index <= end;\n folio = xas_next(&xas)) {\n ...\n if (!folio_try_get(folio)) <-- BOOM\n\n\"2\" is an xarray sibling entry. We get it because memfd_pin_folios does\nnot round the indices passed to filemap_get_folios_contig to huge page\nboundaries for THP, so we load from the middle of a huge page range see a\nsibling. (It does round for hugetlbfs, at the is_file_hugepages test).\n\nTo fix, if the folio is a sibling, then return the next index as the\nstarting point for the next call to filemap_get_folios_contig.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49873" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--666a2501-5d70-4f72-88f3-e12a13f517af.json b/objects/vulnerability/vulnerability--666a2501-5d70-4f72-88f3-e12a13f517af.json new file mode 100644 index 00000000000..e0f2b9d75a4 --- /dev/null +++ b/objects/vulnerability/vulnerability--666a2501-5d70-4f72-88f3-e12a13f517af.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3f7b563a-d032-42d8-a49f-8c330cb2653e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--666a2501-5d70-4f72-88f3-e12a13f517af", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.707779Z", + "modified": "2024-10-22T00:37:10.707779Z", + "name": "CVE-2024-10198", + "description": "A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /manage_customer.php of the component Manage Customer Page. The manipulation of the argument suppliers_name/address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting files to be affected. Other parameters might be affected as well.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-10198" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--66702426-a0ba-4b03-ba34-b25ef4089abf.json b/objects/vulnerability/vulnerability--66702426-a0ba-4b03-ba34-b25ef4089abf.json new file mode 100644 index 00000000000..360b162e896 --- /dev/null +++ b/objects/vulnerability/vulnerability--66702426-a0ba-4b03-ba34-b25ef4089abf.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b7228540-3ef4-4a01-97f5-cfcd2aa4a88d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--66702426-a0ba-4b03-ba34-b25ef4089abf", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.167117Z", + "modified": "2024-10-22T00:37:12.167117Z", + "name": "CVE-2024-49946", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: do not assume bh is held in ppp_channel_bridge_input()\n\nNetworking receive path is usually handled from BH handler.\nHowever, some protocols need to acquire the socket lock, and\npackets might be stored in the socket backlog is the socket was\nowned by a user process.\n\nIn this case, release_sock(), __release_sock(), and sk_backlog_rcv()\nmight call the sk->sk_backlog_rcv() handler in process context.\n\nsybot caught ppp was not considering this case in\nppp_channel_bridge_input() :\n\nWARNING: inconsistent lock state\n6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted\n--------------------------------\ninconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.\nksoftirqd/1/24 [HC0[0]:SC1[1]:HE1:SE0] takes:\n ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]\n ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]\n ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304\n{SOFTIRQ-ON-W} state was registered at:\n lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759\n __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]\n _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154\n spin_lock include/linux/spinlock.h:351 [inline]\n ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline]\n ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304\n pppoe_rcv_core+0xfc/0x314 drivers/net/ppp/pppoe.c:379\n sk_backlog_rcv include/net/sock.h:1111 [inline]\n __release_sock+0x1a8/0x3d8 net/core/sock.c:3004\n release_sock+0x68/0x1b8 net/core/sock.c:3558\n pppoe_sendmsg+0xc8/0x5d8 drivers/net/ppp/pppoe.c:903\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n __sys_sendto+0x374/0x4f4 net/socket.c:2204\n __do_sys_sendto net/socket.c:2216 [inline]\n __se_sys_sendto net/socket.c:2212 [inline]\n __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2212\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712\n el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730\n el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598\nirq event stamp: 282914\n hardirqs last enabled at (282914): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]\n hardirqs last enabled at (282914): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194\n hardirqs last disabled at (282913): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]\n hardirqs last disabled at (282913): [] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162\n softirqs last enabled at (282904): [] softirq_handle_end kernel/softirq.c:400 [inline]\n softirqs last enabled at (282904): [] handle_softirqs+0xa3c/0xbfc kernel/softirq.c:582\n softirqs last disabled at (282909): [] run_ksoftirqd+0x70/0x158 kernel/softirq.c:928\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(&pch->downl);\n \n lock(&pch->downl);\n\n *** DEADLOCK ***\n\n1 lock held by ksoftirqd/1/24:\n #0: ffff80008f74dfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:325\n\nstack backtrace:\nCPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nCall trace:\n dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326\n __dump_sta\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49946" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--66aa0695-845a-4a14-a3fe-d71e735c0681.json b/objects/vulnerability/vulnerability--66aa0695-845a-4a14-a3fe-d71e735c0681.json new file mode 100644 index 00000000000..6c682067d60 --- /dev/null +++ b/objects/vulnerability/vulnerability--66aa0695-845a-4a14-a3fe-d71e735c0681.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6d507989-0a74-4544-867d-536b6367a8c3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--66aa0695-845a-4a14-a3fe-d71e735c0681", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.546082Z", + "modified": "2024-10-22T00:37:10.546082Z", + "name": "CVE-2024-48709", + "description": "CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the membershipType parameter in edit_type.php", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-48709" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--66cb8aa9-f651-4085-9fd4-15cb7db32b07.json b/objects/vulnerability/vulnerability--66cb8aa9-f651-4085-9fd4-15cb7db32b07.json new file mode 100644 index 00000000000..f11631e9ed5 --- /dev/null +++ b/objects/vulnerability/vulnerability--66cb8aa9-f651-4085-9fd4-15cb7db32b07.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ce44b7d2-9d34-40a2-b857-b7c647ca9ea4", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--66cb8aa9-f651-4085-9fd4-15cb7db32b07", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.021266Z", + "modified": "2024-10-22T00:37:11.021266Z", + "name": "CVE-2024-50004", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35\n\n[WHY & HOW]\nMismatch in DCN35 DML2 cause bw validation failed to acquire unexpected DPP pipe to cause\ngrey screen and system hang. Remove EnhancedPrefetchScheduleAccelerationFinal value override\nto match HW spec.\n\n(cherry picked from commit 9dad21f910fcea2bdcff4af46159101d7f9cd8ba)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50004" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--673b60e6-f5d2-4314-8604-191b166bbc7d.json b/objects/vulnerability/vulnerability--673b60e6-f5d2-4314-8604-191b166bbc7d.json new file mode 100644 index 00000000000..6a2b10c87a2 --- /dev/null +++ b/objects/vulnerability/vulnerability--673b60e6-f5d2-4314-8604-191b166bbc7d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--cd929678-b62d-47ac-8f93-596e5602cb2b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--673b60e6-f5d2-4314-8604-191b166bbc7d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.900401Z", + "modified": "2024-10-22T00:37:10.900401Z", + "name": "CVE-2024-47675", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free in bpf_uprobe_multi_link_attach()\n\nIf bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the\nerror_free label and frees the array of bpf_uprobe's without calling\nbpf_uprobe_unregister().\n\nThis leaks bpf_uprobe->uprobe and worse, this frees bpf_uprobe->consumer\nwithout removing it from the uprobe->consumers list.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47675" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--68434b62-dd23-4481-abfc-3f6103e50831.json b/objects/vulnerability/vulnerability--68434b62-dd23-4481-abfc-3f6103e50831.json new file mode 100644 index 00000000000..25e2819be17 --- /dev/null +++ b/objects/vulnerability/vulnerability--68434b62-dd23-4481-abfc-3f6103e50831.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9eb5b131-7fc0-4864-9b02-28e86d09484d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--68434b62-dd23-4481-abfc-3f6103e50831", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.051413Z", + "modified": "2024-10-22T00:37:12.051413Z", + "name": "CVE-2024-49874", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition\n\nIn the svc_i3c_master_probe function, &master->hj_work is bound with\nsvc_i3c_master_hj_work, &master->ibi_work is bound with\nsvc_i3c_master_ibi_work. And svc_i3c_master_ibi_work can start the\nhj_work, svc_i3c_master_irq_handler can start the ibi_work.\n\nIf we remove the module which will call svc_i3c_master_remove to\nmake cleanup, it will free master->base through i3c_master_unregister\nwhile the work mentioned above will be used. The sequence of operations\nthat may lead to a UAF bug is as follows:\n\nCPU0 CPU1\n\n | svc_i3c_master_hj_work\nsvc_i3c_master_remove |\ni3c_master_unregister(&master->base)|\ndevice_unregister(&master->dev) |\ndevice_release |\n//free master->base |\n | i3c_master_do_daa(&master->base)\n | //use master->base\n\nFix it by ensuring that the work is canceled before proceeding with the\ncleanup in svc_i3c_master_remove.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49874" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--686e2013-52cf-4151-b4e8-69f6af4e8e52.json b/objects/vulnerability/vulnerability--686e2013-52cf-4151-b4e8-69f6af4e8e52.json new file mode 100644 index 00000000000..3e84a343041 --- /dev/null +++ b/objects/vulnerability/vulnerability--686e2013-52cf-4151-b4e8-69f6af4e8e52.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--7a5391d9-c1db-4a5f-b10b-27a61abc768e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--686e2013-52cf-4151-b4e8-69f6af4e8e52", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.906963Z", + "modified": "2024-10-22T00:37:10.906963Z", + "name": "CVE-2024-47754", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning\n\nFix a smatch static checker warning on vdec_h264_req_multi_if.c.\nWhich leads to a kernel crash when fb is NULL.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47754" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--68c48e34-b475-42f6-9e30-6485fd644f2a.json b/objects/vulnerability/vulnerability--68c48e34-b475-42f6-9e30-6485fd644f2a.json new file mode 100644 index 00000000000..f8501566b0b --- /dev/null +++ b/objects/vulnerability/vulnerability--68c48e34-b475-42f6-9e30-6485fd644f2a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1e106fc1-d061-44a3-b5d6-44ee6c7fc1f5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--68c48e34-b475-42f6-9e30-6485fd644f2a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.034483Z", + "modified": "2024-10-22T00:37:12.034483Z", + "name": "CVE-2024-49944", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start\n\nIn sctp_listen_start() invoked by sctp_inet_listen(), it should set the\nsk_state back to CLOSED if sctp_autobind() fails due to whatever reason.\n\nOtherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse\nis already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will\nbe dereferenced as sk_state is LISTENING, which causes a crash as bind_hash\nis NULL.\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617\n Call Trace:\n \n __sys_listen_socket net/socket.c:1883 [inline]\n __sys_listen+0x1b7/0x230 net/socket.c:1894\n __do_sys_listen net/socket.c:1902 [inline]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49944" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--69147556-93ee-4c73-beaf-f3a86a3c58d9.json b/objects/vulnerability/vulnerability--69147556-93ee-4c73-beaf-f3a86a3c58d9.json new file mode 100644 index 00000000000..d3e1e9c6905 --- /dev/null +++ b/objects/vulnerability/vulnerability--69147556-93ee-4c73-beaf-f3a86a3c58d9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0f36ac4d-7d6e-441d-95de-ae96002efd3f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--69147556-93ee-4c73-beaf-f3a86a3c58d9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.703451Z", + "modified": "2024-10-22T00:37:10.703451Z", + "name": "CVE-2024-10201", + "description": "Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-10201" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--691ec71b-5c05-4da5-8d80-c9900f2fb5ac.json b/objects/vulnerability/vulnerability--691ec71b-5c05-4da5-8d80-c9900f2fb5ac.json new file mode 100644 index 00000000000..3cef460777c --- /dev/null +++ b/objects/vulnerability/vulnerability--691ec71b-5c05-4da5-8d80-c9900f2fb5ac.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--404e11ad-a4ba-4ce4-a126-2dabb61b1889", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--691ec71b-5c05-4da5-8d80-c9900f2fb5ac", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.689012Z", + "modified": "2024-10-22T00:37:16.689012Z", + "name": "CVE-2022-48951", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()\n\nThe bounds checks in snd_soc_put_volsw_sx() are only being applied to the\nfirst channel, meaning it is possible to write out of bounds values to the\nsecond channel in stereo controls. Add appropriate checks.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48951" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--692aee73-8a1b-4d86-a1f2-1d8e265c6f9e.json b/objects/vulnerability/vulnerability--692aee73-8a1b-4d86-a1f2-1d8e265c6f9e.json new file mode 100644 index 00000000000..347b7742b7b --- /dev/null +++ b/objects/vulnerability/vulnerability--692aee73-8a1b-4d86-a1f2-1d8e265c6f9e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d4d8677a-a628-4bed-9f93-a8ab61c71f18", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--692aee73-8a1b-4d86-a1f2-1d8e265c6f9e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.946772Z", + "modified": "2024-10-22T00:37:10.946772Z", + "name": "CVE-2024-47718", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: always wait for both firmware loading attempts\n\nIn 'rtw_wait_firmware_completion()', always wait for both (regular and\nwowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()'\nhas failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue\n'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually\nthe wowlan one) is still in progress, causing UAF detected by KASAN.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47718" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6a352bb6-d9f1-45f2-97b4-37b1e23cb03f.json b/objects/vulnerability/vulnerability--6a352bb6-d9f1-45f2-97b4-37b1e23cb03f.json new file mode 100644 index 00000000000..8adb13fc3fc --- /dev/null +++ b/objects/vulnerability/vulnerability--6a352bb6-d9f1-45f2-97b4-37b1e23cb03f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--fea931d5-51a9-4fc3-b211-342ee15d8827", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6a352bb6-d9f1-45f2-97b4-37b1e23cb03f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.650541Z", + "modified": "2024-10-22T00:37:16.650541Z", + "name": "CVE-2022-48966", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvneta: Prevent out of bounds read in mvneta_config_rss()\n\nThe pp->indir[0] value comes from the user. It is passed to:\n\n\tif (cpu_online(pp->rxq_def))\n\ninside the mvneta_percpu_elect() function. It needs bounds checkeding\nto ensure that it is not beyond the end of the cpu bitmap.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48966" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6a5176e8-56c0-4297-b367-097826db7961.json b/objects/vulnerability/vulnerability--6a5176e8-56c0-4297-b367-097826db7961.json new file mode 100644 index 00000000000..f3dc52003ac --- /dev/null +++ b/objects/vulnerability/vulnerability--6a5176e8-56c0-4297-b367-097826db7961.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0b918ac4-ecbd-4d11-8b6a-f5996087e80d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6a5176e8-56c0-4297-b367-097826db7961", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.736694Z", + "modified": "2024-10-22T00:37:11.736694Z", + "name": "CVE-2024-41713", + "description": "A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-41713" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6a75fdf9-4186-47d3-8e57-ab34f6962a6f.json b/objects/vulnerability/vulnerability--6a75fdf9-4186-47d3-8e57-ab34f6962a6f.json new file mode 100644 index 00000000000..118b34cfe72 --- /dev/null +++ b/objects/vulnerability/vulnerability--6a75fdf9-4186-47d3-8e57-ab34f6962a6f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--738d31f9-ac30-4b33-aa7d-6df43aa12a58", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6a75fdf9-4186-47d3-8e57-ab34f6962a6f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.948302Z", + "modified": "2024-10-22T00:37:10.948302Z", + "name": "CVE-2024-47707", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()\n\nBlamed commit accidentally removed a check for rt->rt6i_idev being NULL,\nas spotted by syzbot:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\n RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline]\n RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914\nCode: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06\nRSP: 0018:ffffc900047374e0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0\nRBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c\nR10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18\nR13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930\nFS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856\n addrconf_notify+0x3cb/0x1020\n notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93\n call_netdevice_notifiers_extack net/core/dev.c:2032 [inline]\n call_netdevice_notifiers net/core/dev.c:2046 [inline]\n unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352\n unregister_netdevice_many net/core/dev.c:11414 [inline]\n unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289\n unregister_netdevice include/linux/netdevice.h:3129 [inline]\n __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685\n tun_detach drivers/net/tun.c:701 [inline]\n tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510\n __fput+0x24a/0x8a0 fs/file_table.c:422\n task_work_run+0x24f/0x310 kernel/task_work.c:228\n exit_task_work include/linux/task_work.h:40 [inline]\n do_exit+0xa2f/0x27f0 kernel/exit.c:882\n do_group_exit+0x207/0x2c0 kernel/exit.c:1031\n __do_sys_exit_group kernel/exit.c:1042 [inline]\n __se_sys_exit_group kernel/exit.c:1040 [inline]\n __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040\n x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f1acc77def9\nCode: Unable to access opcode bytes at 0x7f1acc77decf.\nRSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043\nRBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0\n \nModules linked in:\n---[ end trace 0000000000000000 ]---\n RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline]\n RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914\nCode: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06\nRSP: 0018:ffffc900047374e0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0\nR\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47707" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6ac6e32b-5ec2-41bc-bc46-a16e78489865.json b/objects/vulnerability/vulnerability--6ac6e32b-5ec2-41bc-bc46-a16e78489865.json new file mode 100644 index 00000000000..acb9077df3c --- /dev/null +++ b/objects/vulnerability/vulnerability--6ac6e32b-5ec2-41bc-bc46-a16e78489865.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2245ee9a-37c4-43f2-93d8-a67c31f43c07", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6ac6e32b-5ec2-41bc-bc46-a16e78489865", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.069583Z", + "modified": "2024-10-22T00:37:12.069583Z", + "name": "CVE-2024-49951", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix possible crash on mgmt_index_removed\n\nIf mgmt_index_removed is called while there are commands queued on\ncmd_sync it could lead to crashes like the bellow trace:\n\n0x0000053D: __list_del_entry_valid_or_report+0x98/0xdc\n0x0000053D: mgmt_pending_remove+0x18/0x58 [bluetooth]\n0x0000053E: mgmt_remove_adv_monitor_complete+0x80/0x108 [bluetooth]\n0x0000053E: hci_cmd_sync_work+0xbc/0x164 [bluetooth]\n\nSo while handling mgmt_index_removed this attempts to dequeue\ncommands passed as user_data to cmd_sync.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49951" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6aca634e-13e9-473f-a325-a25974424599.json b/objects/vulnerability/vulnerability--6aca634e-13e9-473f-a325-a25974424599.json new file mode 100644 index 00000000000..bdc82caa078 --- /dev/null +++ b/objects/vulnerability/vulnerability--6aca634e-13e9-473f-a325-a25974424599.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--97954674-575c-48c4-a834-2ddda9382148", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6aca634e-13e9-473f-a325-a25974424599", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.019177Z", + "modified": "2024-10-22T00:37:12.019177Z", + "name": "CVE-2024-49985", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume\n\nIn case there is any sort of clock controller attached to this I2C bus\ncontroller, for example Versaclock or even an AIC32x4 I2C codec, then\nan I2C transfer triggered from the clock controller clk_ops .prepare\ncallback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex.\n\nThis is because the clock controller first grabs the prepare_lock mutex\nand then performs the prepare operation, including its I2C access. The\nI2C access resumes this I2C bus controller via .runtime_resume callback,\nwhich calls clk_prepare_enable(), which attempts to grab the prepare_lock\nmutex again and deadlocks.\n\nSince the clock are already prepared since probe() and unprepared in\nremove(), use simple clk_enable()/clk_disable() calls to enable and\ndisable the clock on runtime suspend and resume, to avoid hitting the\nprepare_lock mutex.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49985" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6acf7d4f-6a1b-48c0-bc33-856eb1ae33d5.json b/objects/vulnerability/vulnerability--6acf7d4f-6a1b-48c0-bc33-856eb1ae33d5.json new file mode 100644 index 00000000000..95ad15bbfaa --- /dev/null +++ b/objects/vulnerability/vulnerability--6acf7d4f-6a1b-48c0-bc33-856eb1ae33d5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--910bb030-72c7-4305-9391-ff18b5f203ce", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6acf7d4f-6a1b-48c0-bc33-856eb1ae33d5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.181613Z", + "modified": "2024-10-22T00:37:12.181613Z", + "name": "CVE-2024-49971", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Increase array size of dummy_boolean\n\n[WHY]\ndml2_core_shared_mode_support and dml_core_mode_support access the third\nelement of dummy_boolean, i.e. hw_debug5 = &s->dummy_boolean[2], when\ndummy_boolean has size of 2. Any assignment to hw_debug5 causes an\nOVERRUN.\n\n[HOW]\nIncrease dummy_boolean's array size to 3.\n\nThis fixes 2 OVERRUN issues reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49971" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6afc8fc3-85a0-458d-bbd1-4a9639f53d8d.json b/objects/vulnerability/vulnerability--6afc8fc3-85a0-458d-bbd1-4a9639f53d8d.json new file mode 100644 index 00000000000..fd398e15eca --- /dev/null +++ b/objects/vulnerability/vulnerability--6afc8fc3-85a0-458d-bbd1-4a9639f53d8d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e1691388-2618-4aa5-81a4-be080466bf37", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6afc8fc3-85a0-458d-bbd1-4a9639f53d8d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.023334Z", + "modified": "2024-10-22T00:37:11.023334Z", + "name": "CVE-2024-50005", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: Fix potential RCU dereference issue in mac802154_scan_worker\n\nIn the `mac802154_scan_worker` function, the `scan_req->type` field was\naccessed after the RCU read-side critical section was unlocked. According\nto RCU usage rules, this is illegal and can lead to unpredictable\nbehavior, such as accessing memory that has been updated or causing\nuse-after-free issues.\n\nThis possible bug was identified using a static analysis tool developed\nby myself, specifically designed to detect RCU-related issues.\n\nTo address this, the `scan_req->type` value is now stored in a local\nvariable `scan_req_type` while still within the RCU read-side critical\nsection. The `scan_req_type` is then used after the RCU lock is released,\nensuring that the type value is safely accessed without violating RCU\nrules.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50005" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6b9030bb-ad6e-4c9f-8640-8088023e8722.json b/objects/vulnerability/vulnerability--6b9030bb-ad6e-4c9f-8640-8088023e8722.json new file mode 100644 index 00000000000..1a6d073e849 --- /dev/null +++ b/objects/vulnerability/vulnerability--6b9030bb-ad6e-4c9f-8640-8088023e8722.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e615bccf-42be-41f8-861f-94dca1d5af66", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6b9030bb-ad6e-4c9f-8640-8088023e8722", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.102648Z", + "modified": "2024-10-22T00:37:12.102648Z", + "name": "CVE-2024-49886", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug\n\nAttaching SST PCI device to VM causes \"BUG: KASAN: slab-out-of-bounds\".\nkasan report:\n[ 19.411889] ==================================================================\n[ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113\n[ 19.417368]\n[ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10\n[ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022\n[ 19.422687] Call Trace:\n[ 19.424091] \n[ 19.425448] dump_stack_lvl+0x5d/0x80\n[ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.428694] print_report+0x19d/0x52e\n[ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.433539] kasan_report+0xf0/0x170\n[ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10\n[ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common]\n[ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common]\n[ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360\n[ 19.444797] cpuhp_invoke_callback+0x221/0xec0\n[ 19.446337] cpuhp_thread_fun+0x21b/0x610\n[ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10\n[ 19.449354] smpboot_thread_fn+0x2e7/0x6e0\n[ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10\n[ 19.452405] kthread+0x29c/0x350\n[ 19.453817] ? __pfx_kthread+0x10/0x10\n[ 19.455253] ret_from_fork+0x31/0x70\n[ 19.456685] ? __pfx_kthread+0x10/0x10\n[ 19.458114] ret_from_fork_asm+0x1a/0x30\n[ 19.459573] \n[ 19.460853]\n[ 19.462055] Allocated by task 1198:\n[ 19.463410] kasan_save_stack+0x30/0x50\n[ 19.464788] kasan_save_track+0x14/0x30\n[ 19.466139] __kasan_kmalloc+0xaa/0xb0\n[ 19.467465] __kmalloc+0x1cd/0x470\n[ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common]\n[ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr]\n[ 19.471670] do_one_initcall+0xa4/0x380\n[ 19.472903] do_init_module+0x238/0x760\n[ 19.474105] load_module+0x5239/0x6f00\n[ 19.475285] init_module_from_file+0xd1/0x130\n[ 19.476506] idempotent_init_module+0x23b/0x650\n[ 19.477725] __x64_sys_finit_module+0xbe/0x130\n[ 19.476506] idempotent_init_module+0x23b/0x650\n[ 19.477725] __x64_sys_finit_module+0xbe/0x130\n[ 19.478920] do_syscall_64+0x82/0x160\n[ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 19.481292]\n[ 19.482205] The buggy address belongs to the object at ffff888829e65000\n which belongs to the cache kmalloc-512 of size 512\n[ 19.484818] The buggy address is located 0 bytes to the right of\n allocated 512-byte region [ffff888829e65000, ffff888829e65200)\n[ 19.487447]\n[ 19.488328] The buggy address belongs to the physical page:\n[ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60\n[ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)\n[ 19.493914] page_type: 0xffffffff()\n[ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\n[ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\n[ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\n[ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\n[ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff\n[ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000\n[ 19.503784] page dumped because: k\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49886" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6becd092-8e7d-47ef-a3f2-032bc9bb867d.json b/objects/vulnerability/vulnerability--6becd092-8e7d-47ef-a3f2-032bc9bb867d.json new file mode 100644 index 00000000000..2e0c764f537 --- /dev/null +++ b/objects/vulnerability/vulnerability--6becd092-8e7d-47ef-a3f2-032bc9bb867d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0075e1b8-53ed-4322-a692-45211874a579", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6becd092-8e7d-47ef-a3f2-032bc9bb867d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.918099Z", + "modified": "2024-10-22T00:37:10.918099Z", + "name": "CVE-2024-47679", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfs: fix race between evice_inodes() and find_inode()&iput()\n\nHi, all\n\nRecently I noticed a bug[1] in btrfs, after digged it into\nand I believe it'a race in vfs.\n\nLet's assume there's a inode (ie ino 261) with i_count 1 is\ncalled by iput(), and there's a concurrent thread calling\ngeneric_shutdown_super().\n\ncpu0: cpu1:\niput() // i_count is 1\n ->spin_lock(inode)\n ->dec i_count to 0\n ->iput_final() generic_shutdown_super()\n ->__inode_add_lru() ->evict_inodes()\n // cause some reason[2] ->if (atomic_read(inode->i_count)) continue;\n // return before // inode 261 passed the above check\n // list_lru_add_obj() // and then schedule out\n ->spin_unlock()\n// note here: the inode 261\n// was still at sb list and hash list,\n// and I_FREEING|I_WILL_FREE was not been set\n\nbtrfs_iget()\n // after some function calls\n ->find_inode()\n // found the above inode 261\n ->spin_lock(inode)\n // check I_FREEING|I_WILL_FREE\n // and passed\n ->__iget()\n ->spin_unlock(inode) // schedule back\n ->spin_lock(inode)\n // check (I_NEW|I_FREEING|I_WILL_FREE) flags,\n // passed and set I_FREEING\niput() ->spin_unlock(inode)\n ->spin_lock(inode)\t\t\t ->evict()\n // dec i_count to 0\n ->iput_final()\n ->spin_unlock()\n ->evict()\n\nNow, we have two threads simultaneously evicting\nthe same inode, which may trigger the BUG(inode->i_state & I_CLEAR)\nstatement both within clear_inode() and iput().\n\nTo fix the bug, recheck the inode->i_count after holding i_lock.\nBecause in the most scenarios, the first check is valid, and\nthe overhead of spin_lock() can be reduced.\n\nIf there is any misunderstanding, please let me know, thanks.\n\n[1]: https://lore.kernel.org/linux-btrfs/000000000000eabe1d0619c48986@google.com/\n[2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable()\nreturn false when I reproduced the bug.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47679" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6cd448bb-623d-41e3-954a-bce5b9636493.json b/objects/vulnerability/vulnerability--6cd448bb-623d-41e3-954a-bce5b9636493.json new file mode 100644 index 00000000000..e80486a8833 --- /dev/null +++ b/objects/vulnerability/vulnerability--6cd448bb-623d-41e3-954a-bce5b9636493.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--84fb4a3c-edec-4ae5-9e84-b30888d1ad38", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6cd448bb-623d-41e3-954a-bce5b9636493", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.980295Z", + "modified": "2024-10-22T00:37:10.980295Z", + "name": "CVE-2024-50020", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()\n\nThis patch addresses an issue with improper reference count handling in the\nice_sriov_set_msix_vec_count() function.\n\nFirst, the function calls ice_get_vf_by_id(), which increments the\nreference count of the vf pointer. If the subsequent call to\nice_get_vf_vsi() fails, the function currently returns an error without\ndecrementing the reference count of the vf pointer, leading to a reference\ncount leak. The correct behavior, as implemented in this patch, is to\ndecrement the reference count using ice_put_vf(vf) before returning an\nerror when vsi is NULL.\n\nSecond, the function calls ice_sriov_get_irqs(), which sets\nvf->first_vector_idx. If this call returns a negative value, indicating an\nerror, the function returns an error without decrementing the reference\ncount of the vf pointer, resulting in another reference count leak. The\npatch addresses this by adding a call to ice_put_vf(vf) before returning\nan error when vf->first_vector_idx < 0.\n\nThis bug was identified by an experimental static analysis tool developed\nby our team. The tool specializes in analyzing reference count operations\nand identifying potential mismanagement of reference counts. In this case,\nthe tool flagged the missing decrement operation as a potential issue,\nleading to this patch.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50020" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6d77eef7-b880-4a54-9a5e-ccd12a327aa8.json b/objects/vulnerability/vulnerability--6d77eef7-b880-4a54-9a5e-ccd12a327aa8.json new file mode 100644 index 00000000000..25e024da9c0 --- /dev/null +++ b/objects/vulnerability/vulnerability--6d77eef7-b880-4a54-9a5e-ccd12a327aa8.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f0a87571-40c9-441d-9ddf-0f3dddc48b56", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6d77eef7-b880-4a54-9a5e-ccd12a327aa8", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.700271Z", + "modified": "2024-10-22T00:37:10.700271Z", + "name": "CVE-2024-10197", + "description": "A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /manage_supplier.php of the component Manage Supplier Page. The manipulation of the argument address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-10197" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6d96c40f-06ca-4249-a28e-14151a80f674.json b/objects/vulnerability/vulnerability--6d96c40f-06ca-4249-a28e-14151a80f674.json new file mode 100644 index 00000000000..8840b42a0b3 --- /dev/null +++ b/objects/vulnerability/vulnerability--6d96c40f-06ca-4249-a28e-14151a80f674.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--67e746f4-f2fa-4332-8c07-b69e0241b78d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6d96c40f-06ca-4249-a28e-14151a80f674", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.986743Z", + "modified": "2024-10-22T00:37:10.986743Z", + "name": "CVE-2024-50044", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change\n\nrfcomm_sk_state_change attempts to use sock_lock so it must never be\ncalled with it locked but rfcomm_sock_ioctl always attempt to lock it\ncausing the following trace:\n\n======================================================\nWARNING: possible circular locking dependency detected\n6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted\n------------------------------------------------------\nsyz-executor386/5093 is trying to acquire lock:\nffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline]\nffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73\n\nbut task is already holding lock:\nffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50044" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6eecaa10-a636-4b2e-85fc-180cff339b4c.json b/objects/vulnerability/vulnerability--6eecaa10-a636-4b2e-85fc-180cff339b4c.json new file mode 100644 index 00000000000..8960be2764b --- /dev/null +++ b/objects/vulnerability/vulnerability--6eecaa10-a636-4b2e-85fc-180cff339b4c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--981f1d39-ad71-42cc-b0fa-27a8105508e2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6eecaa10-a636-4b2e-85fc-180cff339b4c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.855973Z", + "modified": "2024-10-22T00:37:10.855973Z", + "name": "CVE-2024-47720", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the dcn30_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for nullity at line 386, but then it\nwas being dereferenced without any nullity check at line 401. This\ncould potentially lead to a null pointer dereference error if\nset_output_gamma is indeed null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a nullity check for\nset_output_gamma before the call to set_output_gamma at line 401. If\nset_output_gamma is null, we log an error message and do not call the\nfunction.\n\nThis fix prevents a potential null pointer dereference error.\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func()\nerror: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see line 386)\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c\n 373 bool dcn30_set_output_transfer_func(struct dc *dc,\n 374 struct pipe_ctx *pipe_ctx,\n 375 const struct dc_stream_state *stream)\n 376 {\n 377 int mpcc_id = pipe_ctx->plane_res.hubp->inst;\n 378 struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc;\n 379 const struct pwl_params *params = NULL;\n 380 bool ret = false;\n 381\n 382 /* program OGAM or 3DLUT only for the top pipe*/\n 383 if (pipe_ctx->top_pipe == NULL) {\n 384 /*program rmu shaper and 3dlut in MPC*/\n 385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);\n 386 if (ret == false && mpc->funcs->set_output_gamma) {\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL\n\n 387 if (stream->out_transfer_func.type == TF_TYPE_HWPWL)\n 388 params = &stream->out_transfer_func.pwl;\n 389 else if (pipe_ctx->stream->out_transfer_func.type ==\n 390 TF_TYPE_DISTRIBUTED_POINTS &&\n 391 cm3_helper_translate_curve_to_hw_format(\n 392 &stream->out_transfer_func,\n 393 &mpc->blender_params, false))\n 394 params = &mpc->blender_params;\n 395 /* there are no ROM LUTs in OUTGAM */\n 396 if (stream->out_transfer_func.type == TF_TYPE_PREDEFINED)\n 397 BREAK_TO_DEBUGGER();\n 398 }\n 399 }\n 400\n--> 401 mpc->funcs->set_output_gamma(mpc, mpcc_id, params);\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash\n\n 402 return ret;\n 403 }", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47720" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6fafe2e4-c7f1-4dae-adfe-cb549a36cabe.json b/objects/vulnerability/vulnerability--6fafe2e4-c7f1-4dae-adfe-cb549a36cabe.json new file mode 100644 index 00000000000..aa5f9b95011 --- /dev/null +++ b/objects/vulnerability/vulnerability--6fafe2e4-c7f1-4dae-adfe-cb549a36cabe.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--abf4752d-9165-4463-9114-fcef082a6727", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6fafe2e4-c7f1-4dae-adfe-cb549a36cabe", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.188456Z", + "modified": "2024-10-22T00:37:12.188456Z", + "name": "CVE-2024-49925", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: efifb: Register sysfs groups through driver core\n\nThe driver core can register and cleanup sysfs groups already.\nMake use of that functionality to simplify the error handling and\ncleanup.\n\nAlso avoid a UAF race during unregistering where the sysctl attributes\nwere usable after the info struct was freed.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49925" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6fdbfeff-dec2-452f-ba76-cd783900ee69.json b/objects/vulnerability/vulnerability--6fdbfeff-dec2-452f-ba76-cd783900ee69.json new file mode 100644 index 00000000000..9ccad58e239 --- /dev/null +++ b/objects/vulnerability/vulnerability--6fdbfeff-dec2-452f-ba76-cd783900ee69.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8bd0febd-d4a6-4079-a09d-e5baa6d88064", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6fdbfeff-dec2-452f-ba76-cd783900ee69", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.908177Z", + "modified": "2024-10-22T00:37:10.908177Z", + "name": "CVE-2024-47750", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix Use-After-Free of rsv_qp on HIP08\n\nCurrently rsv_qp is freed before ib_unregister_device() is called\non HIP08. During the time interval, users can still dereg MR and\nrsv_qp will be used in this process, leading to a UAF. Move the\nrelease of rsv_qp after calling ib_unregister_device() to fix it.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47750" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--6ff3d6c7-a4f6-470d-9963-c330ee2091d5.json b/objects/vulnerability/vulnerability--6ff3d6c7-a4f6-470d-9963-c330ee2091d5.json new file mode 100644 index 00000000000..2a1b25947fb --- /dev/null +++ b/objects/vulnerability/vulnerability--6ff3d6c7-a4f6-470d-9963-c330ee2091d5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3139156c-4358-4eae-a531-4795bb6a8d2e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--6ff3d6c7-a4f6-470d-9963-c330ee2091d5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.679339Z", + "modified": "2024-10-22T00:37:16.679339Z", + "name": "CVE-2022-48967", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: Bounds check struct nfc_target arrays\n\nWhile running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:\n\n memcpy: detected field-spanning write (size 129) of single field \"target->sensf_res\" at net/nfc/nci/ntf.c:260 (size 18)\n\nThis appears to be a legitimate lack of bounds checking in\nnci_add_new_protocol(). Add the missing checks.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48967" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--70823b02-50ee-4ece-a89c-43ad823c24cc.json b/objects/vulnerability/vulnerability--70823b02-50ee-4ece-a89c-43ad823c24cc.json new file mode 100644 index 00000000000..5789876b853 --- /dev/null +++ b/objects/vulnerability/vulnerability--70823b02-50ee-4ece-a89c-43ad823c24cc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8d0a1dac-9be6-45dd-9b3b-5c2302f444e8", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--70823b02-50ee-4ece-a89c-43ad823c24cc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.016014Z", + "modified": "2024-10-22T00:37:12.016014Z", + "name": "CVE-2024-49950", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix uaf in l2cap_connect\n\n[Syzbot reported]\nBUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949\nRead of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54\n\nCPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nWorkqueue: hci2 hci_rx_work\nCall Trace:\n \n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc3/0x620 mm/kasan/report.c:488\n kasan_report+0xd9/0x110 mm/kasan/report.c:601\n l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949\n l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]\n l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]\n l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]\n l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825\n l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514\n hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]\n hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028\n process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231\n process_scheduled_works kernel/workqueue.c:3312 [inline]\n worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389\n kthread+0x2c1/0x3a0 kernel/kthread.c:389\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n...\n\nFreed by task 5245:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:47\n kasan_save_track+0x14/0x30 mm/kasan/common.c:68\n kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579\n poison_slab_object+0xf7/0x160 mm/kasan/common.c:240\n __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256\n kasan_slab_free include/linux/kasan.h:184 [inline]\n slab_free_hook mm/slub.c:2256 [inline]\n slab_free mm/slub.c:4477 [inline]\n kfree+0x12a/0x3b0 mm/slub.c:4598\n l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]\n kref_put include/linux/kref.h:65 [inline]\n l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]\n l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802\n l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241\n hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]\n hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265\n hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583\n abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917\n hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328\n process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231\n process_scheduled_works kernel/workqueue.c:3312 [inline]\n worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389\n kthread+0x2c1/0x3a0 kernel/kthread.c:389\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49950" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--7287c2a8-3a70-44de-875b-9d31846b3488.json b/objects/vulnerability/vulnerability--7287c2a8-3a70-44de-875b-9d31846b3488.json new file mode 100644 index 00000000000..2ac146fbde7 --- /dev/null +++ b/objects/vulnerability/vulnerability--7287c2a8-3a70-44de-875b-9d31846b3488.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c0f764ff-c0e2-4ada-bbee-85a3575b2152", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--7287c2a8-3a70-44de-875b-9d31846b3488", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.134711Z", + "modified": "2024-10-22T00:37:12.134711Z", + "name": "CVE-2024-49863", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/scsi: null-ptr-dereference in vhost_scsi_get_req()\n\nSince commit 3f8ca2e115e5 (\"vhost/scsi: Extract common handling code\nfrom control queue handler\") a null pointer dereference bug can be\ntriggered when guest sends an SCSI AN request.\n\nIn vhost_scsi_ctl_handle_vq(), `vc.target` is assigned with\n`&v_req.tmf.lun[1]` within a switch-case block and is then passed to\nvhost_scsi_get_req() which extracts `vc->req` and `tpg`. However, for\na `VIRTIO_SCSI_T_AN_*` request, tpg is not required, so `vc.target` is\nset to NULL in this branch. Later, in vhost_scsi_get_req(),\n`vc->target` is dereferenced without being checked, leading to a null\npointer dereference bug. This bug can be triggered from guest.\n\nWhen this bug occurs, the vhost_worker process is killed while holding\n`vq->mutex` and the corresponding tpg will remain occupied\nindefinitely.\n\nBelow is the KASAN report:\nOops: general protection fault, probably for non-canonical address\n0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 PID: 840 Comm: poc Not tainted 6.10.0+ #1\nHardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS\n1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:vhost_scsi_get_req+0x165/0x3a0\nCode: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 2b 02 00 00\n48 b8 00 00 00 00 00 fc ff df 4d 8b 65 30 4c 89 e2 48 c1 ea 03 <0f> b6\n04 02 4c 89 e2 83 e2 07 38 d0 7f 08 84 c0 0f 85 be 01 00 00\nRSP: 0018:ffff888017affb50 EFLAGS: 00010246\nRAX: dffffc0000000000 RBX: ffff88801b000000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888017affcb8\nRBP: ffff888017affb80 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff888017affc88 R14: ffff888017affd1c R15: ffff888017993000\nFS: 000055556e076500(0000) GS:ffff88806b100000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200027c0 CR3: 0000000010ed0004 CR4: 0000000000370ef0\nCall Trace:\n \n ? show_regs+0x86/0xa0\n ? die_addr+0x4b/0xd0\n ? exc_general_protection+0x163/0x260\n ? asm_exc_general_protection+0x27/0x30\n ? vhost_scsi_get_req+0x165/0x3a0\n vhost_scsi_ctl_handle_vq+0x2a4/0xca0\n ? __pfx_vhost_scsi_ctl_handle_vq+0x10/0x10\n ? __switch_to+0x721/0xeb0\n ? __schedule+0xda5/0x5710\n ? __kasan_check_write+0x14/0x30\n ? _raw_spin_lock+0x82/0xf0\n vhost_scsi_ctl_handle_kick+0x52/0x90\n vhost_run_work_list+0x134/0x1b0\n vhost_task_fn+0x121/0x350\n...\n \n---[ end trace 0000000000000000 ]---\n\nLet's add a check in vhost_scsi_get_req.\n\n[whitespace fixes]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49863" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--72e18284-3fc9-4a0e-bc3f-3eadfcbb50d5.json b/objects/vulnerability/vulnerability--72e18284-3fc9-4a0e-bc3f-3eadfcbb50d5.json new file mode 100644 index 00000000000..6c8022c39e1 --- /dev/null +++ b/objects/vulnerability/vulnerability--72e18284-3fc9-4a0e-bc3f-3eadfcbb50d5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d94cab5a-7048-4339-9e6e-c767d9eb5354", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--72e18284-3fc9-4a0e-bc3f-3eadfcbb50d5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.954184Z", + "modified": "2024-10-22T00:37:17.954184Z", + "name": "CVE-2022-49010", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (coretemp) Check for null before removing sysfs attrs\n\nIf coretemp_add_core() gets an error then pdata->core_data[indx]\nis already NULL and has been kfreed. Don't pass that to\nsysfs_remove_group() as that will crash in sysfs_remove_group().\n\n[Shortened for readability]\n[91854.020159] sysfs: cannot create duplicate filename '/devices/platform/coretemp.0/hwmon/hwmon2/temp20_label'\n\n[91855.126115] BUG: kernel NULL pointer dereference, address: 0000000000000188\n[91855.165103] #PF: supervisor read access in kernel mode\n[91855.194506] #PF: error_code(0x0000) - not-present page\n[91855.224445] PGD 0 P4D 0\n[91855.238508] Oops: 0000 [#1] PREEMPT SMP PTI\n...\n[91855.342716] RIP: 0010:sysfs_remove_group+0xc/0x80\n...\n[91855.796571] Call Trace:\n[91855.810524] coretemp_cpu_offline+0x12b/0x1dd [coretemp]\n[91855.841738] ? coretemp_cpu_online+0x180/0x180 [coretemp]\n[91855.871107] cpuhp_invoke_callback+0x105/0x4b0\n[91855.893432] cpuhp_thread_fun+0x8e/0x150\n...\n\nFix this by checking for NULL first.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49010" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--7382bd05-33b2-43a7-8745-7bde666de5ff.json b/objects/vulnerability/vulnerability--7382bd05-33b2-43a7-8745-7bde666de5ff.json new file mode 100644 index 00000000000..6825261cf1f --- /dev/null +++ b/objects/vulnerability/vulnerability--7382bd05-33b2-43a7-8745-7bde666de5ff.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9bf34c20-8672-4338-a866-9c581e1fc84c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--7382bd05-33b2-43a7-8745-7bde666de5ff", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.112977Z", + "modified": "2024-10-22T00:37:12.112977Z", + "name": "CVE-2024-49975", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuprobes: fix kernel info leak via \"[uprobes]\" vma\n\nxol_add_vma() maps the uninitialized page allocated by __create_xol_area()\ninto userspace. On some architectures (x86) this memory is readable even\nwithout VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ,\nalthough this doesn't really matter, debugger can read this memory anyway.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49975" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--73aa23da-b2c7-4b1b-8687-98acba85881f.json b/objects/vulnerability/vulnerability--73aa23da-b2c7-4b1b-8687-98acba85881f.json new file mode 100644 index 00000000000..2e298d03a16 --- /dev/null +++ b/objects/vulnerability/vulnerability--73aa23da-b2c7-4b1b-8687-98acba85881f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--958bbe86-29a1-45e2-b8a0-94c2387379a1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--73aa23da-b2c7-4b1b-8687-98acba85881f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.020244Z", + "modified": "2024-10-22T00:37:11.020244Z", + "name": "CVE-2024-50056", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c\n\nFix potential dereferencing of ERR_PTR() in find_format_by_pix()\nand uvc_v4l2_enum_format().\n\nFix the following smatch errors:\n\ndrivers/usb/gadget/function/uvc_v4l2.c:124 find_format_by_pix()\nerror: 'fmtdesc' dereferencing possible ERR_PTR()\n\ndrivers/usb/gadget/function/uvc_v4l2.c:392 uvc_v4l2_enum_format()\nerror: 'fmtdesc' dereferencing possible ERR_PTR()\n\nAlso, fix similar issue in uvc_v4l2_try_format() for potential\ndereferencing of ERR_PTR().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50056" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--73cfcf4d-23a0-4066-88bc-3feded2bbcb9.json b/objects/vulnerability/vulnerability--73cfcf4d-23a0-4066-88bc-3feded2bbcb9.json new file mode 100644 index 00000000000..2c34bc9c916 --- /dev/null +++ b/objects/vulnerability/vulnerability--73cfcf4d-23a0-4066-88bc-3feded2bbcb9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0639a345-9601-4219-ab65-0cd9878e004c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--73cfcf4d-23a0-4066-88bc-3feded2bbcb9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.282122Z", + "modified": "2024-10-22T00:37:12.282122Z", + "name": "CVE-2024-49864", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix a race between socket set up and I/O thread creation\n\nIn rxrpc_open_socket(), it sets up the socket and then sets up the I/O\nthread that will handle it. This is a problem, however, as there's a gap\nbetween the two phases in which a packet may come into rxrpc_encap_rcv()\nfrom the UDP packet but we oops when trying to wake the not-yet created I/O\nthread.\n\nAs a quick fix, just make rxrpc_encap_rcv() discard the packet if there's\nno I/O thread yet.\n\nA better, but more intrusive fix would perhaps be to rearrange things such\nthat the socket creation is done by the I/O thread.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49864" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--74417d41-c30e-45a9-9479-8618c3f9cd78.json b/objects/vulnerability/vulnerability--74417d41-c30e-45a9-9479-8618c3f9cd78.json new file mode 100644 index 00000000000..91df52720a5 --- /dev/null +++ b/objects/vulnerability/vulnerability--74417d41-c30e-45a9-9479-8618c3f9cd78.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ed23893c-f648-47d4-bec2-8b20f6e72a2f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--74417d41-c30e-45a9-9479-8618c3f9cd78", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.66003Z", + "modified": "2024-10-22T00:37:16.66003Z", + "name": "CVE-2022-48963", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: iosm: fix memory leak in ipc_mux_init()\n\nWhen failed to alloc ipc_mux->ul_adb.pp_qlt in ipc_mux_init(), ipc_mux\nis not released.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48963" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--74a30dc4-be19-4f54-9a23-c408619404d7.json b/objects/vulnerability/vulnerability--74a30dc4-be19-4f54-9a23-c408619404d7.json new file mode 100644 index 00000000000..9dd7a4e86b8 --- /dev/null +++ b/objects/vulnerability/vulnerability--74a30dc4-be19-4f54-9a23-c408619404d7.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--186af17f-e99d-47db-b442-07fa67b70e96", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--74a30dc4-be19-4f54-9a23-c408619404d7", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:13.162439Z", + "modified": "2024-10-22T00:37:13.162439Z", + "name": "CVE-2024-6519", + "description": "A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-6519" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--758b8de4-de2d-43ab-bbaa-fd117ada5483.json b/objects/vulnerability/vulnerability--758b8de4-de2d-43ab-bbaa-fd117ada5483.json new file mode 100644 index 00000000000..af4b75e82f7 --- /dev/null +++ b/objects/vulnerability/vulnerability--758b8de4-de2d-43ab-bbaa-fd117ada5483.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--072a1990-22b6-45e7-bc87-d6acbadba312", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--758b8de4-de2d-43ab-bbaa-fd117ada5483", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.850241Z", + "modified": "2024-10-22T00:37:10.850241Z", + "name": "CVE-2024-47706", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix possible UAF for bfqq->bic with merge chain\n\n1) initial state, three tasks:\n\n\t\tProcess 1 Process 2\tProcess 3\n\t\t (BIC1) (BIC2)\t\t (BIC3)\n\t\t | Λ | Λ\t\t | Λ\n\t\t | | | |\t\t | |\n\t\t V | V |\t\t V |\n\t\t bfqq1 bfqq2\t\t bfqq3\nprocess ref:\t 1\t\t 1\t\t 1\n\n2) bfqq1 merged to bfqq2:\n\n\t\tProcess 1 Process 2\tProcess 3\n\t\t (BIC1) (BIC2)\t\t (BIC3)\n\t\t | |\t\t | Λ\n\t\t \\--------------\\|\t\t | |\n\t\t V\t\t V |\n\t\t bfqq1--------->bfqq2\t\t bfqq3\nprocess ref:\t 0\t\t 2\t\t 1\n\n3) bfqq2 merged to bfqq3:\n\n\t\tProcess 1 Process 2\tProcess 3\n\t\t (BIC1) (BIC2)\t\t (BIC3)\n\t here -> Λ |\t\t |\n\t\t \\--------------\\ \\-------------\\|\n\t\t V\t\t V\n\t\t bfqq1--------->bfqq2---------->bfqq3\nprocess ref:\t 0\t\t 1\t\t 3\n\nIn this case, IO from Process 1 will get bfqq2 from BIC1 first, and then\nget bfqq3 through merge chain, and finially handle IO by bfqq3.\nHowerver, current code will think bfqq2 is owned by BIC1, like initial\nstate, and set bfqq2->bic to BIC1.\n\nbfq_insert_request\n-> by Process 1\n bfqq = bfq_init_rq(rq)\n bfqq = bfq_get_bfqq_handle_split\n bfqq = bic_to_bfqq\n -> get bfqq2 from BIC1\n bfqq->ref++\n rq->elv.priv[0] = bic\n rq->elv.priv[1] = bfqq\n if (bfqq_process_refs(bfqq) == 1)\n bfqq->bic = bic\n -> record BIC1 to bfqq2\n\n __bfq_insert_request\n new_bfqq = bfq_setup_cooperator\n -> get bfqq3 from bfqq2->new_bfqq\n bfqq_request_freed(bfqq)\n new_bfqq->ref++\n rq->elv.priv[1] = new_bfqq\n -> handle IO by bfqq3\n\nFix the problem by checking bfqq is from merge chain fist. And this\nmight fix a following problem reported by our syzkaller(unreproducible):\n\n==================================================================\nBUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]\nBUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]\nBUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889\nWrite of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595\n\nCPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G L 6.6.0-07439-gba2303cacfda #6\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\nWorkqueue: kblockd blk_mq_requeue_work\nCall Trace:\n \n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:364 [inline]\n print_report+0x10d/0x610 mm/kasan/report.c:475\n kasan_report+0x8e/0xc0 mm/kasan/report.c:588\n bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]\n bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]\n bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889\n bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757\n bfq_init_rq block/bfq-iosched.c:6876 [inline]\n bfq_insert_request block/bfq-iosched.c:6254 [inline]\n bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304\n blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593\n blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502\n process_one_work kernel/workqueue.c:2627 [inline]\n process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700\n worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781\n kthread+0x33c/0x440 kernel/kthread.c:388\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305\n \n\nAllocated by task 20776:\n kasan_save_stack+0x20/0x40 mm/kasan/common.c:45\n kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328\n kasan_slab_alloc include/linux/kasan.h:188 [inline]\n slab_post_alloc_hook mm/slab.h:763 [inline]\n slab_alloc_node mm/slub.c:3458 [inline]\n kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503\n ioc_create_icq block/blk-ioc.c:370 [inline]\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47706" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--772149a0-1311-4223-84d2-473ea3b01873.json b/objects/vulnerability/vulnerability--772149a0-1311-4223-84d2-473ea3b01873.json new file mode 100644 index 00000000000..64786890ff6 --- /dev/null +++ b/objects/vulnerability/vulnerability--772149a0-1311-4223-84d2-473ea3b01873.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4699b2a0-b468-4a34-801e-33505b484925", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--772149a0-1311-4223-84d2-473ea3b01873", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.981306Z", + "modified": "2024-10-22T00:37:10.981306Z", + "name": "CVE-2024-50036", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not delay dst_entries_add() in dst_release()\n\ndst_entries_add() uses per-cpu data that might be freed at netns\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\n\nBefore ip6_route_net_exit() can be called, we release all\nthe dsts associated with this netns, via calls to dst_release(),\nwhich waits an rcu grace period before calling dst_destroy()\n\ndst_entries_add() use in dst_destroy() is racy, because\ndst_entries_destroy() could have been called already.\n\nDecrementing the number of dsts must happen sooner.\n\nNotes:\n\n1) in CONFIG_XFRM case, dst_destroy() can call\n dst_release_immediate(child), this might also cause UAF\n if the child does not have DST_NOCOUNT set.\n IPSEC maintainers might take a look and see how to address this.\n\n2) There is also discussion about removing this count of dst,\n which might happen in future kernels.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50036" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--772f05a6-5ed8-4374-8c1f-4658649f6fdc.json b/objects/vulnerability/vulnerability--772f05a6-5ed8-4374-8c1f-4658649f6fdc.json new file mode 100644 index 00000000000..f3f0a31ed21 --- /dev/null +++ b/objects/vulnerability/vulnerability--772f05a6-5ed8-4374-8c1f-4658649f6fdc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--41943646-e7bf-46e6-be46-00c91707a7fa", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--772f05a6-5ed8-4374-8c1f-4658649f6fdc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.935433Z", + "modified": "2024-10-22T00:37:17.935433Z", + "name": "CVE-2022-49009", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (asus-ec-sensors) Add checks for devm_kcalloc\n\nAs the devm_kcalloc may return NULL, the return value needs to be checked\nto avoid NULL poineter dereference.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49009" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--783fbf14-bc49-489f-b031-f4755dd79b2b.json b/objects/vulnerability/vulnerability--783fbf14-bc49-489f-b031-f4755dd79b2b.json new file mode 100644 index 00000000000..95f8236d7e4 --- /dev/null +++ b/objects/vulnerability/vulnerability--783fbf14-bc49-489f-b031-f4755dd79b2b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c15946dd-c2f1-4f2d-9778-d8a4249beab9", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--783fbf14-bc49-489f-b031-f4755dd79b2b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.963347Z", + "modified": "2024-10-22T00:37:17.963347Z", + "name": "CVE-2022-49013", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix memory leak in sctp_stream_outq_migrate()\n\nWhen sctp_stream_outq_migrate() is called to release stream out resources,\nthe memory pointed to by prio_head in stream out is not released.\n\nThe memory leak information is as follows:\n unreferenced object 0xffff88801fe79f80 (size 64):\n comm \"sctp_repo\", pid 7957, jiffies 4294951704 (age 36.480s)\n hex dump (first 32 bytes):\n 80 9f e7 1f 80 88 ff ff 80 9f e7 1f 80 88 ff ff ................\n 90 9f e7 1f 80 88 ff ff 90 9f e7 1f 80 88 ff ff ................\n backtrace:\n [] kmalloc_trace+0x26/0x60\n [] sctp_sched_prio_set+0x4cc/0x770\n [] sctp_stream_init_ext+0xd2/0x1b0\n [] sctp_sendmsg_to_asoc+0x1614/0x1a30\n [] sctp_sendmsg+0xda1/0x1ef0\n [] inet_sendmsg+0x9d/0xe0\n [] sock_sendmsg+0xd3/0x120\n [] __sys_sendto+0x23a/0x340\n [] __x64_sys_sendto+0xe1/0x1b0\n [] do_syscall_64+0x39/0xb0\n [] entry_SYSCALL_64_after_hwframe+0x63/0xcd", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49013" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--7aba5471-8d6e-4c16-bafd-4cbc8e579bdf.json b/objects/vulnerability/vulnerability--7aba5471-8d6e-4c16-bafd-4cbc8e579bdf.json new file mode 100644 index 00000000000..5881849dfa4 --- /dev/null +++ b/objects/vulnerability/vulnerability--7aba5471-8d6e-4c16-bafd-4cbc8e579bdf.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2868f31a-2381-4556-af42-7a9412d8cb82", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--7aba5471-8d6e-4c16-bafd-4cbc8e579bdf", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.694397Z", + "modified": "2024-10-22T00:37:10.694397Z", + "name": "CVE-2024-10196", + "description": "A vulnerability was found in code-projects Pharmacy Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /add_new_invoice.php. The manipulation of the argument text leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-10196" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--7adc1202-84d9-472b-8082-1aa140572701.json b/objects/vulnerability/vulnerability--7adc1202-84d9-472b-8082-1aa140572701.json new file mode 100644 index 00000000000..c1f29552e5e --- /dev/null +++ b/objects/vulnerability/vulnerability--7adc1202-84d9-472b-8082-1aa140572701.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2a665e8d-95a8-4248-8a7f-9c8c772c8073", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--7adc1202-84d9-472b-8082-1aa140572701", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.638523Z", + "modified": "2024-10-22T00:37:16.638523Z", + "name": "CVE-2022-48980", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing()\n\nThe SJA1105 family has 45 L2 policing table entries\n(SJA1105_MAX_L2_POLICING_COUNT) and SJA1110 has 110\n(SJA1110_MAX_L2_POLICING_COUNT). Keeping the table structure but\naccounting for the difference in port count (5 in SJA1105 vs 10 in\nSJA1110) does not fully explain the difference. Rather, the SJA1110 also\nhas L2 ingress policers for multicast traffic. If a packet is classified\nas multicast, it will be processed by the policer index 99 + SRCPORT.\n\nThe sja1105_init_l2_policing() function initializes all L2 policers such\nthat they don't interfere with normal packet reception by default. To have\na common code between SJA1105 and SJA1110, the index of the multicast\npolicer for the port is calculated because it's an index that is out of\nbounds for SJA1105 but in bounds for SJA1110, and a bounds check is\nperformed.\n\nThe code fails to do the proper thing when determining what to do with the\nmulticast policer of port 0 on SJA1105 (ds->num_ports = 5). The \"mcast\"\nindex will be equal to 45, which is also equal to\ntable->ops->max_entry_count (SJA1105_MAX_L2_POLICING_COUNT). So it passes\nthrough the check. But at the same time, SJA1105 doesn't have multicast\npolicers. So the code programs the SHARINDX field of an out-of-bounds\nelement in the L2 Policing table of the static config.\n\nThe comparison between index 45 and 45 entries should have determined the\ncode to not access this policer index on SJA1105, since its memory wasn't\neven allocated.\n\nWith enough bad luck, the out-of-bounds write could even overwrite other\nvalid kernel data, but in this case, the issue was detected using KASAN.\n\nKernel log:\n\nsja1105 spi5.0: Probed switch chip: SJA1105Q\n==================================================================\nBUG: KASAN: slab-out-of-bounds in sja1105_setup+0x1cbc/0x2340\nWrite of size 8 at addr ffffff880bd57708 by task kworker/u8:0/8\n...\nWorkqueue: events_unbound deferred_probe_work_func\nCall trace:\n...\nsja1105_setup+0x1cbc/0x2340\ndsa_register_switch+0x1284/0x18d0\nsja1105_probe+0x748/0x840\n...\nAllocated by task 8:\n...\nsja1105_setup+0x1bcc/0x2340\ndsa_register_switch+0x1284/0x18d0\nsja1105_probe+0x748/0x840\n...", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48980" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--7d014b2b-28f0-49aa-b458-dfdd5eed1c3c.json b/objects/vulnerability/vulnerability--7d014b2b-28f0-49aa-b458-dfdd5eed1c3c.json new file mode 100644 index 00000000000..52cf3b931f7 --- /dev/null +++ b/objects/vulnerability/vulnerability--7d014b2b-28f0-49aa-b458-dfdd5eed1c3c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0b4fd759-ce8e-4dde-abc4-474b8de47abe", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--7d014b2b-28f0-49aa-b458-dfdd5eed1c3c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.966498Z", + "modified": "2024-10-22T00:37:10.966498Z", + "name": "CVE-2024-50025", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fnic: Move flush_work initialization out of if block\n\nAfter commit 379a58caa199 (\"scsi: fnic: Move fnic_fnic_flush_tx() to a\nwork queue\"), it can happen that a work item is sent to an uninitialized\nwork queue. This may has the effect that the item being queued is never\nactually queued, and any further actions depending on it will not\nproceed.\n\nThe following warning is observed while the fnic driver is loaded:\n\nkernel: WARNING: CPU: 11 PID: 0 at ../kernel/workqueue.c:1524 __queue_work+0x373/0x410\nkernel: \nkernel: queue_work_on+0x3a/0x50\nkernel: fnic_wq_copy_cmpl_handler+0x54a/0x730 [fnic 62fbff0c42e7fb825c60a55cde2fb91facb2ed24]\nkernel: fnic_isr_msix_wq_copy+0x2d/0x60 [fnic 62fbff0c42e7fb825c60a55cde2fb91facb2ed24]\nkernel: __handle_irq_event_percpu+0x36/0x1a0\nkernel: handle_irq_event_percpu+0x30/0x70\nkernel: handle_irq_event+0x34/0x60\nkernel: handle_edge_irq+0x7e/0x1a0\nkernel: __common_interrupt+0x3b/0xb0\nkernel: common_interrupt+0x58/0xa0\nkernel: \n\nIt has been observed that this may break the rediscovery of Fibre\nChannel devices after a temporary fabric failure.\n\nThis patch fixes it by moving the work queue initialization out of\nan if block in fnic_probe().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50025" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--7ea5eb44-6f69-490c-9204-5f95556a3a2c.json b/objects/vulnerability/vulnerability--7ea5eb44-6f69-490c-9204-5f95556a3a2c.json new file mode 100644 index 00000000000..689edb8e7d8 --- /dev/null +++ b/objects/vulnerability/vulnerability--7ea5eb44-6f69-490c-9204-5f95556a3a2c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5f158785-d27b-43a1-8a92-02af7677509a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--7ea5eb44-6f69-490c-9204-5f95556a3a2c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.991526Z", + "modified": "2024-10-22T00:37:10.991526Z", + "name": "CVE-2024-50062", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Avoid null pointer deref during path establishment\n\nFor RTRS path establishment, RTRS client initiates and completes con_num\nof connections. After establishing all its connections, the information\nis exchanged between the client and server through the info_req message.\nDuring this exchange, it is essential that all connections have been\nestablished, and the state of the RTRS srv path is CONNECTED.\n\nSo add these sanity checks, to make sure we detect and abort process in\nerror scenarios to avoid null pointer deref.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50062" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--80b6cd45-4fe8-4c45-85e7-4d6d2483614b.json b/objects/vulnerability/vulnerability--80b6cd45-4fe8-4c45-85e7-4d6d2483614b.json new file mode 100644 index 00000000000..55fd41075a5 --- /dev/null +++ b/objects/vulnerability/vulnerability--80b6cd45-4fe8-4c45-85e7-4d6d2483614b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--bbdf4557-e106-4e5b-9d72-c4049324eeac", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--80b6cd45-4fe8-4c45-85e7-4d6d2483614b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.183723Z", + "modified": "2024-10-22T00:37:12.183723Z", + "name": "CVE-2024-49980", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvrf: revert \"vrf: Remove unnecessary RCU-bh critical section\"\n\nThis reverts commit 504fc6f4f7f681d2a03aa5f68aad549d90eab853.\n\ndev_queue_xmit_nit is expected to be called with BH disabled.\n__dev_queue_xmit has the following:\n\n /* Disable soft irqs for various locks below. Also\n * stops preemption for RCU.\n */\n rcu_read_lock_bh();\n\nVRF must follow this invariant. The referenced commit removed this\nprotection. Which triggered a lockdep warning:\n\n\t================================\n\tWARNING: inconsistent lock state\n\t6.11.0 #1 Tainted: G W\n\t--------------------------------\n\tinconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.\n\tbtserver/134819 [HC0[0]:SC0[0]:HE1:SE1] takes:\n\tffff8882da30c118 (rlock-AF_PACKET){+.?.}-{2:2}, at: tpacket_rcv+0x863/0x3b30\n\t{IN-SOFTIRQ-W} state was registered at:\n\t lock_acquire+0x19a/0x4f0\n\t _raw_spin_lock+0x27/0x40\n\t packet_rcv+0xa33/0x1320\n\t __netif_receive_skb_core.constprop.0+0xcb0/0x3a90\n\t __netif_receive_skb_list_core+0x2c9/0x890\n\t netif_receive_skb_list_internal+0x610/0xcc0\n [...]\n\n\tother info that might help us debug this:\n\t Possible unsafe locking scenario:\n\n\t CPU0\n\t ----\n\t lock(rlock-AF_PACKET);\n\t \n\t lock(rlock-AF_PACKET);\n\n\t *** DEADLOCK ***\n\n\tCall Trace:\n\t \n\t dump_stack_lvl+0x73/0xa0\n\t mark_lock+0x102e/0x16b0\n\t __lock_acquire+0x9ae/0x6170\n\t lock_acquire+0x19a/0x4f0\n\t _raw_spin_lock+0x27/0x40\n\t tpacket_rcv+0x863/0x3b30\n\t dev_queue_xmit_nit+0x709/0xa40\n\t vrf_finish_direct+0x26e/0x340 [vrf]\n\t vrf_l3_out+0x5f4/0xe80 [vrf]\n\t __ip_local_out+0x51e/0x7a0\n [...]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49980" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--80bc4bc7-76bc-4f10-a4f1-3739f89737eb.json b/objects/vulnerability/vulnerability--80bc4bc7-76bc-4f10-a4f1-3739f89737eb.json new file mode 100644 index 00000000000..a3ef02191da --- /dev/null +++ b/objects/vulnerability/vulnerability--80bc4bc7-76bc-4f10-a4f1-3739f89737eb.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d31174dc-04f6-48c5-8657-aff542267dc5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--80bc4bc7-76bc-4f10-a4f1-3739f89737eb", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.843868Z", + "modified": "2024-10-22T00:37:10.843868Z", + "name": "CVE-2024-47705", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix potential invalid pointer dereference in blk_add_partition\n\nThe blk_add_partition() function initially used a single if-condition\n(IS_ERR(part)) to check for errors when adding a partition. This was\nmodified to handle the specific case of -ENXIO separately, allowing the\nfunction to proceed without logging the error in this case. However,\nthis change unintentionally left a path where md_autodetect_dev()\ncould be called without confirming that part is a valid pointer.\n\nThis commit separates the error handling logic by splitting the\ninitial if-condition, improving code readability and handling specific\nerror scenarios explicitly. The function now distinguishes the general\nerror case from -ENXIO without altering the existing behavior of\nmd_autodetect_dev() calls.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47705" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--80c8ab4c-41fa-41a1-94f1-54c902ba8352.json b/objects/vulnerability/vulnerability--80c8ab4c-41fa-41a1-94f1-54c902ba8352.json new file mode 100644 index 00000000000..c841d2b9715 --- /dev/null +++ b/objects/vulnerability/vulnerability--80c8ab4c-41fa-41a1-94f1-54c902ba8352.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0c37750b-1a41-48f5-a8eb-7159a1e6cd61", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--80c8ab4c-41fa-41a1-94f1-54c902ba8352", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.627515Z", + "modified": "2024-10-22T00:37:11.627515Z", + "name": "CVE-2024-40086", + "description": "A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via a password field larger than 64 bytes in length.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-40086" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--81a7f0ac-db7f-4b49-bab8-73fee6537377.json b/objects/vulnerability/vulnerability--81a7f0ac-db7f-4b49-bab8-73fee6537377.json new file mode 100644 index 00000000000..3ca3194462d --- /dev/null +++ b/objects/vulnerability/vulnerability--81a7f0ac-db7f-4b49-bab8-73fee6537377.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9082d378-4283-4246-a395-7d13f32c203b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--81a7f0ac-db7f-4b49-bab8-73fee6537377", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.661677Z", + "modified": "2024-10-22T00:37:16.661677Z", + "name": "CVE-2022-48998", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/bpf/32: Fix Oops on tail call tests\n\ntest_bpf tail call tests end up as:\n\n test_bpf: #0 Tail call leaf jited:1 85 PASS\n test_bpf: #1 Tail call 2 jited:1 111 PASS\n test_bpf: #2 Tail call 3 jited:1 145 PASS\n test_bpf: #3 Tail call 4 jited:1 170 PASS\n test_bpf: #4 Tail call load/store leaf jited:1 190 PASS\n test_bpf: #5 Tail call load/store jited:1\n BUG: Unable to handle kernel data access on write at 0xf1b4e000\n Faulting instruction address: 0xbe86b710\n Oops: Kernel access of bad area, sig: 11 [#1]\n BE PAGE_SIZE=4K MMU=Hash PowerMac\n Modules linked in: test_bpf(+)\n CPU: 0 PID: 97 Comm: insmod Not tainted 6.1.0-rc4+ #195\n Hardware name: PowerMac3,1 750CL 0x87210 PowerMac\n NIP: be86b710 LR: be857e88 CTR: be86b704\n REGS: f1b4df20 TRAP: 0300 Not tainted (6.1.0-rc4+)\n MSR: 00009032 CR: 28008242 XER: 00000000\n DAR: f1b4e000 DSISR: 42000000\n GPR00: 00000001 f1b4dfe0 c11d2280 00000000 00000000 00000000 00000002 00000000\n GPR08: f1b4e000 be86b704 f1b4e000 00000000 00000000 100d816a f2440000 fe73baa8\n GPR16: f2458000 00000000 c1941ae4 f1fe2248 00000045 c0de0000 f2458030 00000000\n GPR24: 000003e8 0000000f f2458000 f1b4dc90 3e584b46 00000000 f24466a0 c1941a00\n NIP [be86b710] 0xbe86b710\n LR [be857e88] __run_one+0xec/0x264 [test_bpf]\n Call Trace:\n [f1b4dfe0] [00000002] 0x2 (unreliable)\n Instruction dump:\n XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n ---[ end trace 0000000000000000 ]---\n\nThis is a tentative to write above the stack. The problem is encoutered\nwith tests added by commit 38608ee7b690 (\"bpf, tests: Add load store\ntest case for tail call\")\n\nThis happens because tail call is done to a BPF prog with a different\nstack_depth. At the time being, the stack is kept as is when the caller\ntail calls its callee. But at exit, the callee restores the stack based\non its own properties. Therefore here, at each run, r1 is erroneously\nincreased by 32 - 16 = 16 bytes.\n\nThis was done that way in order to pass the tail call count from caller\nto callee through the stack. As powerpc32 doesn't have a red zone in\nthe stack, it was necessary the maintain the stack as is for the tail\ncall. But it was not anticipated that the BPF frame size could be\ndifferent.\n\nLet's take a new approach. Use register r4 to carry the tail call count\nduring the tail call, and save it into the stack at function entry if\nrequired. This means the input parameter must be in r3, which is more\ncorrect as it is a 32 bits parameter, then tail call better match with\nnormal BPF function entry, the down side being that we move that input\nparameter back and forth between r3 and r4. That can be optimised later.\n\nDoing that also has the advantage of maximising the common parts between\ntail calls and a normal function exit.\n\nWith the fix, tail call tests are now successfull:\n\n test_bpf: #0 Tail call leaf jited:1 53 PASS\n test_bpf: #1 Tail call 2 jited:1 115 PASS\n test_bpf: #2 Tail call 3 jited:1 154 PASS\n test_bpf: #3 Tail call 4 jited:1 165 PASS\n test_bpf: #4 Tail call load/store leaf jited:1 101 PASS\n test_bpf: #5 Tail call load/store jited:1 141 PASS\n test_bpf: #6 Tail call error path, max count reached jited:1 994 PASS\n test_bpf: #7 Tail call count preserved across function calls jited:1 140975 PASS\n test_bpf: #8 Tail call error path, NULL target jited:1 110 PASS\n test_bpf: #9 Tail call error path, index out of range jited:1 69 PASS\n test_bpf: test_tail_calls: Summary: 10 PASSED, 0 FAILED, [10/10 JIT'ed]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48998" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--81f4da30-e407-49ba-ac72-315f2d8fe780.json b/objects/vulnerability/vulnerability--81f4da30-e407-49ba-ac72-315f2d8fe780.json new file mode 100644 index 00000000000..97b895ba486 --- /dev/null +++ b/objects/vulnerability/vulnerability--81f4da30-e407-49ba-ac72-315f2d8fe780.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3e762235-42b1-4d95-8471-fb39058d0ec7", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--81f4da30-e407-49ba-ac72-315f2d8fe780", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.699012Z", + "modified": "2024-10-22T00:37:10.699012Z", + "name": "CVE-2024-10125", + "description": "The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcore#validatetokensignature contains Middleware that can be used in conjunction with the Application Load Balancer (ALB) OpenId Connect integration and can be used in any ASP.NET http://asp.net/ Core deployment scenario, including Fargate, EKS, ECS, EC2, and Lambda. In the JWT handling code, it performs signature validation but fails to validate the JWT issuer and signer identity. The signer omission, if combined with a scenario where the infrastructure owner allows internet traffic to the ALB targets (not a recommended configuration), can allow for JWT signing by an untrusted entity and an actor may be able to mimic valid OIDC-federated sessions to the ALB targets.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-10125" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8214af54-18a2-4832-9bdd-3e3d7962e473.json b/objects/vulnerability/vulnerability--8214af54-18a2-4832-9bdd-3e3d7962e473.json new file mode 100644 index 00000000000..01deb43d80f --- /dev/null +++ b/objects/vulnerability/vulnerability--8214af54-18a2-4832-9bdd-3e3d7962e473.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--51441a19-0d48-4b13-847b-f10f690bbd9a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8214af54-18a2-4832-9bdd-3e3d7962e473", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.683363Z", + "modified": "2024-10-22T00:37:16.683363Z", + "name": "CVE-2022-48989", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfscache: Fix oops due to race with cookie_lru and use_cookie\n\nIf a cookie expires from the LRU and the LRU_DISCARD flag is set, but\nthe state machine has not run yet, it's possible another thread can call\nfscache_use_cookie and begin to use it.\n\nWhen the cookie_worker finally runs, it will see the LRU_DISCARD flag\nset, transition the cookie->state to LRU_DISCARDING, which will then\nwithdraw the cookie. Once the cookie is withdrawn the object is removed\nthe below oops will occur because the object associated with the cookie\nis now NULL.\n\nFix the oops by clearing the LRU_DISCARD bit if another thread uses the\ncookie before the cookie_worker runs.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n ...\n CPU: 31 PID: 44773 Comm: kworker/u130:1 Tainted: G E 6.0.0-5.dneg.x86_64 #1\n Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022\n Workqueue: events_unbound netfs_rreq_write_to_cache_work [netfs]\n RIP: 0010:cachefiles_prepare_write+0x28/0x90 [cachefiles]\n ...\n Call Trace:\n netfs_rreq_write_to_cache_work+0x11c/0x320 [netfs]\n process_one_work+0x217/0x3e0\n worker_thread+0x4a/0x3b0\n kthread+0xd6/0x100", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48989" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--829ac3e6-f004-462b-bde7-8aa7d4ead29c.json b/objects/vulnerability/vulnerability--829ac3e6-f004-462b-bde7-8aa7d4ead29c.json new file mode 100644 index 00000000000..f52bde2f1b3 --- /dev/null +++ b/objects/vulnerability/vulnerability--829ac3e6-f004-462b-bde7-8aa7d4ead29c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2603b67d-2483-40cc-8251-abc3691394ea", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--829ac3e6-f004-462b-bde7-8aa7d4ead29c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.740786Z", + "modified": "2024-10-22T00:37:11.740786Z", + "name": "CVE-2024-41714", + "description": "A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges within the context of the system.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-41714" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--83d47618-0e1b-42d7-a3b1-81d0c6dc08ad.json b/objects/vulnerability/vulnerability--83d47618-0e1b-42d7-a3b1-81d0c6dc08ad.json new file mode 100644 index 00000000000..8dc7835f89f --- /dev/null +++ b/objects/vulnerability/vulnerability--83d47618-0e1b-42d7-a3b1-81d0c6dc08ad.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3b302923-7d28-43ec-a68c-c8e3905d8568", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--83d47618-0e1b-42d7-a3b1-81d0c6dc08ad", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.844992Z", + "modified": "2024-10-22T00:37:10.844992Z", + "name": "CVE-2024-47690", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: get rid of online repaire on corrupted directory\n\nsyzbot reports a f2fs bug as below:\n\nkernel BUG at fs/f2fs/inode.c:896!\nRIP: 0010:f2fs_evict_inode+0x1598/0x15c0 fs/f2fs/inode.c:896\nCall Trace:\n evict+0x532/0x950 fs/inode.c:704\n dispose_list fs/inode.c:747 [inline]\n evict_inodes+0x5f9/0x690 fs/inode.c:797\n generic_shutdown_super+0x9d/0x2d0 fs/super.c:627\n kill_block_super+0x44/0x90 fs/super.c:1696\n kill_f2fs_super+0x344/0x690 fs/f2fs/super.c:4898\n deactivate_locked_super+0xc4/0x130 fs/super.c:473\n cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373\n task_work_run+0x24f/0x310 kernel/task_work.c:228\n ptrace_notify+0x2d2/0x380 kernel/signal.c:2402\n ptrace_report_syscall include/linux/ptrace.h:415 [inline]\n ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]\n syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173\n syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]\n syscall_exit_to_user_mode+0x279/0x370 kernel/entry/common.c:218\n do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0010:f2fs_evict_inode+0x1598/0x15c0 fs/f2fs/inode.c:896\n\nOnline repaire on corrupted directory in f2fs_lookup() can generate\ndirty data/meta while racing w/ readonly remount, it may leave dirty\ninode after filesystem becomes readonly, however, checkpoint() will\nskips flushing dirty inode in a state of readonly mode, result in\nabove panic.\n\nLet's get rid of online repaire in f2fs_lookup(), and leave the work\nto fsck.f2fs.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47690" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--842fefb1-4305-4d34-8531-931efd33bbab.json b/objects/vulnerability/vulnerability--842fefb1-4305-4d34-8531-931efd33bbab.json new file mode 100644 index 00000000000..a4b36aca0de --- /dev/null +++ b/objects/vulnerability/vulnerability--842fefb1-4305-4d34-8531-931efd33bbab.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0511a631-6abb-49a6-b28f-2e92482b08c3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--842fefb1-4305-4d34-8531-931efd33bbab", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.530771Z", + "modified": "2024-10-22T00:37:10.530771Z", + "name": "CVE-2024-48645", + "description": "In Minecraft mod \"Command Block IDE\" up to and including version 0.4.9, a missing authorization (CWE-862) allows any user to modify \"function\" files used by the game when installed on a dedicated server.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-48645" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--846cb5a8-243f-4984-b50c-0f10912341f9.json b/objects/vulnerability/vulnerability--846cb5a8-243f-4984-b50c-0f10912341f9.json new file mode 100644 index 00000000000..09c40ea52c4 --- /dev/null +++ b/objects/vulnerability/vulnerability--846cb5a8-243f-4984-b50c-0f10912341f9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--7edd9060-d7d6-4109-9406-fdf3e38ad6c5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--846cb5a8-243f-4984-b50c-0f10912341f9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.162753Z", + "modified": "2024-10-22T00:37:12.162753Z", + "name": "CVE-2024-49901", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs\n\nThere are some cases, such as the one uncovered by Commit 46d4efcccc68\n(\"drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails\")\nwhere\n\nmsm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL);\n\nis called on gpu->pdev == NULL, as the GPU device has not been fully\ninitialized yet.\n\nTurns out that there's more than just the aforementioned path that\ncauses this to happen (e.g. the case when there's speedbin data in the\ncatalog, but opp-supported-hw is missing in DT).\n\nAssigning msm_gpu->pdev earlier seems like the least painful solution\nto this, therefore do so.\n\nPatchwork: https://patchwork.freedesktop.org/patch/602742/", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49901" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--850f2554-cd0b-44a3-b847-ab15b942d025.json b/objects/vulnerability/vulnerability--850f2554-cd0b-44a3-b847-ab15b942d025.json new file mode 100644 index 00000000000..b1857f6d44e --- /dev/null +++ b/objects/vulnerability/vulnerability--850f2554-cd0b-44a3-b847-ab15b942d025.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--fbff84df-5ce6-42b1-bd7d-00b7bc3db5a3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--850f2554-cd0b-44a3-b847-ab15b942d025", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.169398Z", + "modified": "2024-10-22T00:37:12.169398Z", + "name": "CVE-2024-49869", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: send: fix buffer overflow detection when copying path to cache entry\n\nStarting with commit c0247d289e73 (\"btrfs: send: annotate struct\nname_cache_entry with __counted_by()\") we annotated the variable length\narray \"name\" from the name_cache_entry structure with __counted_by() to\nimprove overflow detection. However that alone was not correct, because\nthe length of that array does not match the \"name_len\" field - it matches\nthat plus 1 to include the NUL string terminator, so that makes a\nfortified kernel think there's an overflow and report a splat like this:\n\n strcpy: detected buffer overflow: 20 byte write of buffer size 19\n WARNING: CPU: 3 PID: 3310 at __fortify_report+0x45/0x50\n CPU: 3 UID: 0 PID: 3310 Comm: btrfs Not tainted 6.11.0-prnet #1\n Hardware name: CompuLab Ltd. sbc-ihsw/Intense-PC2 (IPC2), BIOS IPC2_3.330.7 X64 03/15/2018\n RIP: 0010:__fortify_report+0x45/0x50\n Code: 48 8b 34 (...)\n RSP: 0018:ffff97ebc0d6f650 EFLAGS: 00010246\n RAX: 7749924ef60fa600 RBX: ffff8bf5446a521a RCX: 0000000000000027\n RDX: 00000000ffffdfff RSI: ffff97ebc0d6f548 RDI: ffff8bf84e7a1cc8\n RBP: ffff8bf548574080 R08: ffffffffa8c40e10 R09: 0000000000005ffd\n R10: 0000000000000004 R11: ffffffffa8c70e10 R12: ffff8bf551eef400\n R13: 0000000000000000 R14: 0000000000000013 R15: 00000000000003a8\n FS: 00007fae144de8c0(0000) GS:ffff8bf84e780000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fae14691690 CR3: 00000001027a2003 CR4: 00000000001706f0\n Call Trace:\n \n ? __warn+0x12a/0x1d0\n ? __fortify_report+0x45/0x50\n ? report_bug+0x154/0x1c0\n ? handle_bug+0x42/0x70\n ? exc_invalid_op+0x1a/0x50\n ? asm_exc_invalid_op+0x1a/0x20\n ? __fortify_report+0x45/0x50\n __fortify_panic+0x9/0x10\n __get_cur_name_and_parent+0x3bc/0x3c0\n get_cur_path+0x207/0x3b0\n send_extent_data+0x709/0x10d0\n ? find_parent_nodes+0x22df/0x25d0\n ? mas_nomem+0x13/0x90\n ? mtree_insert_range+0xa5/0x110\n ? btrfs_lru_cache_store+0x5f/0x1e0\n ? iterate_extent_inodes+0x52d/0x5a0\n process_extent+0xa96/0x11a0\n ? __pfx_lookup_backref_cache+0x10/0x10\n ? __pfx_store_backref_cache+0x10/0x10\n ? __pfx_iterate_backrefs+0x10/0x10\n ? __pfx_check_extent_item+0x10/0x10\n changed_cb+0x6fa/0x930\n ? tree_advance+0x362/0x390\n ? memcmp_extent_buffer+0xd7/0x160\n send_subvol+0xf0a/0x1520\n btrfs_ioctl_send+0x106b/0x11d0\n ? __pfx___clone_root_cmp_sort+0x10/0x10\n _btrfs_ioctl_send+0x1ac/0x240\n btrfs_ioctl+0x75b/0x850\n __se_sys_ioctl+0xca/0x150\n do_syscall_64+0x85/0x160\n ? __count_memcg_events+0x69/0x100\n ? handle_mm_fault+0x1327/0x15c0\n ? __se_sys_rt_sigprocmask+0xf1/0x180\n ? syscall_exit_to_user_mode+0x75/0xa0\n ? do_syscall_64+0x91/0x160\n ? do_user_addr_fault+0x21d/0x630\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7fae145eeb4f\n Code: 00 48 89 (...)\n RSP: 002b:00007ffdf1cb09b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fae145eeb4f\n RDX: 00007ffdf1cb0ad0 RSI: 0000000040489426 RDI: 0000000000000004\n RBP: 00000000000078fe R08: 00007fae144006c0 R09: 00007ffdf1cb0927\n R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffdf1cb1ce8\n R13: 0000000000000003 R14: 000055c499fab2e0 R15: 0000000000000004\n \n\nFix this by not storing the NUL string terminator since we don't actually\nneed it for name cache entries, this way \"name_len\" corresponds to the\nactual size of the \"name\" array. This requires marking the \"name\" array\nfield with __nonstring and using memcpy() instead of strcpy() as\nrecommended by the guidelines at:\n\n https://github.com/KSPP/linux/issues/90", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49869" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8547b687-6bc2-4673-aacf-7ad514a50446.json b/objects/vulnerability/vulnerability--8547b687-6bc2-4673-aacf-7ad514a50446.json new file mode 100644 index 00000000000..0a8541cf49c --- /dev/null +++ b/objects/vulnerability/vulnerability--8547b687-6bc2-4673-aacf-7ad514a50446.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--bc2e4299-5ed7-4989-b526-7cfa885cbb40", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8547b687-6bc2-4673-aacf-7ad514a50446", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.959512Z", + "modified": "2024-10-22T00:37:17.959512Z", + "name": "CVE-2022-49017", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: re-fetch skb cb after tipc_msg_validate\n\nAs the call trace shows, the original skb was freed in tipc_msg_validate(),\nand dereferencing the old skb cb would cause an use-after-free crash.\n\n BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]\n Call Trace:\n \n tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]\n tipc_crypto_rcv+0xd32/0x1ec0 [tipc]\n tipc_rcv+0x744/0x1150 [tipc]\n ...\n Allocated by task 47078:\n kmem_cache_alloc_node+0x158/0x4d0\n __alloc_skb+0x1c1/0x270\n tipc_buf_acquire+0x1e/0xe0 [tipc]\n tipc_msg_create+0x33/0x1c0 [tipc]\n tipc_link_build_proto_msg+0x38a/0x2100 [tipc]\n tipc_link_timeout+0x8b8/0xef0 [tipc]\n tipc_node_timeout+0x2a1/0x960 [tipc]\n call_timer_fn+0x2d/0x1c0\n ...\n Freed by task 47078:\n tipc_msg_validate+0x7b/0x440 [tipc]\n tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc]\n tipc_crypto_rcv+0xd32/0x1ec0 [tipc]\n tipc_rcv+0x744/0x1150 [tipc]\n\nThis patch fixes it by re-fetching the skb cb from the new allocated skb\nafter calling tipc_msg_validate().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49017" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8573befb-1bf0-44df-be2d-bded72e0652d.json b/objects/vulnerability/vulnerability--8573befb-1bf0-44df-be2d-bded72e0652d.json new file mode 100644 index 00000000000..b20189e8326 --- /dev/null +++ b/objects/vulnerability/vulnerability--8573befb-1bf0-44df-be2d-bded72e0652d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3a62d511-23c2-49f7-8228-495123077214", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8573befb-1bf0-44df-be2d-bded72e0652d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.140245Z", + "modified": "2024-10-22T00:37:12.140245Z", + "name": "CVE-2024-49937", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Set correct chandef when starting CAC\n\nWhen starting CAC in a mode other than AP mode, it return a\n\"WARNING: CPU: 0 PID: 63 at cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\"\ncaused by the chandef.chan being null at the end of CAC.\n\nSolution: Ensure the channel definition is set for the different modes\nwhen starting CAC to avoid getting a NULL 'chan' at the end of CAC.\n\n Call Trace:\n ? show_regs.part.0+0x14/0x16\n ? __warn+0x67/0xc0\n ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n ? report_bug+0xa7/0x130\n ? exc_overflow+0x30/0x30\n ? handle_bug+0x27/0x50\n ? exc_invalid_op+0x18/0x60\n ? handle_exception+0xf6/0xf6\n ? exc_overflow+0x30/0x30\n ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n ? exc_overflow+0x30/0x30\n ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n ? regulatory_propagate_dfs_state.cold+0x1b/0x4c [cfg80211]\n ? cfg80211_propagate_cac_done_wk+0x1a/0x30 [cfg80211]\n ? process_one_work+0x165/0x280\n ? worker_thread+0x120/0x3f0\n ? kthread+0xc2/0xf0\n ? process_one_work+0x280/0x280\n ? kthread_complete_and_exit+0x20/0x20\n ? ret_from_fork+0x19/0x24\n\n[shorten subject, remove OCB, reorder cases to match previous list]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49937" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--85cb8c91-daf0-4685-a85b-c7dcac69d974.json b/objects/vulnerability/vulnerability--85cb8c91-daf0-4685-a85b-c7dcac69d974.json new file mode 100644 index 00000000000..4f7f24b3fbb --- /dev/null +++ b/objects/vulnerability/vulnerability--85cb8c91-daf0-4685-a85b-c7dcac69d974.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--35c32486-db8f-45bb-b4a8-f2a842c4fb24", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--85cb8c91-daf0-4685-a85b-c7dcac69d974", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.019163Z", + "modified": "2024-10-22T00:37:11.019163Z", + "name": "CVE-2024-50030", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/ct: prevent UAF in send_recv()\n\nEnsure we serialize with completion side to prevent UAF with fence going\nout of scope on the stack, since we have no clue if it will fire after\nthe timeout before we can erase from the xa. Also we have some dependent\nloads and stores for which we need the correct ordering, and we lack the\nneeded barriers. Fix this by grabbing the ct->lock after the wait, which\nis also held by the completion side.\n\nv2 (Badal):\n - Also print done after acquiring the lock and seeing timeout.\n\n(cherry picked from commit 52789ce35c55ccd30c4b67b9cc5b2af55e0122ea)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50030" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--863ecce4-4127-4c65-9747-07a1409d4d32.json b/objects/vulnerability/vulnerability--863ecce4-4127-4c65-9747-07a1409d4d32.json new file mode 100644 index 00000000000..e03d48c9b29 --- /dev/null +++ b/objects/vulnerability/vulnerability--863ecce4-4127-4c65-9747-07a1409d4d32.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b25c1275-fd1c-40a0-a69e-7f11e05d50c8", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--863ecce4-4127-4c65-9747-07a1409d4d32", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.982684Z", + "modified": "2024-10-22T00:37:10.982684Z", + "name": "CVE-2024-50039", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: accept TCA_STAB only for root qdisc\n\nMost qdiscs maintain their backlog using qdisc_pkt_len(skb)\non the assumption it is invariant between the enqueue()\nand dequeue() handlers.\n\nUnfortunately syzbot can crash a host rather easily using\na TBF + SFQ combination, with an STAB on SFQ [1]\n\nWe can't support TCA_STAB on arbitrary level, this would\nrequire to maintain per-qdisc storage.\n\n[1]\n[ 88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 88.798611] #PF: supervisor read access in kernel mode\n[ 88.799014] #PF: error_code(0x0000) - not-present page\n[ 88.799506] PGD 0 P4D 0\n[ 88.799829] Oops: Oops: 0000 [#1] SMP NOPTI\n[ 88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117\n[ 88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq\n[ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00\nAll code\n========\n 0:\t0f b7 50 12 \tmovzwl 0x12(%rax),%edx\n 4:\t48 8d 04 d5 00 00 00 \tlea 0x0(,%rdx,8),%rax\n b:\t00\n c:\t48 89 d6 \tmov %rdx,%rsi\n f:\t48 29 d0 \tsub %rdx,%rax\n 12:\t48 8b 91 c0 01 00 00 \tmov 0x1c0(%rcx),%rdx\n 19:\t48 c1 e0 03 \tshl $0x3,%rax\n 1d:\t48 01 c2 \tadd %rax,%rdx\n 20:\t66 83 7a 1a 00 \tcmpw $0x0,0x1a(%rdx)\n 25:\t7e c0 \tjle 0xffffffffffffffe7\n 27:\t48 8b 3a \tmov (%rdx),%rdi\n 2a:*\t4c 8b 07 \tmov (%rdi),%r8\t\t<-- trapping instruction\n 2d:\t4c 89 02 \tmov %r8,(%rdx)\n 30:\t49 89 50 08 \tmov %rdx,0x8(%r8)\n 34:\t48 c7 47 08 00 00 00 \tmovq $0x0,0x8(%rdi)\n 3b:\t00\n 3c:\t48 \trex.W\n 3d:\tc7 \t.byte 0xc7\n 3e:\t07 \t(bad)\n\t...\n\nCode starting with the faulting instruction\n===========================================\n 0:\t4c 8b 07 \tmov (%rdi),%r8\n 3:\t4c 89 02 \tmov %r8,(%rdx)\n 6:\t49 89 50 08 \tmov %rdx,0x8(%r8)\n a:\t48 c7 47 08 00 00 00 \tmovq $0x0,0x8(%rdi)\n 11:\t00\n 12:\t48 \trex.W\n 13:\tc7 \t.byte 0xc7\n 14:\t07 \t(bad)\n\t...\n[ 88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206\n[ 88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800\n[ 88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000\n[ 88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f\n[ 88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140\n[ 88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac\n[ 88.806734] FS: 00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000\n[ 88.807225] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0\n[ 88.808165] Call Trace:\n[ 88.808459] \n[ 88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)\n[ 88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715)\n[ 88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539)\n[ 88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623)\n[ 88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq\n[ 88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq\n[ 88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_g\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50039" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--869131f1-bdab-4013-b13f-a9e3fbe4c7a0.json b/objects/vulnerability/vulnerability--869131f1-bdab-4013-b13f-a9e3fbe4c7a0.json new file mode 100644 index 00000000000..838552928ff --- /dev/null +++ b/objects/vulnerability/vulnerability--869131f1-bdab-4013-b13f-a9e3fbe4c7a0.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--24fc4169-0b05-43ed-8090-ae3d42b224b2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--869131f1-bdab-4013-b13f-a9e3fbe4c7a0", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.94573Z", + "modified": "2024-10-22T00:37:10.94573Z", + "name": "CVE-2024-47688", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: Fix a potential null-ptr-deref in module_add_driver()\n\nInject fault while probing of-fpga-region, if kasprintf() fails in\nmodule_add_driver(), the second sysfs_remove_link() in exit path will cause\nnull-ptr-deref as below because kernfs_name_hash() will call strlen() with\nNULL driver_name.\n\nFix it by releasing resources based on the exit path sequence.\n\n\t KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n\t Mem abort info:\n\t ESR = 0x0000000096000005\n\t EC = 0x25: DABT (current EL), IL = 32 bits\n\t SET = 0, FnV = 0\n\t EA = 0, S1PTW = 0\n\t FSC = 0x05: level 1 translation fault\n\t Data abort info:\n\t ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n\t CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n\t GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n\t [dfffffc000000000] address between user and kernel address ranges\n\t Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\n\t Dumping ftrace buffer:\n\t (ftrace buffer empty)\n\t Modules linked in: of_fpga_region(+) fpga_region fpga_bridge cfg80211 rfkill 8021q garp mrp stp llc ipv6 [last unloaded: of_fpga_region]\n\t CPU: 2 UID: 0 PID: 2036 Comm: modprobe Not tainted 6.11.0-rc2-g6a0e38264012 #295\n\t Hardware name: linux,dummy-virt (DT)\n\t pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n\t pc : strlen+0x24/0xb0\n\t lr : kernfs_name_hash+0x1c/0xc4\n\t sp : ffffffc081f97380\n\t x29: ffffffc081f97380 x28: ffffffc081f97b90 x27: ffffff80c821c2a0\n\t x26: ffffffedac0be418 x25: 0000000000000000 x24: ffffff80c09d2000\n\t x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000\n\t x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000001840\n\t x17: 0000000000000000 x16: 0000000000000000 x15: 1ffffff8103f2e42\n\t x14: 00000000f1f1f1f1 x13: 0000000000000004 x12: ffffffb01812d61d\n\t x11: 1ffffff01812d61c x10: ffffffb01812d61c x9 : dfffffc000000000\n\t x8 : 0000004fe7ed29e4 x7 : ffffff80c096b0e7 x6 : 0000000000000001\n\t x5 : ffffff80c096b0e0 x4 : 1ffffffdb990efa2 x3 : 0000000000000000\n\t x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000000\n\t Call trace:\n\t strlen+0x24/0xb0\n\t kernfs_name_hash+0x1c/0xc4\n\t kernfs_find_ns+0x118/0x2e8\n\t kernfs_remove_by_name_ns+0x80/0x100\n\t sysfs_remove_link+0x74/0xa8\n\t module_add_driver+0x278/0x394\n\t bus_add_driver+0x1f0/0x43c\n\t driver_register+0xf4/0x3c0\n\t __platform_driver_register+0x60/0x88\n\t of_fpga_region_init+0x20/0x1000 [of_fpga_region]\n\t do_one_initcall+0x110/0x788\n\t do_init_module+0x1dc/0x5c8\n\t load_module+0x3c38/0x4cac\n\t init_module_from_file+0xd4/0x128\n\t idempotent_init_module+0x2cc/0x528\n\t __arm64_sys_finit_module+0xac/0x100\n\t invoke_syscall+0x6c/0x258\n\t el0_svc_common.constprop.0+0x160/0x22c\n\t do_el0_svc+0x44/0x5c\n\t el0_svc+0x48/0xb8\n\t el0t_64_sync_handler+0x13c/0x158\n\t el0t_64_sync+0x190/0x194\n\t Code: f2fbffe1 a90157f4 12000802 aa0003f5 (38e16861)\n\t ---[ end trace 0000000000000000 ]---\n\t Kernel panic - not syncing: Oops: Fatal exception", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47688" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--86fc75db-3ff9-4c62-99f0-c924ecb5ecce.json b/objects/vulnerability/vulnerability--86fc75db-3ff9-4c62-99f0-c924ecb5ecce.json new file mode 100644 index 00000000000..8667ab6e24e --- /dev/null +++ b/objects/vulnerability/vulnerability--86fc75db-3ff9-4c62-99f0-c924ecb5ecce.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ff25df97-d636-48e7-8717-aa367b615c00", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--86fc75db-3ff9-4c62-99f0-c924ecb5ecce", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.174589Z", + "modified": "2024-10-22T00:37:12.174589Z", + "name": "CVE-2024-49979", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: fix tcp fraglist segmentation after pull from frag_list\n\nDetect tcp gso fraglist skbs with corrupted geometry (see below) and\npass these to skb_segment instead of skb_segment_list, as the first\ncan segment them correctly.\n\nValid SKB_GSO_FRAGLIST skbs\n- consist of two or more segments\n- the head_skb holds the protocol headers plus first gso_size\n- one or more frag_list skbs hold exactly one segment\n- all but the last must be gso_size\n\nOptional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can\nmodify these skbs, breaking these invariants.\n\nIn extreme cases they pull all data into skb linear. For TCP, this\ncauses a NULL ptr deref in __tcpv4_gso_segment_list_csum at\ntcp_hdr(seg->next).\n\nDetect invalid geometry due to pull, by checking head_skb size.\nDon't just drop, as this may blackhole a destination. Convert to be\nable to pass to regular skb_segment.\n\nApproach and description based on a patch by Willem de Bruijn.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49979" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--875e778c-00d5-44f4-bc86-2176e0af10ad.json b/objects/vulnerability/vulnerability--875e778c-00d5-44f4-bc86-2176e0af10ad.json new file mode 100644 index 00000000000..b96dcdb53aa --- /dev/null +++ b/objects/vulnerability/vulnerability--875e778c-00d5-44f4-bc86-2176e0af10ad.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ce82eca1-aba0-4530-9287-db2c1726d4bf", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--875e778c-00d5-44f4-bc86-2176e0af10ad", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.022323Z", + "modified": "2024-10-22T00:37:11.022323Z", + "name": "CVE-2024-50016", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid overflow assignment in link_dp_cts\n\nsampling_rate is an uint8_t but is assigned an unsigned int, and thus it\ncan overflow. As a result, sampling_rate is changed to uint32_t.\n\nSimilarly, LINK_QUAL_PATTERN_SET has a size of 2 bits, and it should\nonly be assigned to a value less or equal than 4.\n\nThis fixes 2 INTEGER_OVERFLOW issues reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50016" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--87671fae-b274-4ace-a58e-65ac909a51e1.json b/objects/vulnerability/vulnerability--87671fae-b274-4ace-a58e-65ac909a51e1.json new file mode 100644 index 00000000000..33774acb9d2 --- /dev/null +++ b/objects/vulnerability/vulnerability--87671fae-b274-4ace-a58e-65ac909a51e1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0279b8aa-acf9-4c61-b7c7-1c8a50e77f33", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--87671fae-b274-4ace-a58e-65ac909a51e1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.00056Z", + "modified": "2024-10-22T00:37:11.00056Z", + "name": "CVE-2024-50019", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkthread: unpark only parked kthread\n\nCalling into kthread unparking unconditionally is mostly harmless when\nthe kthread is already unparked. The wake up is then simply ignored\nbecause the target is not in TASK_PARKED state.\n\nHowever if the kthread is per CPU, the wake up is preceded by a call\nto kthread_bind() which expects the task to be inactive and in\nTASK_PARKED state, which obviously isn't the case if it is unparked.\n\nAs a result, calling kthread_stop() on an unparked per-cpu kthread\ntriggers such a warning:\n\n\tWARNING: CPU: 0 PID: 11 at kernel/kthread.c:525 __kthread_bind_mask kernel/kthread.c:525\n\t \n\t kthread_stop+0x17a/0x630 kernel/kthread.c:707\n\t destroy_workqueue+0x136/0xc40 kernel/workqueue.c:5810\n\t wg_destruct+0x1e2/0x2e0 drivers/net/wireguard/device.c:257\n\t netdev_run_todo+0xe1a/0x1000 net/core/dev.c:10693\n\t default_device_exit_batch+0xa14/0xa90 net/core/dev.c:11769\n\t ops_exit_list net/core/net_namespace.c:178 [inline]\n\t cleanup_net+0x89d/0xcc0 net/core/net_namespace.c:640\n\t process_one_work kernel/workqueue.c:3231 [inline]\n\t process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312\n\t worker_thread+0x86d/0xd70 kernel/workqueue.c:3393\n\t kthread+0x2f0/0x390 kernel/kthread.c:389\n\t ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n\t ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\t \n\nFix this with skipping unecessary unparking while stopping a kthread.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50019" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8782f1ab-dbec-43e8-8094-5f1e40c93286.json b/objects/vulnerability/vulnerability--8782f1ab-dbec-43e8-8094-5f1e40c93286.json new file mode 100644 index 00000000000..80e49f50b9b --- /dev/null +++ b/objects/vulnerability/vulnerability--8782f1ab-dbec-43e8-8094-5f1e40c93286.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c77bd5f8-94df-4f38-b3f3-ac65b17063c3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8782f1ab-dbec-43e8-8094-5f1e40c93286", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.572459Z", + "modified": "2024-10-22T00:37:10.572459Z", + "name": "CVE-2024-30157", + "description": "A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-30157" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--88042ee4-81c6-4cd2-b35e-e2d7bc0fe61d.json b/objects/vulnerability/vulnerability--88042ee4-81c6-4cd2-b35e-e2d7bc0fe61d.json new file mode 100644 index 00000000000..d47edeeaab6 --- /dev/null +++ b/objects/vulnerability/vulnerability--88042ee4-81c6-4cd2-b35e-e2d7bc0fe61d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b67955d7-47f3-41bd-b198-55454d4bec95", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--88042ee4-81c6-4cd2-b35e-e2d7bc0fe61d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.177598Z", + "modified": "2024-10-22T00:37:12.177598Z", + "name": "CVE-2024-49970", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Implement bounds check for stream encoder creation in DCN401\n\n'stream_enc_regs' array is an array of dcn10_stream_enc_registers\nstructures. The array is initialized with four elements, corresponding\nto the four calls to stream_enc_regs() in the array initializer. This\nmeans that valid indices for this array are 0, 1, 2, and 3.\n\nThe error message 'stream_enc_regs' 4 <= 5 below, is indicating that\nthere is an attempt to access this array with an index of 5, which is\nout of bounds. This could lead to undefined behavior\n\nHere, eng_id is used as an index to access the stream_enc_regs array. If\neng_id is 5, this would result in an out-of-bounds access on the\nstream_enc_regs array.\n\nThus fixing Buffer overflow error in dcn401_stream_encoder_create\n\nFound by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn401/dcn401_resource.c:1209 dcn401_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49970" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--88febbc7-2b1b-4a32-a73b-3fb67046a83a.json b/objects/vulnerability/vulnerability--88febbc7-2b1b-4a32-a73b-3fb67046a83a.json new file mode 100644 index 00000000000..e90266c3f4b --- /dev/null +++ b/objects/vulnerability/vulnerability--88febbc7-2b1b-4a32-a73b-3fb67046a83a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1bfe3a77-54ba-401a-baa3-8c70b51aad5c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--88febbc7-2b1b-4a32-a73b-3fb67046a83a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.050062Z", + "modified": "2024-10-22T00:37:12.050062Z", + "name": "CVE-2024-49910", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the dcn401_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for null, but then it was being\ndereferenced without any null check. This could lead to a null pointer\ndereference if set_output_gamma is null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a null check for set_output_gamma\nbefore the call to set_output_gamma.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49910" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8924b343-3eae-4bd2-9bbc-6cfad00fcacc.json b/objects/vulnerability/vulnerability--8924b343-3eae-4bd2-9bbc-6cfad00fcacc.json new file mode 100644 index 00000000000..a0a56d5ebf1 --- /dev/null +++ b/objects/vulnerability/vulnerability--8924b343-3eae-4bd2-9bbc-6cfad00fcacc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--70ace1c5-d4b6-4bd9-bf70-4f3a2f6787fc", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8924b343-3eae-4bd2-9bbc-6cfad00fcacc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.175566Z", + "modified": "2024-10-22T00:37:12.175566Z", + "name": "CVE-2024-49939", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid to add interface to list twice when SER\n\nIf SER L2 occurs during the WoWLAN resume flow, the add interface flow\nis triggered by ieee80211_reconfig(). However, due to\nrtw89_wow_resume() return failure, it will cause the add interface flow\nto be executed again, resulting in a double add list and causing a kernel\npanic. Therefore, we have added a check to prevent double adding of the\nlist.\n\nlist_add double add: new=ffff99d6992e2010, prev=ffff99d6992e2010, next=ffff99d695302628.\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:37!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W O 6.6.30-02659-gc18865c4dfbd #1 770df2933251a0e3c888ba69d1053a817a6376a7\nHardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.169.0 06/24/2021\nWorkqueue: events_freezable ieee80211_restart_work [mac80211]\nRIP: 0010:__list_add_valid_or_report+0x5e/0xb0\nCode: c7 74 18 48 39 ce 74 13 b0 01 59 5a 5e 5f 41 58 41 59 41 5a 5d e9 e2 d6 03 00 cc 48 c7 c7 8d 4f 17 83 48 89 c2 e8 02 c0 00 00 <0f> 0b 48 c7 c7 aa 8c 1c 83 e8 f4 bf 00 00 0f 0b 48 c7 c7 c8 bc 12\nRSP: 0018:ffffa91b8007bc50 EFLAGS: 00010246\nRAX: 0000000000000058 RBX: ffff99d6992e0900 RCX: a014d76c70ef3900\nRDX: ffffa91b8007bae8 RSI: 00000000ffffdfff RDI: 0000000000000001\nRBP: ffffa91b8007bc88 R08: 0000000000000000 R09: ffffa91b8007bae0\nR10: 00000000ffffdfff R11: ffffffff83a79800 R12: ffff99d695302060\nR13: ffff99d695300900 R14: ffff99d6992e1be0 R15: ffff99d6992e2010\nFS: 0000000000000000(0000) GS:ffff99d6aac00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000078fbdba43480 CR3: 000000010e464000 CR4: 00000000001506f0\nCall Trace:\n \n ? __die_body+0x1f/0x70\n ? die+0x3d/0x60\n ? do_trap+0xa4/0x110\n ? __list_add_valid_or_report+0x5e/0xb0\n ? do_error_trap+0x6d/0x90\n ? __list_add_valid_or_report+0x5e/0xb0\n ? handle_invalid_op+0x30/0x40\n ? __list_add_valid_or_report+0x5e/0xb0\n ? exc_invalid_op+0x3c/0x50\n ? asm_exc_invalid_op+0x16/0x20\n ? __list_add_valid_or_report+0x5e/0xb0\n rtw89_ops_add_interface+0x309/0x310 [rtw89_core 7c32b1ee6854761c0321027c8a58c5160e41f48f]\n drv_add_interface+0x5c/0x130 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n ieee80211_reconfig+0x241/0x13d0 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n ? finish_wait+0x3e/0x90\n ? synchronize_rcu_expedited+0x174/0x260\n ? sync_rcu_exp_done_unlocked+0x50/0x50\n ? wake_bit_function+0x40/0x40\n ieee80211_restart_work+0xf0/0x140 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n process_scheduled_works+0x1e5/0x480\n worker_thread+0xea/0x1e0\n kthread+0xdb/0x110\n ? move_linked_works+0x90/0x90\n ? kthread_associate_blkcg+0xa0/0xa0\n ret_from_fork+0x3b/0x50\n ? kthread_associate_blkcg+0xa0/0xa0\n ret_from_fork_asm+0x11/0x20\n \nModules linked in: dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc rfcomm cmac uinput algif_hash algif_skcipher af_alg btusb btrtl iio_trig_hrtimer industrialio_sw_trigger btmtk industrialio_configfs btbcm btintel uvcvideo videobuf2_vmalloc iio_trig_sysfs videobuf2_memops videobuf2_v4l2 videobuf2_common uvc snd_hda_codec_hdmi veth snd_hda_intel snd_intel_dspcfg acpi_als snd_hda_codec industrialio_triggered_buffer kfifo_buf snd_hwdep industrialio i2c_piix4 snd_hda_core designware_i2s ip6table_nat snd_soc_max98357a xt_MASQUERADE xt_cgroup snd_soc_acp_rt5682_mach fuse rtw89_8922ae(O) rtw89_8922a(O) rtw89_pci(O) rtw89_core(O) 8021q mac80211(O) bluetooth ecdh_generic ecc cfg80211 r8152 mii joydev\ngsmi: Log Shutdown Reason 0x03\n---[ end trace 0000000000000000 ]---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49939" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8984b90a-70b3-4e74-8bc5-e31d085df4f2.json b/objects/vulnerability/vulnerability--8984b90a-70b3-4e74-8bc5-e31d085df4f2.json new file mode 100644 index 00000000000..079267f6f06 --- /dev/null +++ b/objects/vulnerability/vulnerability--8984b90a-70b3-4e74-8bc5-e31d085df4f2.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4e890be1-d569-4b06-8c6c-2666a291f5fb", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8984b90a-70b3-4e74-8bc5-e31d085df4f2", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.98773Z", + "modified": "2024-10-22T00:37:10.98773Z", + "name": "CVE-2024-50041", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix macvlan leak by synchronizing access to mac_filter_hash\n\nThis patch addresses a macvlan leak issue in the i40e driver caused by\nconcurrent access to vsi->mac_filter_hash. The leak occurs when multiple\nthreads attempt to modify the mac_filter_hash simultaneously, leading to\ninconsistent state and potential memory leaks.\n\nTo fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing\nvf->default_lan_addr.addr with spin_lock/unlock_bh(&vsi->mac_filter_hash_lock),\nensuring atomic operations and preventing concurrent access.\n\nAdditionally, we add lockdep_assert_held(&vsi->mac_filter_hash_lock) in\ni40e_add_mac_filter() to help catch similar issues in the future.\n\nReproduction steps:\n1. Spawn VFs and configure port vlan on them.\n2. Trigger concurrent macvlan operations (e.g., adding and deleting\n\tportvlan and/or mac filters).\n3. Observe the potential memory leak and inconsistent state in the\n\tmac_filter_hash.\n\nThis synchronization ensures the integrity of the mac_filter_hash and prevents\nthe described leak.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50041" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8988842c-4930-4e48-9456-9015fe0ddc03.json b/objects/vulnerability/vulnerability--8988842c-4930-4e48-9456-9015fe0ddc03.json new file mode 100644 index 00000000000..87613a60bcf --- /dev/null +++ b/objects/vulnerability/vulnerability--8988842c-4930-4e48-9456-9015fe0ddc03.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f03331ba-a4ff-4e0c-a0a1-8ee70974c298", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8988842c-4930-4e48-9456-9015fe0ddc03", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.519858Z", + "modified": "2024-10-22T00:37:10.519858Z", + "name": "CVE-2024-48597", + "description": "Online Clinic Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /success/editp.php?action=edit.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-48597" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--89933699-e37e-43ed-9782-615407708461.json b/objects/vulnerability/vulnerability--89933699-e37e-43ed-9782-615407708461.json new file mode 100644 index 00000000000..02d73b8155b --- /dev/null +++ b/objects/vulnerability/vulnerability--89933699-e37e-43ed-9782-615407708461.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9cab296b-19f0-434e-b0e2-311c04ba42c3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--89933699-e37e-43ed-9782-615407708461", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.642702Z", + "modified": "2024-10-22T00:37:11.642702Z", + "name": "CVE-2024-40087", + "description": "Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-40087" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8a042ae2-6e65-4e4b-85d1-68ef50e7e3c9.json b/objects/vulnerability/vulnerability--8a042ae2-6e65-4e4b-85d1-68ef50e7e3c9.json new file mode 100644 index 00000000000..f84a8a12572 --- /dev/null +++ b/objects/vulnerability/vulnerability--8a042ae2-6e65-4e4b-85d1-68ef50e7e3c9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--43656a9a-439b-4fea-857c-391a0f7dcbc0", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8a042ae2-6e65-4e4b-85d1-68ef50e7e3c9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.933396Z", + "modified": "2024-10-22T00:37:17.933396Z", + "name": "CVE-2022-49027", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: Fix error handling in iavf_init_module()\n\nThe iavf_init_module() won't destroy workqueue when pci_register_driver()\nfailed. Call destroy_workqueue() when pci_register_driver() failed to\nprevent the resource leak.\n\nSimilar to the handling of u132_hcd_init in commit f276e002793c\n(\"usb: u132-hcd: fix resource leak\")", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49027" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8b23f20c-7819-4e69-89a5-d8520bcaad43.json b/objects/vulnerability/vulnerability--8b23f20c-7819-4e69-89a5-d8520bcaad43.json new file mode 100644 index 00000000000..0d0eced6c39 --- /dev/null +++ b/objects/vulnerability/vulnerability--8b23f20c-7819-4e69-89a5-d8520bcaad43.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9303dcf2-c543-475d-8c83-492f8f016fc7", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8b23f20c-7819-4e69-89a5-d8520bcaad43", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.633904Z", + "modified": "2024-10-22T00:37:16.633904Z", + "name": "CVE-2022-48968", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix potential memory leak in otx2_init_tc()\n\nIn otx2_init_tc(), if rhashtable_init() failed, it does not free\ntc->tc_entries_bitmap which is allocated in otx2_tc_alloc_ent_bitmap().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48968" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8b4c9dc3-13f1-497d-9ec6-f986dd031f97.json b/objects/vulnerability/vulnerability--8b4c9dc3-13f1-497d-9ec6-f986dd031f97.json new file mode 100644 index 00000000000..9e3c808809d --- /dev/null +++ b/objects/vulnerability/vulnerability--8b4c9dc3-13f1-497d-9ec6-f986dd031f97.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8d13dbfc-f429-40bb-b901-f03f6ad329af", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8b4c9dc3-13f1-497d-9ec6-f986dd031f97", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.073796Z", + "modified": "2024-10-22T00:37:12.073796Z", + "name": "CVE-2024-49977", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Fix zero-division error when disabling tc cbs\n\nThe commit b8c43360f6e4 (\"net: stmmac: No need to calculate speed divider\nwhen offload is disabled\") allows the \"port_transmit_rate_kbps\" to be\nset to a value of 0, which is then passed to the \"div_s64\" function when\ntc-cbs is disabled. This leads to a zero-division error.\n\nWhen tc-cbs is disabled, the idleslope, sendslope, and credit values the\ncredit values are not required to be configured. Therefore, adding a return\nstatement after setting the txQ mode to DCB when tc-cbs is disabled would\nprevent a zero-division error.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49977" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8c25d60d-80aa-480d-9204-394a17f0e02f.json b/objects/vulnerability/vulnerability--8c25d60d-80aa-480d-9204-394a17f0e02f.json new file mode 100644 index 00000000000..ddb8775b740 --- /dev/null +++ b/objects/vulnerability/vulnerability--8c25d60d-80aa-480d-9204-394a17f0e02f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--041c9e81-3cfd-4e63-9eec-ce3f8bf4c479", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8c25d60d-80aa-480d-9204-394a17f0e02f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.107232Z", + "modified": "2024-10-22T00:37:12.107232Z", + "name": "CVE-2024-49893", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check stream_status before it is used\n\n[WHAT & HOW]\ndc_state_get_stream_status can return null, and therefore null must be\nchecked before stream_status is used.\n\nThis fixes 1 NULL_RETURNS issue reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49893" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8c47a3cd-8835-4eed-86a5-f54f3b03fd5b.json b/objects/vulnerability/vulnerability--8c47a3cd-8835-4eed-86a5-f54f3b03fd5b.json new file mode 100644 index 00000000000..228efbf0499 --- /dev/null +++ b/objects/vulnerability/vulnerability--8c47a3cd-8835-4eed-86a5-f54f3b03fd5b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a051460f-b529-4c52-aa0f-fd2d62390fde", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8c47a3cd-8835-4eed-86a5-f54f3b03fd5b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.195568Z", + "modified": "2024-10-22T00:37:12.195568Z", + "name": "CVE-2024-49983", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free\n\nWhen calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(),\nthe 'ppath' is updated but it is the 'path' that is freed, thus potentially\ntriggering a double-free in the following process:\n\next4_ext_replay_update_ex\n ppath = path\n ext4_force_split_extent_at(&ppath)\n ext4_split_extent_at\n ext4_ext_insert_extent\n ext4_ext_create_new_leaf\n ext4_ext_grow_indepth\n ext4_find_extent\n if (depth > path[0].p_maxdepth)\n kfree(path) ---> path First freed\n *orig_path = path = NULL ---> null ppath\n kfree(path) ---> path double-free !!!\n\nSo drop the unnecessary ppath and use path directly to avoid this problem.\nAnd use ext4_find_extent() directly to update path, avoiding unnecessary\nmemory allocation and freeing. Also, propagate the error returned by\next4_find_extent() instead of using strange error codes.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49983" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8cc3b9c9-f833-4056-8237-d03971525c1e.json b/objects/vulnerability/vulnerability--8cc3b9c9-f833-4056-8237-d03971525c1e.json new file mode 100644 index 00000000000..0a9f0cb60cf --- /dev/null +++ b/objects/vulnerability/vulnerability--8cc3b9c9-f833-4056-8237-d03971525c1e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--cabc34dd-5534-471b-9e7b-9b7b059e88b4", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8cc3b9c9-f833-4056-8237-d03971525c1e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.833039Z", + "modified": "2024-10-22T00:37:10.833039Z", + "name": "CVE-2024-47731", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/perf: Fix ali_drw_pmu driver interrupt status clearing\n\nThe alibaba_uncore_pmu driver forgot to clear all interrupt status\nin the interrupt processing function. After the PMU counter overflow\ninterrupt occurred, an interrupt storm occurred, causing the system\nto hang.\n\nTherefore, clear the correct interrupt status in the interrupt handling\nfunction to fix it.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47731" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8cfdb74d-f42e-4226-aaae-1c05ee7561cb.json b/objects/vulnerability/vulnerability--8cfdb74d-f42e-4226-aaae-1c05ee7561cb.json new file mode 100644 index 00000000000..416452672ae --- /dev/null +++ b/objects/vulnerability/vulnerability--8cfdb74d-f42e-4226-aaae-1c05ee7561cb.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b301ca07-d59d-44e9-9c7d-3fbe20bd17bc", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8cfdb74d-f42e-4226-aaae-1c05ee7561cb", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.85296Z", + "modified": "2024-10-22T00:37:10.85296Z", + "name": "CVE-2024-47685", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()\n\nsyzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending\ngarbage on the four reserved tcp bits (th->res1)\n\nUse skb_put_zero() to clear the whole TCP header,\nas done in nf_reject_ip_tcphdr_put()\n\nBUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255\n nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255\n nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344\n nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288\n nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\n nf_hook include/linux/netfilter.h:269 [inline]\n NF_HOOK include/linux/netfilter.h:312 [inline]\n ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310\n __netif_receive_skb_one_core net/core/dev.c:5661 [inline]\n __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775\n process_backlog+0x4ad/0xa50 net/core/dev.c:6108\n __napi_poll+0xe7/0x980 net/core/dev.c:6772\n napi_poll net/core/dev.c:6841 [inline]\n net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963\n handle_softirqs+0x1ce/0x800 kernel/softirq.c:554\n __do_softirq+0x14/0x1a kernel/softirq.c:588\n do_softirq+0x9a/0x100 kernel/softirq.c:455\n __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382\n local_bh_enable include/linux/bottom_half.h:33 [inline]\n rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline]\n __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450\n dev_queue_xmit include/linux/netdevice.h:3105 [inline]\n neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565\n neigh_output include/net/neighbour.h:542 [inline]\n ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141\n __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]\n ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226\n NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247\n dst_output include/net/dst.h:450 [inline]\n NF_HOOK include/linux/netfilter.h:314 [inline]\n ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366\n inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135\n __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466\n tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline]\n tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143\n tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333\n __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679\n inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750\n __sys_connect_file net/socket.c:2061 [inline]\n __sys_connect+0x606/0x690 net/socket.c:2078\n __do_sys_connect net/socket.c:2088 [inline]\n __se_sys_connect net/socket.c:2085 [inline]\n __x64_sys_connect+0x91/0xe0 net/socket.c:2085\n x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was stored to memory at:\n nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249\n nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344\n nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288\n nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\n nf_hook include/linux/netfilter.h:269 [inline]\n NF_HOOK include/linux/netfilter.h:312 [inline]\n ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310\n __netif_receive_skb_one_core\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47685" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8d78bf33-cb81-41ed-b038-6604f2a50f10.json b/objects/vulnerability/vulnerability--8d78bf33-cb81-41ed-b038-6604f2a50f10.json new file mode 100644 index 00000000000..9fa18a81403 --- /dev/null +++ b/objects/vulnerability/vulnerability--8d78bf33-cb81-41ed-b038-6604f2a50f10.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f6e22a64-6dd0-4fee-b1e4-07e1514b88b4", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8d78bf33-cb81-41ed-b038-6604f2a50f10", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.007614Z", + "modified": "2024-10-22T00:37:12.007614Z", + "name": "CVE-2024-35287", + "description": "A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-35287" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8e834e53-f325-4082-a7c7-16a421d6f2f2.json b/objects/vulnerability/vulnerability--8e834e53-f325-4082-a7c7-16a421d6f2f2.json new file mode 100644 index 00000000000..95e6f8abd21 --- /dev/null +++ b/objects/vulnerability/vulnerability--8e834e53-f325-4082-a7c7-16a421d6f2f2.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f07a3a68-efe1-4901-b799-933c1ee0d505", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8e834e53-f325-4082-a7c7-16a421d6f2f2", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.562522Z", + "modified": "2024-10-22T00:37:16.562522Z", + "name": "CVE-2022-48997", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nchar: tpm: Protect tpm_pm_suspend with locks\n\nCurrently tpm transactions are executed unconditionally in\ntpm_pm_suspend() function, which may lead to races with other tpm\naccessors in the system.\n\nSpecifically, the hw_random tpm driver makes use of tpm_get_random(),\nand this function is called in a loop from a kthread, which means it's\nnot frozen alongside userspace, and so can race with the work done\nduring system suspend:\n\n tpm tpm0: tpm_transmit: tpm_recv: error -52\n tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics\n CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\n Call Trace:\n tpm_tis_status.cold+0x19/0x20\n tpm_transmit+0x13b/0x390\n tpm_transmit_cmd+0x20/0x80\n tpm1_pm_suspend+0xa6/0x110\n tpm_pm_suspend+0x53/0x80\n __pnp_bus_suspend+0x35/0xe0\n __device_suspend+0x10f/0x350\n\nFix this by calling tpm_try_get_ops(), which itself is a wrapper around\ntpm_chip_start(), but takes the appropriate mutex.\n\n[Jason: reworked commit message, added metadata]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48997" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8e9f7e3d-5a9a-4fc4-ae2e-ad442fb6911f.json b/objects/vulnerability/vulnerability--8e9f7e3d-5a9a-4fc4-ae2e-ad442fb6911f.json new file mode 100644 index 00000000000..be2993c33aa --- /dev/null +++ b/objects/vulnerability/vulnerability--8e9f7e3d-5a9a-4fc4-ae2e-ad442fb6911f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--427c5485-c821-4262-9efe-2ab68d4616c4", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8e9f7e3d-5a9a-4fc4-ae2e-ad442fb6911f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.182635Z", + "modified": "2024-10-22T00:37:12.182635Z", + "name": "CVE-2024-49872", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/gup: fix memfd_pin_folios alloc race panic\n\nIf memfd_pin_folios tries to create a hugetlb page, but someone else\nalready did, then folio gets the value -EEXIST here:\n\n folio = memfd_alloc_folio(memfd, start_idx);\n if (IS_ERR(folio)) {\n ret = PTR_ERR(folio);\n if (ret != -EEXIST)\n goto err;\n\nthen on the next trip through the \"while start_idx\" loop we panic here:\n\n if (folio) {\n folio_put(folio);\n\nTo fix, set the folio to NULL on error.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49872" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--8fa425a4-79b7-45ff-8996-d9d99b3854f2.json b/objects/vulnerability/vulnerability--8fa425a4-79b7-45ff-8996-d9d99b3854f2.json new file mode 100644 index 00000000000..ae3f81885ea --- /dev/null +++ b/objects/vulnerability/vulnerability--8fa425a4-79b7-45ff-8996-d9d99b3854f2.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--483337a9-b742-425b-81e1-eee0ffdb0db0", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--8fa425a4-79b7-45ff-8996-d9d99b3854f2", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.155889Z", + "modified": "2024-10-22T00:37:12.155889Z", + "name": "CVE-2024-49996", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix buffer overflow when parsing NFS reparse points\n\nReparseDataLength is sum of the InodeType size and DataBuffer size.\nSo to get DataBuffer size it is needed to subtract InodeType's size from\nReparseDataLength.\n\nFunction cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer\nat position after the end of the buffer because it does not subtract\nInodeType size from the length. Fix this problem and correctly subtract\nvariable len.\n\nMember InodeType is present only when reparse buffer is large enough. Check\nfor ReparseDataLength before accessing InodeType to prevent another invalid\nmemory access.\n\nMajor and minor rdev values are present also only when reparse buffer is\nlarge enough. Check for reparse buffer size before calling reparse_mkdev().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49996" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--908b1135-dece-43cb-8e10-fc48acc5b2bc.json b/objects/vulnerability/vulnerability--908b1135-dece-43cb-8e10-fc48acc5b2bc.json new file mode 100644 index 00000000000..532ab995850 --- /dev/null +++ b/objects/vulnerability/vulnerability--908b1135-dece-43cb-8e10-fc48acc5b2bc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6dfb83c6-62e8-4b36-9b47-4987ecb48009", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--908b1135-dece-43cb-8e10-fc48acc5b2bc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.921874Z", + "modified": "2024-10-22T00:37:10.921874Z", + "name": "CVE-2024-47686", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()\n\nThe psc->div[] array has psc->num_div elements. These values come from\nwhen we call clk_hw_register_div(). It's adc_divisors and\nARRAY_SIZE(adc_divisors)) and so on. So this condition needs to be >=\ninstead of > to prevent an out of bounds read.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47686" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--90c994b6-89e2-469e-bfed-31fa22f3b7d5.json b/objects/vulnerability/vulnerability--90c994b6-89e2-469e-bfed-31fa22f3b7d5.json new file mode 100644 index 00000000000..04faf653b9e --- /dev/null +++ b/objects/vulnerability/vulnerability--90c994b6-89e2-469e-bfed-31fa22f3b7d5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--40db0c23-8da9-4d1d-8f62-b3ce51eab488", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--90c994b6-89e2-469e-bfed-31fa22f3b7d5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.958033Z", + "modified": "2024-10-22T00:37:17.958033Z", + "name": "CVE-2022-49021", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: fix null-ptr-deref while probe() failed\n\nI got a null-ptr-deref report as following when doing fault injection test:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000058\nOops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G B N 6.1.0-rc3+\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:klist_put+0x2d/0xd0\nCall Trace:\n \n klist_remove+0xf1/0x1c0\n device_release_driver_internal+0x23e/0x2d0\n bus_remove_device+0x1bd/0x240\n device_del+0x357/0x770\n phy_device_remove+0x11/0x30\n mdiobus_unregister+0xa5/0x140\n release_nodes+0x6a/0xa0\n devres_release_all+0xf8/0x150\n device_unbind_cleanup+0x19/0xd0\n\n//probe path:\nphy_device_register()\n device_add()\n\nphy_connect\n phy_attach_direct() //set device driver\n probe() //it's failed, driver is not bound\n device_bind_driver() // probe failed, it's not called\n\n//remove path:\nphy_device_remove()\n device_del()\n device_release_driver_internal()\n __device_release_driver() //dev->drv is not NULL\n klist_remove() <- knode_driver is not added yet, cause null-ptr-deref\n\nIn phy_attach_direct(), after setting the 'dev->driver', probe() fails,\ndevice_bind_driver() is not called, so the knode_driver->n_klist is not\nset, then it causes null-ptr-deref in __device_release_driver() while\ndeleting device. Fix this by setting dev->driver to NULL in the error\npath in phy_attach_direct().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49021" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--917237e6-e1e1-4399-8c12-989e836b12e5.json b/objects/vulnerability/vulnerability--917237e6-e1e1-4399-8c12-989e836b12e5.json new file mode 100644 index 00000000000..ac3f4edc251 --- /dev/null +++ b/objects/vulnerability/vulnerability--917237e6-e1e1-4399-8c12-989e836b12e5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c0368095-dbfc-4f80-b013-1201d2477608", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--917237e6-e1e1-4399-8c12-989e836b12e5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.891142Z", + "modified": "2024-10-22T00:37:10.891142Z", + "name": "CVE-2024-47713", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()\n\nSince '__dev_queue_xmit()' should be called with interrupts enabled,\nthe following backtrace:\n\nieee80211_do_stop()\n ...\n spin_lock_irqsave(&local->queue_stop_reason_lock, flags)\n ...\n ieee80211_free_txskb()\n ieee80211_report_used_skb()\n ieee80211_report_ack_skb()\n cfg80211_mgmt_tx_status_ext()\n nl80211_frame_tx_status()\n genlmsg_multicast_netns()\n genlmsg_multicast_netns_filtered()\n nlmsg_multicast_filtered()\n\t netlink_broadcast_filtered()\n\t do_one_broadcast()\n\t netlink_broadcast_deliver()\n\t __netlink_sendskb()\n\t netlink_deliver_tap()\n\t __netlink_deliver_tap_skb()\n\t dev_queue_xmit()\n\t __dev_queue_xmit() ; with IRQS disabled\n ...\n spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)\n\nissues the warning (as reported by syzbot reproducer):\n\nWARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120\n\nFix this by implementing a two-phase skb reclamation in\n'ieee80211_do_stop()', where actual work is performed\noutside of a section with interrupts disabled.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47713" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--922b6741-b3e5-4f66-90a2-1199229972b1.json b/objects/vulnerability/vulnerability--922b6741-b3e5-4f66-90a2-1199229972b1.json new file mode 100644 index 00000000000..c3e446f0fd4 --- /dev/null +++ b/objects/vulnerability/vulnerability--922b6741-b3e5-4f66-90a2-1199229972b1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--66152c90-a636-425d-a2f9-f7b2719c861f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--922b6741-b3e5-4f66-90a2-1199229972b1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.091588Z", + "modified": "2024-10-22T00:37:12.091588Z", + "name": "CVE-2024-49908", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)\n\nThis commit adds a null check for the 'afb' variable in the\namdgpu_dm_update_cursor function. Previously, 'afb' was assumed to be\nnull at line 8388, but was used later in the code without a null check.\nThis could potentially lead to a null pointer dereference.\n\nChanges since v1:\n- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:8433 amdgpu_dm_update_cursor()\n\terror: we previously assumed 'afb' could be null (see line 8388)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49908" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--9290e5a8-5439-4665-92a0-ef8321290818.json b/objects/vulnerability/vulnerability--9290e5a8-5439-4665-92a0-ef8321290818.json new file mode 100644 index 00000000000..5051a9f44cc --- /dev/null +++ b/objects/vulnerability/vulnerability--9290e5a8-5439-4665-92a0-ef8321290818.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0f0b78cf-b6d3-489d-9a9c-bf10d908aac6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--9290e5a8-5439-4665-92a0-ef8321290818", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.127611Z", + "modified": "2024-10-22T00:37:12.127611Z", + "name": "CVE-2024-49941", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpiolib: Fix potential NULL pointer dereference in gpiod_get_label()\n\nIn `gpiod_get_label()`, it is possible that `srcu_dereference_check()` may\nreturn a NULL pointer, leading to a scenario where `label->str` is accessed\nwithout verifying if `label` itself is NULL.\n\nThis patch adds a proper NULL check for `label` before accessing\n`label->str`. The check for `label->str != NULL` is removed because\n`label->str` can never be NULL if `label` is not NULL.\n\nThis fixes the issue where the label name was being printed as `(efault)`\nwhen dumping the sysfs GPIO file when `label == NULL`.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49941" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--92d74cf7-f099-4066-aa9a-c3be4da5cc5c.json b/objects/vulnerability/vulnerability--92d74cf7-f099-4066-aa9a-c3be4da5cc5c.json new file mode 100644 index 00000000000..79081911444 --- /dev/null +++ b/objects/vulnerability/vulnerability--92d74cf7-f099-4066-aa9a-c3be4da5cc5c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--87712806-7dba-4720-a312-f0cddc3d2104", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--92d74cf7-f099-4066-aa9a-c3be4da5cc5c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.093682Z", + "modified": "2024-10-22T00:37:12.093682Z", + "name": "CVE-2024-49987", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpftool: Fix undefined behavior in qsort(NULL, 0, ...)\n\nWhen netfilter has no entry to display, qsort is called with\nqsort(NULL, 0, ...). This results in undefined behavior, as UBSan\nreports:\n\nnet.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null\n\nAlthough the C standard does not explicitly state whether calling qsort\nwith a NULL pointer when the size is 0 constitutes undefined behavior,\nSection 7.1.4 of the C standard (Use of library functions) mentions:\n\n\"Each of the following statements applies unless explicitly stated\notherwise in the detailed descriptions that follow: If an argument to a\nfunction has an invalid value (such as a value outside the domain of\nthe function, or a pointer outside the address space of the program, or\na null pointer, or a pointer to non-modifiable storage when the\ncorresponding parameter is not const-qualified) or a type (after\npromotion) not expected by a function with variable number of\narguments, the behavior is undefined.\"\n\nTo avoid this, add an early return when nf_link_info is NULL to prevent\ncalling qsort with a NULL pointer.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49987" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--951193d9-f91a-4c92-b757-be0c50760d3e.json b/objects/vulnerability/vulnerability--951193d9-f91a-4c92-b757-be0c50760d3e.json new file mode 100644 index 00000000000..1b076be9125 --- /dev/null +++ b/objects/vulnerability/vulnerability--951193d9-f91a-4c92-b757-be0c50760d3e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5f115b66-8891-4b92-b5cf-9023fde764ea", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--951193d9-f91a-4c92-b757-be0c50760d3e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.955048Z", + "modified": "2024-10-22T00:37:10.955048Z", + "name": "CVE-2024-47751", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()\n\nWithin kirin_pcie_parse_port(), the pcie->num_slots is compared to\npcie->gpio_id_reset size (MAX_PCI_SLOTS) which is correct and would lead\nto an overflow.\n\nThus, fix condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and move\npcie->num_slots increment below the if-statement to avoid out-of-bounds\narray access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n[kwilczynski: commit log]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47751" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--95938611-6ce1-4ebd-b7bc-54aa6855c88c.json b/objects/vulnerability/vulnerability--95938611-6ce1-4ebd-b7bc-54aa6855c88c.json new file mode 100644 index 00000000000..9171f268138 --- /dev/null +++ b/objects/vulnerability/vulnerability--95938611-6ce1-4ebd-b7bc-54aa6855c88c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--42af740a-b1c4-4f17-b45a-4fe971c9384d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--95938611-6ce1-4ebd-b7bc-54aa6855c88c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.880778Z", + "modified": "2024-10-22T00:37:10.880778Z", + "name": "CVE-2024-47755", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: Fix devs leaks in scan_labels()\n\nscan_labels() leaks memory when label scanning fails and it falls back\nto just creating a default \"seed\" namespace for userspace to configure.\nRoot can force the kernel to leak memory.\n\nAllocate the minimum resources unconditionally and release them when\nunneeded to avoid the memory leak.\n\nA kmemleak reports:\nunreferenced object 0xffff88800dda1980 (size 16):\n comm \"kworker/u10:5\", pid 69, jiffies 4294671781\n hex dump (first 16 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace (crc 0):\n [<00000000c5dea560>] __kmalloc+0x32c/0x470\n [<000000009ed43c83>] nd_region_register_namespaces+0x6fb/0x1120 [libnvdimm]\n [<000000000e07a65c>] nd_region_probe+0xfe/0x210 [libnvdimm]\n [<000000007b79ce5f>] nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm]\n [<00000000a5f3da2e>] really_probe+0xc6/0x390\n [<00000000129e2a69>] __driver_probe_device+0x78/0x150\n [<000000002dfed28b>] driver_probe_device+0x1e/0x90\n [<00000000e7048de2>] __device_attach_driver+0x85/0x110\n [<0000000032dca295>] bus_for_each_drv+0x85/0xe0\n [<00000000391c5a7d>] __device_attach+0xbe/0x1e0\n [<0000000026dabec0>] bus_probe_device+0x94/0xb0\n [<00000000c590d936>] device_add+0x656/0x870\n [<000000003d69bfaa>] nd_async_device_register+0xe/0x50 [libnvdimm]\n [<000000003f4c52a4>] async_run_entry_fn+0x2e/0x110\n [<00000000e201f4b0>] process_one_work+0x1ee/0x600\n [<000000006d90d5a9>] worker_thread+0x183/0x350", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47755" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--95aee335-db4d-4018-b4a5-0c0e0a21d9cb.json b/objects/vulnerability/vulnerability--95aee335-db4d-4018-b4a5-0c0e0a21d9cb.json new file mode 100644 index 00000000000..7186b31d5e5 --- /dev/null +++ b/objects/vulnerability/vulnerability--95aee335-db4d-4018-b4a5-0c0e0a21d9cb.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--7b39a1b1-1868-4b36-b89b-0083565a60eb", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--95aee335-db4d-4018-b4a5-0c0e0a21d9cb", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.753058Z", + "modified": "2024-10-22T00:37:11.753058Z", + "name": "CVE-2024-41712", + "description": "A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary commands on the system within the context of the user.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-41712" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--978a17ae-25bf-440f-9481-af860dd90240.json b/objects/vulnerability/vulnerability--978a17ae-25bf-440f-9481-af860dd90240.json new file mode 100644 index 00000000000..dcfa5ddec31 --- /dev/null +++ b/objects/vulnerability/vulnerability--978a17ae-25bf-440f-9481-af860dd90240.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3fd3be2c-92b2-4534-bac9-8d37313e0700", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--978a17ae-25bf-440f-9481-af860dd90240", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.949012Z", + "modified": "2024-10-22T00:37:17.949012Z", + "name": "CVE-2022-49025", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix use-after-free when reverting termination table\n\nWhen having multiple dests with termination tables and second one\nor afterwards fails the driver reverts usage of term tables but\ndoesn't reset the assignment in attr->dests[num_vport_dests].termtbl\nwhich case a use-after-free when releasing the rule.\nFix by resetting the assignment of termtbl to null.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49025" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--97a51a57-0972-4c2d-8804-33e52e6693ac.json b/objects/vulnerability/vulnerability--97a51a57-0972-4c2d-8804-33e52e6693ac.json new file mode 100644 index 00000000000..5680b254d13 --- /dev/null +++ b/objects/vulnerability/vulnerability--97a51a57-0972-4c2d-8804-33e52e6693ac.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--053f8b9e-9faa-450c-8c3b-ab8951d4d448", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--97a51a57-0972-4c2d-8804-33e52e6693ac", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.95159Z", + "modified": "2024-10-22T00:37:17.95159Z", + "name": "CVE-2022-49011", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()\n\nAs comment of pci_get_domain_bus_and_slot() says, it returns\na pci device with refcount increment, when finish using it,\nthe caller must decrement the reference count by calling\npci_dev_put(). So call it after using to avoid refcount leak.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49011" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--9939e47b-0e89-4e39-b375-d41e862ec1bb.json b/objects/vulnerability/vulnerability--9939e47b-0e89-4e39-b375-d41e862ec1bb.json new file mode 100644 index 00000000000..8a43ecde457 --- /dev/null +++ b/objects/vulnerability/vulnerability--9939e47b-0e89-4e39-b375-d41e862ec1bb.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9ae1c5d8-9f17-4efa-b739-25ee7e33bc3d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--9939e47b-0e89-4e39-b375-d41e862ec1bb", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.997877Z", + "modified": "2024-10-22T00:37:10.997877Z", + "name": "CVE-2024-50023", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: Remove LED entry from LEDs list on unregister\n\nCommit c938ab4da0eb (\"net: phy: Manual remove LEDs to ensure correct\nordering\") correctly fixed a problem with using devm_ but missed\nremoving the LED entry from the LEDs list.\n\nThis cause kernel panic on specific scenario where the port for the PHY\nis torn down and up and the kmod for the PHY is removed.\n\nOn setting the port down the first time, the assosiacted LEDs are\ncorrectly unregistered. The associated kmod for the PHY is now removed.\nThe kmod is now added again and the port is now put up, the associated LED\nare registered again.\nOn putting the port down again for the second time after these step, the\nLED list now have 4 elements. With the first 2 already unregistered\npreviously and the 2 new one registered again.\n\nThis cause a kernel panic as the first 2 element should have been\nremoved.\n\nFix this by correctly removing the element when LED is unregistered.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50023" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--997a5bca-948c-424f-925b-5b7c72c0198a.json b/objects/vulnerability/vulnerability--997a5bca-948c-424f-925b-5b7c72c0198a.json new file mode 100644 index 00000000000..f5709fc3137 --- /dev/null +++ b/objects/vulnerability/vulnerability--997a5bca-948c-424f-925b-5b7c72c0198a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1ae2a0ea-f3fb-4ccb-8eb4-f82490386ae5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--997a5bca-948c-424f-925b-5b7c72c0198a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.64475Z", + "modified": "2024-10-22T00:37:16.64475Z", + "name": "CVE-2022-48969", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: Fix NULL sring after live migration\n\nA NAPI is setup for each network sring to poll data to kernel\nThe sring with source host is destroyed before live migration and\nnew sring with target host is setup after live migration.\nThe NAPI for the old sring is not deleted until setup new sring\nwith target host after migration. With busy_poll/busy_read enabled,\nthe NAPI can be polled before got deleted when resume VM.\n\nBUG: unable to handle kernel NULL pointer dereference at\n0000000000000008\nIP: xennet_poll+0xae/0xd20\nPGD 0 P4D 0\nOops: 0000 [#1] SMP PTI\nCall Trace:\n finish_task_switch+0x71/0x230\n timerqueue_del+0x1d/0x40\n hrtimer_try_to_cancel+0xb5/0x110\n xennet_alloc_rx_buffers+0x2a0/0x2a0\n napi_busy_loop+0xdb/0x270\n sock_poll+0x87/0x90\n do_sys_poll+0x26f/0x580\n tracing_map_insert+0x1d4/0x2f0\n event_hist_trigger+0x14a/0x260\n\n finish_task_switch+0x71/0x230\n __schedule+0x256/0x890\n recalc_sigpending+0x1b/0x50\n xen_sched_clock+0x15/0x20\n __rb_reserve_next+0x12d/0x140\n ring_buffer_lock_reserve+0x123/0x3d0\n event_triggers_call+0x87/0xb0\n trace_event_buffer_commit+0x1c4/0x210\n xen_clocksource_get_cycles+0x15/0x20\n ktime_get_ts64+0x51/0xf0\n SyS_ppoll+0x160/0x1a0\n SyS_ppoll+0x160/0x1a0\n do_syscall_64+0x73/0x130\n entry_SYSCALL_64_after_hwframe+0x41/0xa6\n...\nRIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900\nCR2: 0000000000000008\n---[ end trace f8601785b354351c ]---\n\nxen frontend should remove the NAPIs for the old srings before live\nmigration as the bond srings are destroyed\n\nThere is a tiny window between the srings are set to NULL and\nthe NAPIs are disabled, It is safe as the NAPI threads are still\nfrozen at that time", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48969" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--99cf6561-6e0b-4d6a-a7ff-7ed5c1639d56.json b/objects/vulnerability/vulnerability--99cf6561-6e0b-4d6a-a7ff-7ed5c1639d56.json new file mode 100644 index 00000000000..e3830c80179 --- /dev/null +++ b/objects/vulnerability/vulnerability--99cf6561-6e0b-4d6a-a7ff-7ed5c1639d56.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b568b941-3028-4266-8094-acc04afd1acd", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--99cf6561-6e0b-4d6a-a7ff-7ed5c1639d56", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.040628Z", + "modified": "2024-10-22T00:37:12.040628Z", + "name": "CVE-2024-49993", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count\n\nIf qi_submit_sync() is invoked with 0 invalidation descriptors (for\ninstance, for DMA draining purposes), we can run into a bug where a\nsubmitting thread fails to detect the completion of invalidation_wait.\nSubsequently, this led to a soft lockup. Currently, there is no impact\nby this bug on the existing users because no callers are submitting\ninvalidations with 0 descriptors. This fix will enable future users\n(such as DMA drain) calling qi_submit_sync() with 0 count.\n\nSuppose thread T1 invokes qi_submit_sync() with non-zero descriptors, while\nconcurrently, thread T2 calls qi_submit_sync() with zero descriptors. Both\nthreads then enter a while loop, waiting for their respective descriptors\nto complete. T1 detects its completion (i.e., T1's invalidation_wait status\nchanges to QI_DONE by HW) and proceeds to call reclaim_free_desc() to\nreclaim all descriptors, potentially including adjacent ones of other\nthreads that are also marked as QI_DONE.\n\nDuring this time, while T2 is waiting to acquire the qi->q_lock, the IOMMU\nhardware may complete the invalidation for T2, setting its status to\nQI_DONE. However, if T1's execution of reclaim_free_desc() frees T2's\ninvalidation_wait descriptor and changes its status to QI_FREE, T2 will\nnot observe the QI_DONE status for its invalidation_wait and will\nindefinitely remain stuck.\n\nThis soft lockup does not occur when only non-zero descriptors are\nsubmitted.In such cases, invalidation descriptors are interspersed among\nwait descriptors with the status QI_IN_USE, acting as barriers. These\nbarriers prevent the reclaim code from mistakenly freeing descriptors\nbelonging to other submitters.\n\nConsidered the following example timeline:\n\tT1\t\t\tT2\n========================================\n\tID1\n\tWD1\n\twhile(WD1!=QI_DONE)\n\tunlock\n\t\t\t\tlock\n\tWD1=QI_DONE*\t\tWD2\n\t\t\t\twhile(WD2!=QI_DONE)\n\t\t\t\tunlock\n\tlock\n\tWD1==QI_DONE?\n\tID1=QI_DONE\t\tWD2=DONE*\n\treclaim()\n\tID1=FREE\n\tWD1=FREE\n\tWD2=FREE\n\tunlock\n\t\t\t\tsoft lockup! T2 never sees QI_DONE in WD2\n\nWhere:\nID = invalidation descriptor\nWD = wait descriptor\n* Written by hardware\n\nThe root of the problem is that the descriptor status QI_DONE flag is used\nfor two conflicting purposes:\n1. signal a descriptor is ready for reclaim (to be freed)\n2. signal by the hardware that a wait descriptor is complete\n\nThe solution (in this patch) is state separation by using QI_FREE flag\nfor #1.\n\nOnce a thread's invalidation descriptors are complete, their status would\nbe set to QI_FREE. The reclaim_free_desc() function would then only\nfree descriptors marked as QI_FREE instead of those marked as\nQI_DONE. This change ensures that T2 (from the previous example) will\ncorrectly observe the completion of its invalidation_wait (marked as\nQI_DONE).", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49993" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--9a4ffd38-0035-418a-95d6-6afb391d982b.json b/objects/vulnerability/vulnerability--9a4ffd38-0035-418a-95d6-6afb391d982b.json new file mode 100644 index 00000000000..e17790ec0e2 --- /dev/null +++ b/objects/vulnerability/vulnerability--9a4ffd38-0035-418a-95d6-6afb391d982b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a5478651-cbae-4d35-a2b2-9f3b97ba90fe", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--9a4ffd38-0035-418a-95d6-6afb391d982b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.137719Z", + "modified": "2024-10-22T00:37:12.137719Z", + "name": "CVE-2024-49948", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: add more sanity checks to qdisc_pkt_len_init()\n\nOne path takes care of SKB_GSO_DODGY, assuming\nskb->len is bigger than hdr_len.\n\nvirtio_net_hdr_to_skb() does not fully dissect TCP headers,\nit only make sure it is at least 20 bytes.\n\nIt is possible for an user to provide a malicious 'GSO' packet,\ntotal length of 80 bytes.\n\n- 20 bytes of IPv4 header\n- 60 bytes TCP header\n- a small gso_size like 8\n\nvirtio_net_hdr_to_skb() would declare this packet as a normal\nGSO packet, because it would see 40 bytes of payload,\nbigger than gso_size.\n\nWe need to make detect this case to not underflow\nqdisc_skb_cb(skb)->pkt_len.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49948" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--9bab7066-4d22-4d76-a1b6-1d8ea9d77f2b.json b/objects/vulnerability/vulnerability--9bab7066-4d22-4d76-a1b6-1d8ea9d77f2b.json new file mode 100644 index 00000000000..1af6e2c4e67 --- /dev/null +++ b/objects/vulnerability/vulnerability--9bab7066-4d22-4d76-a1b6-1d8ea9d77f2b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b94e395f-5a72-4efc-a314-2299939445ab", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--9bab7066-4d22-4d76-a1b6-1d8ea9d77f2b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.901752Z", + "modified": "2024-10-22T00:37:10.901752Z", + "name": "CVE-2024-47712", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param\n\nIn the `wilc_parse_join_bss_param` function, the TSF field of the `ies`\nstructure is accessed after the RCU read-side critical section is\nunlocked. According to RCU usage rules, this is illegal. Reusing this\npointer can lead to unpredictable behavior, including accessing memory\nthat has been updated or causing use-after-free issues.\n\nThis possible bug was identified using a static analysis tool developed\nby myself, specifically designed to detect RCU-related issues.\n\nTo address this, the TSF value is now stored in a local variable\n`ies_tsf` before the RCU lock is released. The `param->tsf_lo` field is\nthen assigned using this local variable, ensuring that the TSF value is\nsafely accessed.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47712" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--9c1469cc-9ac8-4c51-a4fe-dd594e2c87b1.json b/objects/vulnerability/vulnerability--9c1469cc-9ac8-4c51-a4fe-dd594e2c87b1.json new file mode 100644 index 00000000000..1122b043c9e --- /dev/null +++ b/objects/vulnerability/vulnerability--9c1469cc-9ac8-4c51-a4fe-dd594e2c87b1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--102eea41-6892-4199-aaea-c3c4781f6e73", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--9c1469cc-9ac8-4c51-a4fe-dd594e2c87b1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.994179Z", + "modified": "2024-10-22T00:37:10.994179Z", + "name": "CVE-2024-50003", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix system hang while resume with TBT monitor\n\n[Why]\nConnected with a Thunderbolt monitor and do the suspend and the system\nmay hang while resume.\n\nThe TBT monitor HPD will be triggered during the resume procedure\nand call the drm_client_modeset_probe() while\nstruct drm_connector connector->dev->master is NULL.\n\nIt will mess up the pipe topology after resume.\n\n[How]\nSkip the TBT monitor HPD during the resume procedure because we\ncurrently will probe the connectors after resume by default.\n\n(cherry picked from commit 453f86a26945207a16b8f66aaed5962dc2b95b85)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50003" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--9ca0909f-b793-4a2c-96b4-5a8628bcab1f.json b/objects/vulnerability/vulnerability--9ca0909f-b793-4a2c-96b4-5a8628bcab1f.json new file mode 100644 index 00000000000..9c1de372027 --- /dev/null +++ b/objects/vulnerability/vulnerability--9ca0909f-b793-4a2c-96b4-5a8628bcab1f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ec7b57bc-c8c7-4353-a265-dfa1bdad9089", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--9ca0909f-b793-4a2c-96b4-5a8628bcab1f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.682172Z", + "modified": "2024-10-22T00:37:16.682172Z", + "name": "CVE-2022-48974", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: fix using __this_cpu_add in preemptible\n\nCurrently in nf_conntrack_hash_check_insert(), when it fails in\nnf_ct_ext_valid_pre/post(), NF_CT_STAT_INC() will be called in the\npreemptible context, a call trace can be triggered:\n\n BUG: using __this_cpu_add() in preemptible [00000000] code: conntrack/1636\n caller is nf_conntrack_hash_check_insert+0x45/0x430 [nf_conntrack]\n Call Trace:\n \n dump_stack_lvl+0x33/0x46\n check_preemption_disabled+0xc3/0xf0\n nf_conntrack_hash_check_insert+0x45/0x430 [nf_conntrack]\n ctnetlink_create_conntrack+0x3cd/0x4e0 [nf_conntrack_netlink]\n ctnetlink_new_conntrack+0x1c0/0x450 [nf_conntrack_netlink]\n nfnetlink_rcv_msg+0x277/0x2f0 [nfnetlink]\n netlink_rcv_skb+0x50/0x100\n nfnetlink_rcv+0x65/0x144 [nfnetlink]\n netlink_unicast+0x1ae/0x290\n netlink_sendmsg+0x257/0x4f0\n sock_sendmsg+0x5f/0x70\n\nThis patch is to fix it by changing to use NF_CT_STAT_INC_ATOMIC() for\nnf_ct_ext_valid_pre/post() check in nf_conntrack_hash_check_insert(),\nas well as nf_ct_ext_valid_post() in __nf_conntrack_confirm().\n\nNote that nf_ct_ext_valid_pre() check in __nf_conntrack_confirm() is\nsafe to use NF_CT_STAT_INC(), as it's under local_bh_disable().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48974" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--9cf05270-e9d9-43b7-8927-f17bc2be572b.json b/objects/vulnerability/vulnerability--9cf05270-e9d9-43b7-8927-f17bc2be572b.json new file mode 100644 index 00000000000..90323dc2247 --- /dev/null +++ b/objects/vulnerability/vulnerability--9cf05270-e9d9-43b7-8927-f17bc2be572b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--969982cf-20c7-4868-be80-1f92fffdaf9b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--9cf05270-e9d9-43b7-8927-f17bc2be572b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.026295Z", + "modified": "2024-10-22T00:37:12.026295Z", + "name": "CVE-2024-49883", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: aovid use-after-free in ext4_ext_insert_extent()\n\nAs Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is\nreallocated in ext4_ext_create_new_leaf(), we'll use the stale path and\ncause UAF. Below is a sample trace with dummy values:\n\next4_ext_insert_extent\n path = *ppath = 2000\n ext4_ext_create_new_leaf(ppath)\n ext4_find_extent(ppath)\n path = *ppath = 2000\n if (depth > path[0].p_maxdepth)\n kfree(path = 2000);\n *ppath = path = NULL;\n path = kcalloc() = 3000\n *ppath = 3000;\n return path;\n /* here path is still 2000, UAF! */\n eh = path[depth].p_hdr\n\n==================================================================\nBUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330\nRead of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179\nCPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866\nCall Trace:\n \n ext4_ext_insert_extent+0x26d4/0x3330\n ext4_ext_map_blocks+0xe22/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n[...]\n\nAllocated by task 179:\n ext4_find_extent+0x81c/0x1f70\n ext4_ext_map_blocks+0x146/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n ext4_writepages+0x26d/0x4e0\n do_writepages+0x175/0x700\n[...]\n\nFreed by task 179:\n kfree+0xcb/0x240\n ext4_find_extent+0x7c0/0x1f70\n ext4_ext_insert_extent+0xa26/0x3330\n ext4_ext_map_blocks+0xe22/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n ext4_writepages+0x26d/0x4e0\n do_writepages+0x175/0x700\n[...]\n==================================================================\n\nSo use *ppath to update the path to avoid the above problem.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49883" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--9e9f9127-9770-4a20-81fe-6e1514f139ef.json b/objects/vulnerability/vulnerability--9e9f9127-9770-4a20-81fe-6e1514f139ef.json new file mode 100644 index 00000000000..322841c4caa --- /dev/null +++ b/objects/vulnerability/vulnerability--9e9f9127-9770-4a20-81fe-6e1514f139ef.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5efa819a-30e8-45e8-a8c1-ffd1393c57e3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--9e9f9127-9770-4a20-81fe-6e1514f139ef", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.692104Z", + "modified": "2024-10-22T00:37:16.692104Z", + "name": "CVE-2022-48954", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/qeth: fix use-after-free in hsci\n\nKASAN found that addr was dereferenced after br2dev_event_work was freed.\n\n==================================================================\nBUG: KASAN: use-after-free in qeth_l2_br2dev_worker+0x5ba/0x6b0\nRead of size 1 at addr 00000000fdcea440 by task kworker/u760:4/540\nCPU: 17 PID: 540 Comm: kworker/u760:4 Tainted: G E 6.1.0-20221128.rc7.git1.5aa3bed4ce83.300.fc36.s390x+kasan #1\nHardware name: IBM 8561 T01 703 (LPAR)\nWorkqueue: 0.0.8000_event qeth_l2_br2dev_worker\nCall Trace:\n [<000000016944d4ce>] dump_stack_lvl+0xc6/0xf8\n [<000000016942cd9c>] print_address_description.constprop.0+0x34/0x2a0\n [<000000016942d118>] print_report+0x110/0x1f8\n [<0000000167a7bd04>] kasan_report+0xfc/0x128\n [<000000016938d79a>] qeth_l2_br2dev_worker+0x5ba/0x6b0\n [<00000001673edd1e>] process_one_work+0x76e/0x1128\n [<00000001673ee85c>] worker_thread+0x184/0x1098\n [<000000016740718a>] kthread+0x26a/0x310\n [<00000001672c606a>] __ret_from_fork+0x8a/0xe8\n [<00000001694711da>] ret_from_fork+0xa/0x40\nAllocated by task 108338:\n kasan_save_stack+0x40/0x68\n kasan_set_track+0x36/0x48\n __kasan_kmalloc+0xa0/0xc0\n qeth_l2_switchdev_event+0x25a/0x738\n atomic_notifier_call_chain+0x9c/0xf8\n br_switchdev_fdb_notify+0xf4/0x110\n fdb_notify+0x122/0x180\n fdb_add_entry.constprop.0.isra.0+0x312/0x558\n br_fdb_add+0x59e/0x858\n rtnl_fdb_add+0x58a/0x928\n rtnetlink_rcv_msg+0x5f8/0x8d8\n netlink_rcv_skb+0x1f2/0x408\n netlink_unicast+0x570/0x790\n netlink_sendmsg+0x752/0xbe0\n sock_sendmsg+0xca/0x110\n ____sys_sendmsg+0x510/0x6a8\n ___sys_sendmsg+0x12a/0x180\n __sys_sendmsg+0xe6/0x168\n __do_sys_socketcall+0x3c8/0x468\n do_syscall+0x22c/0x328\n __do_syscall+0x94/0xf0\n system_call+0x82/0xb0\nFreed by task 540:\n kasan_save_stack+0x40/0x68\n kasan_set_track+0x36/0x48\n kasan_save_free_info+0x4c/0x68\n ____kasan_slab_free+0x14e/0x1a8\n __kasan_slab_free+0x24/0x30\n __kmem_cache_free+0x168/0x338\n qeth_l2_br2dev_worker+0x154/0x6b0\n process_one_work+0x76e/0x1128\n worker_thread+0x184/0x1098\n kthread+0x26a/0x310\n __ret_from_fork+0x8a/0xe8\n ret_from_fork+0xa/0x40\nLast potentially related work creation:\n kasan_save_stack+0x40/0x68\n __kasan_record_aux_stack+0xbe/0xd0\n insert_work+0x56/0x2e8\n __queue_work+0x4ce/0xd10\n queue_work_on+0xf4/0x100\n qeth_l2_switchdev_event+0x520/0x738\n atomic_notifier_call_chain+0x9c/0xf8\n br_switchdev_fdb_notify+0xf4/0x110\n fdb_notify+0x122/0x180\n fdb_add_entry.constprop.0.isra.0+0x312/0x558\n br_fdb_add+0x59e/0x858\n rtnl_fdb_add+0x58a/0x928\n rtnetlink_rcv_msg+0x5f8/0x8d8\n netlink_rcv_skb+0x1f2/0x408\n netlink_unicast+0x570/0x790\n netlink_sendmsg+0x752/0xbe0\n sock_sendmsg+0xca/0x110\n ____sys_sendmsg+0x510/0x6a8\n ___sys_sendmsg+0x12a/0x180\n __sys_sendmsg+0xe6/0x168\n __do_sys_socketcall+0x3c8/0x468\n do_syscall+0x22c/0x328\n __do_syscall+0x94/0xf0\n system_call+0x82/0xb0\nSecond to last potentially related work creation:\n kasan_save_stack+0x40/0x68\n __kasan_record_aux_stack+0xbe/0xd0\n kvfree_call_rcu+0xb2/0x760\n kernfs_unlink_open_file+0x348/0x430\n kernfs_fop_release+0xc2/0x320\n __fput+0x1ae/0x768\n task_work_run+0x1bc/0x298\n exit_to_user_mode_prepare+0x1a0/0x1a8\n __do_syscall+0x94/0xf0\n system_call+0x82/0xb0\nThe buggy address belongs to the object at 00000000fdcea400\n which belongs to the cache kmalloc-96 of size 96\nThe buggy address is located 64 bytes inside of\n 96-byte region [00000000fdcea400, 00000000fdcea460)\nThe buggy address belongs to the physical page:\npage:000000005a9c26e8 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xfdcea\nflags: 0x3ffff00000000200(slab|node=0|zone=1|lastcpupid=0x1ffff)\nraw: 3ffff00000000200 0000000000000000 0000000100000122 000000008008cc00\nraw: 0000000000000000 0020004100000000 ffffffff00000001 0000000000000000\npage dumped because: kasan: bad access detected\nMemory state around the buggy address:\n 00000000fdcea300: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n 00000000fdcea380: fb fb fb fb fb fb f\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48954" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--9ebf541f-1562-49bf-ae19-307fe2bb2e7a.json b/objects/vulnerability/vulnerability--9ebf541f-1562-49bf-ae19-307fe2bb2e7a.json new file mode 100644 index 00000000000..a575c7f25ed --- /dev/null +++ b/objects/vulnerability/vulnerability--9ebf541f-1562-49bf-ae19-307fe2bb2e7a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ee7119bc-8aad-4542-a442-bf94e61bff2d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--9ebf541f-1562-49bf-ae19-307fe2bb2e7a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.602662Z", + "modified": "2024-10-22T00:37:11.602662Z", + "name": "CVE-2024-40084", + "description": "A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exceptionally long HTTP methods or paths.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-40084" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--9f740f2d-b638-49ab-9d2a-e73f4b49fd0f.json b/objects/vulnerability/vulnerability--9f740f2d-b638-49ab-9d2a-e73f4b49fd0f.json new file mode 100644 index 00000000000..a487c70ab03 --- /dev/null +++ b/objects/vulnerability/vulnerability--9f740f2d-b638-49ab-9d2a-e73f4b49fd0f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3e3e0f47-f3cc-4300-ba3f-471bb382e0ea", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--9f740f2d-b638-49ab-9d2a-e73f4b49fd0f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.866615Z", + "modified": "2024-10-22T00:37:10.866615Z", + "name": "CVE-2024-47696", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency\n\nIn the commit aee2424246f9 (\"RDMA/iwcm: Fix a use-after-free related to\ndestroying CM IDs\"), the function flush_workqueue is invoked to flush the\nwork queue iwcm_wq.\n\nBut at that time, the work queue iwcm_wq was created via the function\nalloc_ordered_workqueue without the flag WQ_MEM_RECLAIM.\n\nBecause the current process is trying to flush the whole iwcm_wq, if\niwcm_wq doesn't have the flag WQ_MEM_RECLAIM, verify that the current\nprocess is not reclaiming memory or running on a workqueue which doesn't\nhave the flag WQ_MEM_RECLAIM as that can break forward-progress guarantee\nleading to a deadlock.\n\nThe call trace is as below:\n\n[ 125.350876][ T1430] Call Trace:\n[ 125.356281][ T1430] \n[ 125.361285][ T1430] ? __warn (kernel/panic.c:693)\n[ 125.367640][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9))\n[ 125.375689][ T1430] ? report_bug (lib/bug.c:180 lib/bug.c:219)\n[ 125.382505][ T1430] ? handle_bug (arch/x86/kernel/traps.c:239)\n[ 125.388987][ T1430] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1))\n[ 125.395831][ T1430] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621)\n[ 125.403125][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9))\n[ 125.410984][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9))\n[ 125.418764][ T1430] __flush_workqueue (kernel/workqueue.c:3970)\n[ 125.426021][ T1430] ? __pfx___might_resched (kernel/sched/core.c:10151)\n[ 125.433431][ T1430] ? destroy_cm_id (drivers/infiniband/core/iwcm.c:375) iw_cm\n[ 125.441209][ T1430] ? __pfx___flush_workqueue (kernel/workqueue.c:3910)\n[ 125.473900][ T1430] ? _raw_spin_lock_irqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162)\n[ 125.473909][ T1430] ? __pfx__raw_spin_lock_irqsave (kernel/locking/spinlock.c:161)\n[ 125.482537][ T1430] _destroy_id (drivers/infiniband/core/cma.c:2044) rdma_cm\n[ 125.495072][ T1430] nvme_rdma_free_queue (drivers/nvme/host/rdma.c:656 drivers/nvme/host/rdma.c:650) nvme_rdma\n[ 125.505827][ T1430] nvme_rdma_reset_ctrl_work (drivers/nvme/host/rdma.c:2180) nvme_rdma\n[ 125.505831][ T1430] process_one_work (kernel/workqueue.c:3231)\n[ 125.515122][ T1430] worker_thread (kernel/workqueue.c:3306 kernel/workqueue.c:3393)\n[ 125.515127][ T1430] ? __pfx_worker_thread (kernel/workqueue.c:3339)\n[ 125.531837][ T1430] kthread (kernel/kthread.c:389)\n[ 125.539864][ T1430] ? __pfx_kthread (kernel/kthread.c:342)\n[ 125.550628][ T1430] ret_from_fork (arch/x86/kernel/process.c:147)\n[ 125.558840][ T1430] ? __pfx_kthread (kernel/kthread.c:342)\n[ 125.558844][ T1430] ret_from_fork_asm (arch/x86/entry/entry_64.S:257)\n[ 125.566487][ T1430] \n[ 125.566488][ T1430] ---[ end trace 0000000000000000 ]---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47696" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a080f190-625a-40d3-a941-4dde0b76f4f7.json b/objects/vulnerability/vulnerability--a080f190-625a-40d3-a941-4dde0b76f4f7.json new file mode 100644 index 00000000000..9e3af525dfb --- /dev/null +++ b/objects/vulnerability/vulnerability--a080f190-625a-40d3-a941-4dde0b76f4f7.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d8691c5e-f13e-480e-9661-5f66739c87e9", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a080f190-625a-40d3-a941-4dde0b76f4f7", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.974767Z", + "modified": "2024-10-22T00:37:10.974767Z", + "name": "CVE-2024-50055", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: bus: Fix double free in driver API bus_register()\n\nFor bus_register(), any error which happens after kset_register() will\ncause that @priv are freed twice, fixed by setting @priv with NULL after\nthe first free.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50055" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a1dbd01a-6582-4377-9330-3209a541b0dd.json b/objects/vulnerability/vulnerability--a1dbd01a-6582-4377-9330-3209a541b0dd.json new file mode 100644 index 00000000000..44eddc0e6e0 --- /dev/null +++ b/objects/vulnerability/vulnerability--a1dbd01a-6582-4377-9330-3209a541b0dd.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4627c363-0177-4af7-94f6-fd2c7f7a7ef9", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a1dbd01a-6582-4377-9330-3209a541b0dd", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.924421Z", + "modified": "2024-10-22T00:37:10.924421Z", + "name": "CVE-2024-47743", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: prevent NULL pointer dereference in find_asymmetric_key()\n\nIn find_asymmetric_key(), if all NULLs are passed in the id_{0,1,2}\narguments, the kernel will first emit WARN but then have an oops\nbecause id_2 gets dereferenced anyway.\n\nAdd the missing id_2 check and move WARN_ON() to the final else branch\nto avoid duplicate NULL checks.\n\nFound by Linux Verification Center (linuxtesting.org) with Svace static\nanalysis tool.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47743" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a2263916-77e5-4eeb-b2e6-7c5ae6a09fdd.json b/objects/vulnerability/vulnerability--a2263916-77e5-4eeb-b2e6-7c5ae6a09fdd.json new file mode 100644 index 00000000000..b118ed6707b --- /dev/null +++ b/objects/vulnerability/vulnerability--a2263916-77e5-4eeb-b2e6-7c5ae6a09fdd.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a6cbd07d-933b-4fcc-91b9-cb143c0f5592", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a2263916-77e5-4eeb-b2e6-7c5ae6a09fdd", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.929119Z", + "modified": "2024-10-22T00:37:17.929119Z", + "name": "CVE-2022-49020", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: Fix a potential socket leak in p9_socket_open\n\nBoth p9_fd_create_tcp() and p9_fd_create_unix() will call\np9_socket_open(). If the creation of p9_trans_fd fails,\np9_fd_create_tcp() and p9_fd_create_unix() will return an\nerror directly instead of releasing the cscoket, which will\nresult in a socket leak.\n\nThis patch adds sock_release() to fix the leak issue.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49020" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a330fb9b-3a1a-47c5-b882-cca2b5d938f1.json b/objects/vulnerability/vulnerability--a330fb9b-3a1a-47c5-b882-cca2b5d938f1.json new file mode 100644 index 00000000000..02919b63498 --- /dev/null +++ b/objects/vulnerability/vulnerability--a330fb9b-3a1a-47c5-b882-cca2b5d938f1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b574e64e-6c8a-47f0-be52-88f917092903", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a330fb9b-3a1a-47c5-b882-cca2b5d938f1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.039439Z", + "modified": "2024-10-22T00:37:12.039439Z", + "name": "CVE-2024-49366", + "description": "Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49366" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a4cea89b-791f-4e87-a200-093b14e488f9.json b/objects/vulnerability/vulnerability--a4cea89b-791f-4e87-a200-093b14e488f9.json new file mode 100644 index 00000000000..547fca8ded8 --- /dev/null +++ b/objects/vulnerability/vulnerability--a4cea89b-791f-4e87-a200-093b14e488f9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b67484b3-7cda-40cb-bd7e-dd4c69406c35", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a4cea89b-791f-4e87-a200-093b14e488f9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.144036Z", + "modified": "2024-10-22T00:37:12.144036Z", + "name": "CVE-2024-49966", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: cancel dqi_sync_work before freeing oinfo\n\nocfs2_global_read_info() will initialize and schedule dqi_sync_work at the\nend, if error occurs after successfully reading global quota, it will\ntrigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled:\n\nODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c\n\nThis reports that there is an active delayed work when freeing oinfo in\nerror handling, so cancel dqi_sync_work first. BTW, return status instead\nof -1 when .read_file_info fails.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49966" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a5f06037-4f48-42e8-bca6-6c200f61e041.json b/objects/vulnerability/vulnerability--a5f06037-4f48-42e8-bca6-6c200f61e041.json new file mode 100644 index 00000000000..aa912097e91 --- /dev/null +++ b/objects/vulnerability/vulnerability--a5f06037-4f48-42e8-bca6-6c200f61e041.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--7f1eccfd-a5ad-49d6-a29e-c23083fdfd2d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a5f06037-4f48-42e8-bca6-6c200f61e041", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.631899Z", + "modified": "2024-10-22T00:37:16.631899Z", + "name": "CVE-2022-48971", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix not cleanup led when bt_init fails\n\nbt_init() calls bt_leds_init() to register led, but if it fails later,\nbt_leds_cleanup() is not called to unregister it.\n\nThis can cause panic if the argument \"bluetooth-power\" in text is freed\nand then another led_trigger_register() tries to access it:\n\nBUG: unable to handle page fault for address: ffffffffc06d3bc0\nRIP: 0010:strcmp+0xc/0x30\n Call Trace:\n \n led_trigger_register+0x10d/0x4f0\n led_trigger_register_simple+0x7d/0x100\n bt_init+0x39/0xf7 [bluetooth]\n do_one_initcall+0xd0/0x4e0", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48971" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a688a35e-59d8-4089-993b-28170dc31a59.json b/objects/vulnerability/vulnerability--a688a35e-59d8-4089-993b-28170dc31a59.json new file mode 100644 index 00000000000..c2e56bc2116 --- /dev/null +++ b/objects/vulnerability/vulnerability--a688a35e-59d8-4089-993b-28170dc31a59.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--30dc951a-bc40-46f7-bad0-bc40d26a8651", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a688a35e-59d8-4089-993b-28170dc31a59", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.945184Z", + "modified": "2024-10-22T00:37:17.945184Z", + "name": "CVE-2022-49004", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Sync efi page table's kernel mappings before switching\n\nThe EFI page table is initially created as a copy of the kernel page table.\nWith VMAP_STACK enabled, kernel stacks are allocated in the vmalloc area:\nif the stack is allocated in a new PGD (one that was not present at the\nmoment of the efi page table creation or not synced in a previous vmalloc\nfault), the kernel will take a trap when switching to the efi page table\nwhen the vmalloc kernel stack is accessed, resulting in a kernel panic.\n\nFix that by updating the efi kernel mappings before switching to the efi\npage table.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49004" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a69df355-45e4-4c08-b420-ee513584f9d1.json b/objects/vulnerability/vulnerability--a69df355-45e4-4c08-b420-ee513584f9d1.json new file mode 100644 index 00000000000..880a02d75d2 --- /dev/null +++ b/objects/vulnerability/vulnerability--a69df355-45e4-4c08-b420-ee513584f9d1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d9853431-b156-4d11-a3f7-9d0ce640a9b2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a69df355-45e4-4c08-b420-ee513584f9d1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.87592Z", + "modified": "2024-10-22T00:37:10.87592Z", + "name": "CVE-2024-47328", + "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Automation By Autonami allows SQL Injection.This issue affects Automation By Autonami: from n/a through 3.1.2.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47328" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a6a268ed-3380-470c-9e22-e6d75d30df47.json b/objects/vulnerability/vulnerability--a6a268ed-3380-470c-9e22-e6d75d30df47.json new file mode 100644 index 00000000000..6c976fb9ce7 --- /dev/null +++ b/objects/vulnerability/vulnerability--a6a268ed-3380-470c-9e22-e6d75d30df47.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3e0e48c1-704d-4448-a919-fbbd71abcfc4", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a6a268ed-3380-470c-9e22-e6d75d30df47", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.826886Z", + "modified": "2024-10-22T00:37:10.826886Z", + "name": "CVE-2024-47726", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to wait dio completion\n\nIt should wait all existing dio write IOs before block removal,\notherwise, previous direct write IO may overwrite data in the\nblock which may be reused by other inode.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47726" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a80f78c6-d5dd-405a-886d-218781973ec3.json b/objects/vulnerability/vulnerability--a80f78c6-d5dd-405a-886d-218781973ec3.json new file mode 100644 index 00000000000..bfee99811f7 --- /dev/null +++ b/objects/vulnerability/vulnerability--a80f78c6-d5dd-405a-886d-218781973ec3.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6a81236b-e0ac-4d96-97ae-2d43fd80dd97", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a80f78c6-d5dd-405a-886d-218781973ec3", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.168339Z", + "modified": "2024-10-22T00:37:12.168339Z", + "name": "CVE-2024-49927", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/ioapic: Handle allocation failures gracefully\n\nBreno observed panics when using failslab under certain conditions during\nruntime:\n\n can not alloc irq_pin_list (-1,0,20)\n Kernel panic - not syncing: IO-APIC: failed to add irq-pin. Can not proceed\n\n panic+0x4e9/0x590\n mp_irqdomain_alloc+0x9ab/0xa80\n irq_domain_alloc_irqs_locked+0x25d/0x8d0\n __irq_domain_alloc_irqs+0x80/0x110\n mp_map_pin_to_irq+0x645/0x890\n acpi_register_gsi_ioapic+0xe6/0x150\n hpet_open+0x313/0x480\n\nThat's a pointless panic which is a leftover of the historic IO/APIC code\nwhich panic'ed during early boot when the interrupt allocation failed.\n\nThe only place which might justify panic is the PIT/HPET timer_check() code\nwhich tries to figure out whether the timer interrupt is delivered through\nthe IO/APIC. But that code does not require to handle interrupt allocation\nfailures. If the interrupt cannot be allocated then timer delivery fails\nand it either panics due to that or falls back to legacy mode.\n\nCure this by removing the panic wrapper around __add_pin_to_irq_node() and\nmaking mp_irqdomain_alloc() aware of the failure condition and handle it as\nany other failure in this function gracefully.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49927" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a902391b-b543-4f67-a19d-911051a74f0f.json b/objects/vulnerability/vulnerability--a902391b-b543-4f67-a19d-911051a74f0f.json new file mode 100644 index 00000000000..05941c9a6da --- /dev/null +++ b/objects/vulnerability/vulnerability--a902391b-b543-4f67-a19d-911051a74f0f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5b8d8dbe-f50a-4f3f-9109-63db8bdb2e86", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a902391b-b543-4f67-a19d-911051a74f0f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.521635Z", + "modified": "2024-10-22T00:37:12.521635Z", + "name": "CVE-2024-46326", + "description": "Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout function.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-46326" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a959b860-741d-45b1-bba6-58c3555924bc.json b/objects/vulnerability/vulnerability--a959b860-741d-45b1-bba6-58c3555924bc.json new file mode 100644 index 00000000000..603a799b2cf --- /dev/null +++ b/objects/vulnerability/vulnerability--a959b860-741d-45b1-bba6-58c3555924bc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8278fcb0-53da-44da-afee-d75a6136d716", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a959b860-741d-45b1-bba6-58c3555924bc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.825425Z", + "modified": "2024-10-22T00:37:10.825425Z", + "name": "CVE-2024-47689", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error()\n\nsyzbot reports a f2fs bug as below:\n\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 58 at kernel/rcu/sync.c:177 rcu_sync_dtor+0xcd/0x180 kernel/rcu/sync.c:177\nCPU: 1 UID: 0 PID: 58 Comm: kworker/1:2 Not tainted 6.10.0-syzkaller-12562-g1722389b0d86 #0\nWorkqueue: events destroy_super_work\nRIP: 0010:rcu_sync_dtor+0xcd/0x180 kernel/rcu/sync.c:177\nCall Trace:\n percpu_free_rwsem+0x41/0x80 kernel/locking/percpu-rwsem.c:42\n destroy_super_work+0xec/0x130 fs/super.c:282\n process_one_work kernel/workqueue.c:3231 [inline]\n process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312\n worker_thread+0x86d/0xd40 kernel/workqueue.c:3390\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nAs Christian Brauner pointed out [1]: the root cause is f2fs sets\nSB_RDONLY flag in internal function, rather than setting the flag\ncovered w/ sb->s_umount semaphore via remount procedure, then below\nrace condition causes this bug:\n\n- freeze_super()\n - sb_wait_write(sb, SB_FREEZE_WRITE)\n - sb_wait_write(sb, SB_FREEZE_PAGEFAULT)\n - sb_wait_write(sb, SB_FREEZE_FS)\n\t\t\t\t\t- f2fs_handle_critical_error\n\t\t\t\t\t - sb->s_flags |= SB_RDONLY\n- thaw_super\n - thaw_super_locked\n - sb_rdonly() is true, so it skips\n sb_freeze_unlock(sb, SB_FREEZE_FS)\n - deactivate_locked_super\n\nSince f2fs has almost the same logic as ext4 [2] when handling critical\nerror in filesystem if it mounts w/ errors=remount-ro option:\n- set CP_ERROR_FLAG flag which indicates filesystem is stopped\n- record errors to superblock\n- set SB_RDONLY falg\nOnce we set CP_ERROR_FLAG flag, all writable interfaces can detect the\nflag and stop any further updates on filesystem. So, it is safe to not\nset SB_RDONLY flag, let's remove the logic and keep in line w/ ext4 [3].\n\n[1] https://lore.kernel.org/all/20240729-himbeeren-funknetz-96e62f9c7aee@brauner\n[2] https://lore.kernel.org/all/20240729132721.hxih6ehigadqf7wx@quack3\n[3] https://lore.kernel.org/linux-ext4/20240805201241.27286-1-jack@suse.cz", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47689" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--a9755a0f-4f6a-43fa-9e16-61f7a5f60449.json b/objects/vulnerability/vulnerability--a9755a0f-4f6a-43fa-9e16-61f7a5f60449.json new file mode 100644 index 00000000000..7f51d868210 --- /dev/null +++ b/objects/vulnerability/vulnerability--a9755a0f-4f6a-43fa-9e16-61f7a5f60449.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ec9173b4-b730-4bc2-a3a1-e7a92163f42a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--a9755a0f-4f6a-43fa-9e16-61f7a5f60449", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.14174Z", + "modified": "2024-10-22T00:37:12.14174Z", + "name": "CVE-2024-49913", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream\n\nThis commit addresses a null pointer dereference issue in the\n`commit_planes_for_stream` function at line 4140. The issue could occur\nwhen `top_pipe_to_program` is null.\n\nThe fix adds a check to ensure `top_pipe_to_program` is not null before\naccessing its stream_res. This prevents a null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program' could be null (see line 3906)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49913" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--aafcb74b-fb9a-4f68-ba03-8b2536440e5a.json b/objects/vulnerability/vulnerability--aafcb74b-fb9a-4f68-ba03-8b2536440e5a.json new file mode 100644 index 00000000000..81fe9516840 --- /dev/null +++ b/objects/vulnerability/vulnerability--aafcb74b-fb9a-4f68-ba03-8b2536440e5a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--77015283-b4d5-41d6-a91a-6202497846e3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--aafcb74b-fb9a-4f68-ba03-8b2536440e5a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.016578Z", + "modified": "2024-10-22T00:37:11.016578Z", + "name": "CVE-2024-50017", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/ident_map: Use gbpages only where full GB page should be mapped.\n\nWhen ident_pud_init() uses only GB pages to create identity maps, large\nranges of addresses not actually requested can be included in the resulting\ntable; a 4K request will map a full GB. This can include a lot of extra\naddress space past that requested, including areas marked reserved by the\nBIOS. That allows processor speculation into reserved regions, that on UV\nsystems can cause system halts.\n\nOnly use GB pages when map creation requests include the full GB page of\nspace. Fall back to using smaller 2M pages when only portions of a GB page\nare included in the request.\n\nNo attempt is made to coalesce mapping requests. If a request requires a\nmap entry at the 2M (pmd) level, subsequent mapping requests within the\nsame 1G region will also be at the pmd level, even if adjacent or\noverlapping such requests could have been combined to map a full GB page.\nExisting usage starts with larger regions and then adds smaller regions, so\nthis should not have any great consequence.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50017" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ab644506-5d60-4acc-9011-2ea5c55cb6e7.json b/objects/vulnerability/vulnerability--ab644506-5d60-4acc-9011-2ea5c55cb6e7.json new file mode 100644 index 00000000000..d4a48657ae5 --- /dev/null +++ b/objects/vulnerability/vulnerability--ab644506-5d60-4acc-9011-2ea5c55cb6e7.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4a4f356a-8971-46a9-8dec-fdb905f25fb9", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ab644506-5d60-4acc-9011-2ea5c55cb6e7", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.639632Z", + "modified": "2024-10-22T00:37:16.639632Z", + "name": "CVE-2022-48984", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: slcan: fix freed work crash\n\nThe LTP test pty03 is causing a crash in slcan:\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 0 PID: 348 Comm: kworker/0:3 Not tainted 6.0.8-1-default #1 openSUSE Tumbleweed 9d20364b934f5aab0a9bdf84e8f45cfdfae39dab\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014\n Workqueue: 0x0 (events)\n RIP: 0010:process_one_work (/home/rich/kernel/linux/kernel/workqueue.c:706 /home/rich/kernel/linux/kernel/workqueue.c:2185)\n Code: 49 89 ff 41 56 41 55 41 54 55 53 48 89 f3 48 83 ec 10 48 8b 06 48 8b 6f 48 49 89 c4 45 30 e4 a8 04 b8 00 00 00 00 4c 0f 44 e0 <49> 8b 44 24 08 44 8b a8 00 01 00 00 41 83 e5 20 f6 45 10 04 75 0e\n RSP: 0018:ffffaf7b40f47e98 EFLAGS: 00010046\n RAX: 0000000000000000 RBX: ffff9d644e1b8b48 RCX: ffff9d649e439968\n RDX: 00000000ffff8455 RSI: ffff9d644e1b8b48 RDI: ffff9d64764aa6c0\n RBP: ffff9d649e4335c0 R08: 0000000000000c00 R09: ffff9d64764aa734\n R10: 0000000000000007 R11: 0000000000000001 R12: 0000000000000000\n R13: ffff9d649e4335e8 R14: ffff9d64490da780 R15: ffff9d64764aa6c0\n FS: 0000000000000000(0000) GS:ffff9d649e400000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000008 CR3: 0000000036424000 CR4: 00000000000006f0\n Call Trace:\n \n worker_thread (/home/rich/kernel/linux/kernel/workqueue.c:2436)\n kthread (/home/rich/kernel/linux/kernel/kthread.c:376)\n ret_from_fork (/home/rich/kernel/linux/arch/x86/entry/entry_64.S:312)\n\nApparently, the slcan's tx_work is freed while being scheduled. While\nslcan_netdev_close() (netdev side) calls flush_work(&sl->tx_work),\nslcan_close() (tty side) does not. So when the netdev is never set UP,\nbut the tty is stuffed with bytes and forced to wakeup write, the work\nis scheduled, but never flushed.\n\nSo add an additional flush_work() to slcan_close() to be sure the work\nis flushed under all circumstances.\n\nThe Fixes commit below moved flush_work() from slcan_close() to\nslcan_netdev_close(). What was the rationale behind it? Maybe we can\ndrop the one in slcan_netdev_close()?\n\nI see the same pattern in can327. So it perhaps needs the very same fix.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48984" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ac300193-5e67-4faa-90d0-b845ab886706.json b/objects/vulnerability/vulnerability--ac300193-5e67-4faa-90d0-b845ab886706.json new file mode 100644 index 00000000000..30ad9417335 --- /dev/null +++ b/objects/vulnerability/vulnerability--ac300193-5e67-4faa-90d0-b845ab886706.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--71394d72-c318-439f-be38-164fc9afc9c6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ac300193-5e67-4faa-90d0-b845ab886706", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.199617Z", + "modified": "2024-10-22T00:37:12.199617Z", + "name": "CVE-2024-49894", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in degamma hardware format translation\n\nFixes index out of bounds issue in\n`cm_helper_translate_curve_to_degamma_hw_format` function. The issue\ncould occur when the index 'i' exceeds the number of transfer function\npoints (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds the function returns\nfalse to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49894" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ac47ea91-9426-4b23-8d4e-2c25d5124c52.json b/objects/vulnerability/vulnerability--ac47ea91-9426-4b23-8d4e-2c25d5124c52.json new file mode 100644 index 00000000000..ebb463faa32 --- /dev/null +++ b/objects/vulnerability/vulnerability--ac47ea91-9426-4b23-8d4e-2c25d5124c52.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a1056fce-a70e-44dd-a0a7-9d55d01c2fdc", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ac47ea91-9426-4b23-8d4e-2c25d5124c52", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.076013Z", + "modified": "2024-10-22T00:37:12.076013Z", + "name": "CVE-2024-49957", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix null-ptr-deref when journal load failed.\n\nDuring the mounting process, if journal_reset() fails because of too short\njournal, then lead to jbd2_journal_load() fails with NULL j_sb_buffer. \nSubsequently, ocfs2_journal_shutdown() calls\njbd2_journal_flush()->jbd2_cleanup_journal_tail()->\n__jbd2_update_log_tail()->jbd2_journal_update_sb_log_tail()\n->lock_buffer(journal->j_sb_buffer), resulting in a null-pointer\ndereference error.\n\nTo resolve this issue, we should check the JBD2_LOADED flag to ensure the\njournal was properly loaded. Additionally, use journal instead of\nosb->journal directly to simplify the code.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49957" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ac4b1119-72de-4c3d-b532-ed76392e85e3.json b/objects/vulnerability/vulnerability--ac4b1119-72de-4c3d-b532-ed76392e85e3.json new file mode 100644 index 00000000000..33485365ff7 --- /dev/null +++ b/objects/vulnerability/vulnerability--ac4b1119-72de-4c3d-b532-ed76392e85e3.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--61144327-0776-4976-80bd-e5cf599811b8", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ac4b1119-72de-4c3d-b532-ed76392e85e3", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.975775Z", + "modified": "2024-10-22T00:37:10.975775Z", + "name": "CVE-2024-50021", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix improper handling of refcount in ice_dpll_init_rclk_pins()\n\nThis patch addresses a reference count handling issue in the\nice_dpll_init_rclk_pins() function. The function calls ice_dpll_get_pins(),\nwhich increments the reference count of the relevant resources. However,\nif the condition WARN_ON((!vsi || !vsi->netdev)) is met, the function\ncurrently returns an error without properly releasing the resources\nacquired by ice_dpll_get_pins(), leading to a reference count leak.\n\nTo resolve this, the check has been moved to the top of the function. This\nensures that the function verifies the state before any resources are\nacquired, avoiding the need for additional resource management in the\nerror path.\n\nThis bug was identified by an experimental static analysis tool developed\nby our team. The tool specializes in analyzing reference count operations\nand detecting potential issues where resources are not properly managed.\nIn this case, the tool flagged the missing release operation as a\npotential problem, which led to the development of this patch.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50021" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--adc1ef53-b0e8-4caf-b6e7-17e3f4adee09.json b/objects/vulnerability/vulnerability--adc1ef53-b0e8-4caf-b6e7-17e3f4adee09.json new file mode 100644 index 00000000000..dd32cc6da4c --- /dev/null +++ b/objects/vulnerability/vulnerability--adc1ef53-b0e8-4caf-b6e7-17e3f4adee09.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--572e65c8-6e4e-4dd1-97d8-4c6db32b5fb2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--adc1ef53-b0e8-4caf-b6e7-17e3f4adee09", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.042223Z", + "modified": "2024-10-22T00:37:12.042223Z", + "name": "CVE-2024-49924", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: pxafb: Fix possible use after free in pxafb_task()\n\nIn the pxafb_probe function, it calls the pxafb_init_fbinfo function,\nafter which &fbi->task is associated with pxafb_task. Moreover,\nwithin this pxafb_init_fbinfo function, the pxafb_blank function\nwithin the &pxafb_ops struct is capable of scheduling work.\n\nIf we remove the module which will call pxafb_remove to make cleanup,\nit will call unregister_framebuffer function which can call\ndo_unregister_framebuffer to free fbi->fb through\nput_fb_info(fb_info), while the work mentioned above will be used.\nThe sequence of operations that may lead to a UAF bug is as follows:\n\nCPU0 CPU1\n\n | pxafb_task\npxafb_remove |\nunregister_framebuffer(info) |\ndo_unregister_framebuffer(fb_info) |\nput_fb_info(fb_info) |\n// free fbi->fb | set_ctrlr_state(fbi, state)\n | __pxafb_lcd_power(fbi, 0)\n | fbi->lcd_power(on, &fbi->fb.var)\n | //use fbi->fb\n\nFix it by ensuring that the work is canceled before proceeding\nwith the cleanup in pxafb_remove.\n\nNote that only root user can remove the driver at runtime.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49924" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ade81491-b9c2-4982-9907-5d50db0576c6.json b/objects/vulnerability/vulnerability--ade81491-b9c2-4982-9907-5d50db0576c6.json new file mode 100644 index 00000000000..a192f3c89fa --- /dev/null +++ b/objects/vulnerability/vulnerability--ade81491-b9c2-4982-9907-5d50db0576c6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2ab647ed-1194-4177-9ac6-e81869b24b25", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ade81491-b9c2-4982-9907-5d50db0576c6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.640741Z", + "modified": "2024-10-22T00:37:16.640741Z", + "name": "CVE-2022-48947", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix u8 overflow\n\nBy keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases\nmultiple times and eventually it will wrap around the maximum number\n(i.e., 255).\nThis patch prevents this by adding a boundary check with\nL2CAP_MAX_CONF_RSP\n\nBtmon log:\nBluetooth monitor ver 5.64\n= Note: Linux version 6.1.0-rc2 (x86_64) 0.264594\n= Note: Bluetooth subsystem version 2.22 0.264636\n@ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191\n= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604\n@ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741\n= Open Index: 00:00:00:00:00:00 [hci0] 13.900426\n(...)\n> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106\n invalid packet size (12 != 1033)\n 08 00 01 00 02 01 04 00 01 10 ff ff ............\n> ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561\n invalid packet size (14 != 1547)\n 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@.....\n> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390\n invalid packet size (16 != 2061)\n 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@.......\n> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932\n invalid packet size (16 != 2061)\n 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@.......\n= bluetoothd: Bluetooth daemon 5.43 14.401828\n> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753\n invalid packet size (12 != 1033)\n 08 00 01 00 04 01 04 00 40 00 00 00 ........@...", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48947" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--adf7a46f-f25e-4a4d-9fbc-05e65c6e51ff.json b/objects/vulnerability/vulnerability--adf7a46f-f25e-4a4d-9fbc-05e65c6e51ff.json new file mode 100644 index 00000000000..53d92e2dc20 --- /dev/null +++ b/objects/vulnerability/vulnerability--adf7a46f-f25e-4a4d-9fbc-05e65c6e51ff.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0cf5c1d0-3412-4536-a20c-e35410550e81", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--adf7a46f-f25e-4a4d-9fbc-05e65c6e51ff", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.848684Z", + "modified": "2024-10-22T00:37:10.848684Z", + "name": "CVE-2024-47711", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Don't return OOB skb in manage_oob().\n\nsyzbot reported use-after-free in unix_stream_recv_urg(). [0]\n\nThe scenario is\n\n 1. send(MSG_OOB)\n 2. recv(MSG_OOB)\n -> The consumed OOB remains in recv queue\n 3. send(MSG_OOB)\n 4. recv()\n -> manage_oob() returns the next skb of the consumed OOB\n -> This is also OOB, but unix_sk(sk)->oob_skb is not cleared\n 5. recv(MSG_OOB)\n -> unix_sk(sk)->oob_skb is used but already freed\n\nThe recent commit 8594d9b85c07 (\"af_unix: Don't call skb_get() for OOB\nskb.\") uncovered the issue.\n\nIf the OOB skb is consumed and the next skb is peeked in manage_oob(),\nwe still need to check if the skb is OOB.\n\nLet's do so by falling back to the following checks in manage_oob()\nand add the test case in selftest.\n\nNote that we need to add a similar check for SIOCATMARK.\n\n[0]:\nBUG: KASAN: slab-use-after-free in unix_stream_read_actor+0xa6/0xb0 net/unix/af_unix.c:2959\nRead of size 4 at addr ffff8880326abcc4 by task syz-executor178/5235\n\nCPU: 0 UID: 0 PID: 5235 Comm: syz-executor178 Not tainted 6.11.0-rc5-syzkaller-00742-gfbdaffe41adc #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nCall Trace:\n \n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n unix_stream_read_actor+0xa6/0xb0 net/unix/af_unix.c:2959\n unix_stream_recv_urg+0x1df/0x320 net/unix/af_unix.c:2640\n unix_stream_read_generic+0x2456/0x2520 net/unix/af_unix.c:2778\n unix_stream_recvmsg+0x22b/0x2c0 net/unix/af_unix.c:2996\n sock_recvmsg_nosec net/socket.c:1046 [inline]\n sock_recvmsg+0x22f/0x280 net/socket.c:1068\n ____sys_recvmsg+0x1db/0x470 net/socket.c:2816\n ___sys_recvmsg net/socket.c:2858 [inline]\n __sys_recvmsg+0x2f0/0x3e0 net/socket.c:2888\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f5360d6b4e9\nCode: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fff29b3a458 EFLAGS: 00000246 ORIG_RAX: 000000000000002f\nRAX: ffffffffffffffda RBX: 00007fff29b3a638 RCX: 00007f5360d6b4e9\nRDX: 0000000000002001 RSI: 0000000020000640 RDI: 0000000000000003\nRBP: 00007f5360dde610 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 00007fff29b3a628 R14: 0000000000000001 R15: 0000000000000001\n \n\nAllocated by task 5235:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n unpoison_slab_object mm/kasan/common.c:312 [inline]\n __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338\n kasan_slab_alloc include/linux/kasan.h:201 [inline]\n slab_post_alloc_hook mm/slub.c:3988 [inline]\n slab_alloc_node mm/slub.c:4037 [inline]\n kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4080\n __alloc_skb+0x1c3/0x440 net/core/skbuff.c:667\n alloc_skb include/linux/skbuff.h:1320 [inline]\n alloc_skb_with_frags+0xc3/0x770 net/core/skbuff.c:6528\n sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2815\n sock_alloc_send_skb include/net/sock.h:1778 [inline]\n queue_oob+0x108/0x680 net/unix/af_unix.c:2198\n unix_stream_sendmsg+0xd24/0xf80 net/unix/af_unix.c:2351\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:745\n ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597\n ___sys_sendmsg net/socket.c:2651 [inline]\n __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 5235:\n kasan_save_stack mm/kasan/common.c:47\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47711" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--aeea1a7b-4130-4251-a72a-e488e8edfc9a.json b/objects/vulnerability/vulnerability--aeea1a7b-4130-4251-a72a-e488e8edfc9a.json new file mode 100644 index 00000000000..c19f48b04e3 --- /dev/null +++ b/objects/vulnerability/vulnerability--aeea1a7b-4130-4251-a72a-e488e8edfc9a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2ce12b22-5fe6-40c1-b072-8e6232095e35", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--aeea1a7b-4130-4251-a72a-e488e8edfc9a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.158424Z", + "modified": "2024-10-22T00:37:12.158424Z", + "name": "CVE-2024-49921", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before used\n\n[WHAT & HOW]\nPoniters, such as dc->clk_mgr, are null checked previously in the same\nfunction, so Coverity warns \"implies that \"dc->clk_mgr\" might be null\".\nAs a result, these pointers need to be checked when used again.\n\nThis fixes 10 FORWARD_NULL issues reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49921" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--af15fcd2-641a-4a05-94e3-9b0e0165aa20.json b/objects/vulnerability/vulnerability--af15fcd2-641a-4a05-94e3-9b0e0165aa20.json new file mode 100644 index 00000000000..39ee26612c3 --- /dev/null +++ b/objects/vulnerability/vulnerability--af15fcd2-641a-4a05-94e3-9b0e0165aa20.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9545aa8b-0d2e-4d25-9908-333ea38f3f19", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--af15fcd2-641a-4a05-94e3-9b0e0165aa20", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.970963Z", + "modified": "2024-10-22T00:37:10.970963Z", + "name": "CVE-2024-50057", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tipd: Free IRQ only if it was requested before\n\nIn polling mode, if no IRQ was requested there is no need to free it.\nCall devm_free_irq() only if client->irq is set. This fixes the warning\ncaused by the tps6598x module removal:\n\nWARNING: CPU: 2 PID: 333 at kernel/irq/devres.c:144 devm_free_irq+0x80/0x8c\n...\n...\nCall trace:\n devm_free_irq+0x80/0x8c\n tps6598x_remove+0x28/0x88 [tps6598x]\n i2c_device_remove+0x2c/0x9c\n device_remove+0x4c/0x80\n device_release_driver_internal+0x1cc/0x228\n driver_detach+0x50/0x98\n bus_remove_driver+0x6c/0xbc\n driver_unregister+0x30/0x60\n i2c_del_driver+0x54/0x64\n tps6598x_i2c_driver_exit+0x18/0xc3c [tps6598x]\n __arm64_sys_delete_module+0x184/0x264\n invoke_syscall+0x48/0x110\n el0_svc_common.constprop.0+0xc8/0xe8\n do_el0_svc+0x20/0x2c\n el0_svc+0x28/0x98\n el0t_64_sync_handler+0x13c/0x158\n el0t_64_sync+0x190/0x194", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50057" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--afeb0527-a997-428c-b554-4e73ef3c351e.json b/objects/vulnerability/vulnerability--afeb0527-a997-428c-b554-4e73ef3c351e.json new file mode 100644 index 00000000000..292c7f20a94 --- /dev/null +++ b/objects/vulnerability/vulnerability--afeb0527-a997-428c-b554-4e73ef3c351e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--413883c9-99f0-43ac-a227-251c35beea1e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--afeb0527-a997-428c-b554-4e73ef3c351e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.109332Z", + "modified": "2024-10-22T00:37:12.109332Z", + "name": "CVE-2024-49899", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Initialize denominators' default to 1\n\n[WHAT & HOW]\nVariables used as denominators and maybe not assigned to other values,\nshould not be 0. Change their default to 1 so they are never 0.\n\nThis fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49899" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b0554f50-ccc6-4c4e-8fa6-b26f25dbbb7c.json b/objects/vulnerability/vulnerability--b0554f50-ccc6-4c4e-8fa6-b26f25dbbb7c.json new file mode 100644 index 00000000000..7c17d2e7d42 --- /dev/null +++ b/objects/vulnerability/vulnerability--b0554f50-ccc6-4c4e-8fa6-b26f25dbbb7c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--273504dc-6c2c-47e8-a2b5-deb0f8783495", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b0554f50-ccc6-4c4e-8fa6-b26f25dbbb7c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.933256Z", + "modified": "2024-10-22T00:37:10.933256Z", + "name": "CVE-2024-47699", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential null-ptr-deref in nilfs_btree_insert()\n\nPatch series \"nilfs2: fix potential issues with empty b-tree nodes\".\n\nThis series addresses three potential issues with empty b-tree nodes that\ncan occur with corrupted filesystem images, including one recently\ndiscovered by syzbot.\n\n\nThis patch (of 3):\n\nIf a b-tree is broken on the device, and the b-tree height is greater than\n2 (the level of the root node is greater than 1) even if the number of\nchild nodes of the b-tree root is 0, a NULL pointer dereference occurs in\nnilfs_btree_prepare_insert(), which is called from nilfs_btree_insert().\n\nThis is because, when the number of child nodes of the b-tree root is 0,\nnilfs_btree_do_lookup() does not set the block buffer head in any of\npath[x].bp_bh, leaving it as the initial value of NULL, but if the level\nof the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(),\nwhich accesses the buffer memory of path[x].bp_bh, is called.\n\nFix this issue by adding a check to nilfs_btree_root_broken(), which\nperforms sanity checks when reading the root node from the device, to\ndetect this inconsistency.\n\nThanks to Lizhi Xu for trying to solve the bug and clarifying the cause\nearly on.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47699" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b131d1ef-867e-4ac8-b938-8b04807787ad.json b/objects/vulnerability/vulnerability--b131d1ef-867e-4ac8-b938-8b04807787ad.json new file mode 100644 index 00000000000..5de04a8ad93 --- /dev/null +++ b/objects/vulnerability/vulnerability--b131d1ef-867e-4ac8-b938-8b04807787ad.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--79ce8367-a42f-4854-8cc6-501018eb034c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b131d1ef-867e-4ac8-b938-8b04807787ad", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.726601Z", + "modified": "2024-10-22T00:37:16.726601Z", + "name": "CVE-2022-48999", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Handle attempt to delete multipath route when fib_info contains an nh reference\n\nGwangun Jung reported a slab-out-of-bounds access in fib_nh_match:\n fib_nh_match+0xf98/0x1130 linux-6.0-rc7/net/ipv4/fib_semantics.c:961\n fib_table_delete+0x5f3/0xa40 linux-6.0-rc7/net/ipv4/fib_trie.c:1753\n inet_rtm_delroute+0x2b3/0x380 linux-6.0-rc7/net/ipv4/fib_frontend.c:874\n\nSeparate nexthop objects are mutually exclusive with the legacy\nmultipath spec. Fix fib_nh_match to return if the config for the\nto be deleted route contains a multipath spec while the fib_info\nis using a nexthop object.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48999" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b1f3ca13-eb6a-406b-a870-13c194c9e528.json b/objects/vulnerability/vulnerability--b1f3ca13-eb6a-406b-a870-13c194c9e528.json new file mode 100644 index 00000000000..67feae26f0b --- /dev/null +++ b/objects/vulnerability/vulnerability--b1f3ca13-eb6a-406b-a870-13c194c9e528.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b9492bd9-faf6-4734-8c80-f417a3f7f598", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b1f3ca13-eb6a-406b-a870-13c194c9e528", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.148552Z", + "modified": "2024-10-22T00:37:12.148552Z", + "name": "CVE-2024-49853", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix double free in OPTEE transport\n\nChannels can be shared between protocols, avoid freeing the same channel\ndescriptors twice when unloading the stack.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49853" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b20a712a-b53c-409a-b68a-2243dfc94238.json b/objects/vulnerability/vulnerability--b20a712a-b53c-409a-b68a-2243dfc94238.json new file mode 100644 index 00000000000..f65c1e26325 --- /dev/null +++ b/objects/vulnerability/vulnerability--b20a712a-b53c-409a-b68a-2243dfc94238.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--17454f81-d662-4534-87b2-b6cadbcab8cb", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b20a712a-b53c-409a-b68a-2243dfc94238", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.154567Z", + "modified": "2024-10-22T00:37:12.154567Z", + "name": "CVE-2024-49884", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix slab-use-after-free in ext4_split_extent_at()\n\nWe hit the following use-after-free:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in ext4_split_extent_at+0xba8/0xcc0\nRead of size 2 at addr ffff88810548ed08 by task kworker/u20:0/40\nCPU: 0 PID: 40 Comm: kworker/u20:0 Not tainted 6.9.0-dirty #724\nCall Trace:\n \n kasan_report+0x93/0xc0\n ext4_split_extent_at+0xba8/0xcc0\n ext4_split_extent.isra.0+0x18f/0x500\n ext4_split_convert_extents+0x275/0x750\n ext4_ext_handle_unwritten_extents+0x73e/0x1580\n ext4_ext_map_blocks+0xe20/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n\nAllocated by task 40:\n __kmalloc_noprof+0x1ac/0x480\n ext4_find_extent+0xf3b/0x1e70\n ext4_ext_map_blocks+0x188/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n\nFreed by task 40:\n kfree+0xf1/0x2b0\n ext4_find_extent+0xa71/0x1e70\n ext4_ext_insert_extent+0xa22/0x3260\n ext4_split_extent_at+0x3ef/0xcc0\n ext4_split_extent.isra.0+0x18f/0x500\n ext4_split_convert_extents+0x275/0x750\n ext4_ext_handle_unwritten_extents+0x73e/0x1580\n ext4_ext_map_blocks+0xe20/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n==================================================================\n\nThe flow of issue triggering is as follows:\n\next4_split_extent_at\n path = *ppath\n ext4_ext_insert_extent(ppath)\n ext4_ext_create_new_leaf(ppath)\n ext4_find_extent(orig_path)\n path = *orig_path\n read_extent_tree_block\n // return -ENOMEM or -EIO\n ext4_free_ext_path(path)\n kfree(path)\n *orig_path = NULL\n a. If err is -ENOMEM:\n ext4_ext_dirty(path + path->p_depth)\n // path use-after-free !!!\n b. If err is -EIO and we have EXT_DEBUG defined:\n ext4_ext_show_leaf(path)\n eh = path[depth].p_hdr\n // path also use-after-free !!!\n\nSo when trying to zeroout or fix the extent length, call ext4_find_extent()\nto update the path.\n\nIn addition we use *ppath directly as an ext4_ext_show_leaf() input to\navoid possible use-after-free when EXT_DEBUG is defined, and to avoid\nunnecessary path updates.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49884" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b26833d2-6008-42a0-a5ea-155356702bba.json b/objects/vulnerability/vulnerability--b26833d2-6008-42a0-a5ea-155356702bba.json new file mode 100644 index 00000000000..f94564fd71f --- /dev/null +++ b/objects/vulnerability/vulnerability--b26833d2-6008-42a0-a5ea-155356702bba.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5d2a4767-fb11-42a5-9895-ab40a4ec164c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b26833d2-6008-42a0-a5ea-155356702bba", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.925443Z", + "modified": "2024-10-22T00:37:10.925443Z", + "name": "CVE-2024-47684", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: check skb is non-NULL in tcp_rto_delta_us()\n\nWe have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic\nkernel that are running ceph and recently hit a null ptr dereference in\ntcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also\nsaw it getting hit from the RACK case as well. Here are examples of the oops\nmessages we saw in each of those cases:\n\nJul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020\nJul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode\nJul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page\nJul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0\nJul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI\nJul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu\nJul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023\nJul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160\nJul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3\nJul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246\nJul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000\nJul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60\nJul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8\nJul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900\nJul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30\nJul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000\nJul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nJul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0\nJul 26 15:05:02 rx [11061395.913822] PKRU: 55555554\nJul 26 15:05:02 rx [11061395.916786] Call Trace:\nJul 26 15:05:02 rx [11061395.919488]\nJul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f\nJul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9\nJul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380\nJul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0\nJul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50\nJul 26 15:05:02 rx [11061395.943000] ? __bad_area_nosemaphore+0x50/0x1a0\nJul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20\nJul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450\nJul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140\nJul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90\nJul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0\nJul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40\nJul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160\nJul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160\nJul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220\nJul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240\nJul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0\nJul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240\nJul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130\nJul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280\nJul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10\nJul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30\nJul 26 15:05:02 rx [11061396.017718] ? lapic_next_even\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47684" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b3c177d6-dce7-47d8-b688-d1fe85785509.json b/objects/vulnerability/vulnerability--b3c177d6-dce7-47d8-b688-d1fe85785509.json new file mode 100644 index 00000000000..39d741e86d1 --- /dev/null +++ b/objects/vulnerability/vulnerability--b3c177d6-dce7-47d8-b688-d1fe85785509.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0582da76-cc4c-4cd9-8d23-4231464145f4", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b3c177d6-dce7-47d8-b688-d1fe85785509", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.430725Z", + "modified": "2024-10-22T00:37:11.430725Z", + "name": "CVE-2024-8901", + "description": "The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer and issuer validation. In uncommon deployments of ALB, wherein endpoints are exposed to internet traffic, an actor can provide a JWT signed by an untrusted entity in order to spoof OIDC-federated sessions and successfully bypass authentication.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-8901" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b3e421de-f837-4753-a6a6-dbf13fe5e7ad.json b/objects/vulnerability/vulnerability--b3e421de-f837-4753-a6a6-dbf13fe5e7ad.json new file mode 100644 index 00000000000..a0679e588ce --- /dev/null +++ b/objects/vulnerability/vulnerability--b3e421de-f837-4753-a6a6-dbf13fe5e7ad.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--cab7fca9-9b01-4a97-808b-dbd7b2207cd3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b3e421de-f837-4753-a6a6-dbf13fe5e7ad", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.121759Z", + "modified": "2024-10-22T00:37:12.121759Z", + "name": "CVE-2024-49933", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk_iocost: fix more out of bound shifts\n\nRecently running UBSAN caught few out of bound shifts in the\nioc_forgive_debts() function:\n\nUBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38\nshift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long\nlong')\n...\nUBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30\nshift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long\nlong')\n...\nCall Trace:\n\ndump_stack_lvl+0xca/0x130\n__ubsan_handle_shift_out_of_bounds+0x22c/0x280\n? __lock_acquire+0x6441/0x7c10\nioc_timer_fn+0x6cec/0x7750\n? blk_iocost_init+0x720/0x720\n? call_timer_fn+0x5d/0x470\ncall_timer_fn+0xfa/0x470\n? blk_iocost_init+0x720/0x720\n__run_timer_base+0x519/0x700\n...\n\nActual impact of this issue was not identified but I propose to fix the\nundefined behaviour.\nThe proposed fix to prevent those out of bound shifts consist of\nprecalculating exponent before using it the shift operations by taking\nmin value from the actual exponent and maximum possible number of bits.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49933" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b45fa98f-444b-4730-956c-e07c40ae00e9.json b/objects/vulnerability/vulnerability--b45fa98f-444b-4730-956c-e07c40ae00e9.json new file mode 100644 index 00000000000..1b0ba22ab3f --- /dev/null +++ b/objects/vulnerability/vulnerability--b45fa98f-444b-4730-956c-e07c40ae00e9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--7fbea5cc-737c-45c2-9dce-e8d013857ac1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b45fa98f-444b-4730-956c-e07c40ae00e9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.144995Z", + "modified": "2024-10-22T00:37:12.144995Z", + "name": "CVE-2024-49367", + "description": "Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49367" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b4911309-0592-4a8f-9e6c-94848ff6c7c6.json b/objects/vulnerability/vulnerability--b4911309-0592-4a8f-9e6c-94848ff6c7c6.json new file mode 100644 index 00000000000..715fae6552d --- /dev/null +++ b/objects/vulnerability/vulnerability--b4911309-0592-4a8f-9e6c-94848ff6c7c6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--04b3b670-25c9-430a-aff2-dcc2ee7af2d4", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b4911309-0592-4a8f-9e6c-94848ff6c7c6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.131306Z", + "modified": "2024-10-22T00:37:12.131306Z", + "name": "CVE-2024-49882", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix double brelse() the buffer of the extents path\n\nIn ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been\nreleased, otherwise it may be released twice. An example of what triggers\nthis is as follows:\n\n split2 map split1\n|--------|-------|--------|\n\next4_ext_map_blocks\n ext4_ext_handle_unwritten_extents\n ext4_split_convert_extents\n // path->p_depth == 0\n ext4_split_extent\n // 1. do split1\n ext4_split_extent_at\n |ext4_ext_insert_extent\n | ext4_ext_create_new_leaf\n | ext4_ext_grow_indepth\n | le16_add_cpu(&neh->eh_depth, 1)\n | ext4_find_extent\n | // return -ENOMEM\n |// get error and try zeroout\n |path = ext4_find_extent\n | path->p_depth = 1\n |ext4_ext_try_to_merge\n | ext4_ext_try_to_merge_up\n | path->p_depth = 0\n | brelse(path[1].p_bh) ---> not set to NULL here\n |// zeroout success\n // 2. update path\n ext4_find_extent\n // 3. do split2\n ext4_split_extent_at\n ext4_ext_insert_extent\n ext4_ext_create_new_leaf\n ext4_ext_grow_indepth\n le16_add_cpu(&neh->eh_depth, 1)\n ext4_find_extent\n path[0].p_bh = NULL;\n path->p_depth = 1\n read_extent_tree_block ---> return err\n // path[1].p_bh is still the old value\n ext4_free_ext_path\n ext4_ext_drop_refs\n // path->p_depth == 1\n brelse(path[1].p_bh) ---> brelse a buffer twice\n\nFinally got the following WARRNING when removing the buffer from lru:\n\n============================================\nVFS: brelse: Trying to free free buffer\nWARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90\nCPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716\nRIP: 0010:__brelse+0x58/0x90\nCall Trace:\n \n __find_get_block+0x6e7/0x810\n bdev_getblk+0x2b/0x480\n __ext4_get_inode_loc+0x48a/0x1240\n ext4_get_inode_loc+0xb2/0x150\n ext4_reserve_inode_write+0xb7/0x230\n __ext4_mark_inode_dirty+0x144/0x6a0\n ext4_ext_insert_extent+0x9c8/0x3230\n ext4_ext_map_blocks+0xf45/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n============================================", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49882" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b4fb97bf-1ba7-40d5-829d-a817c623f9bf.json b/objects/vulnerability/vulnerability--b4fb97bf-1ba7-40d5-829d-a817c623f9bf.json new file mode 100644 index 00000000000..34d65dafb0d --- /dev/null +++ b/objects/vulnerability/vulnerability--b4fb97bf-1ba7-40d5-829d-a817c623f9bf.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--2c191dc3-4942-4c6d-ae08-e4378d03bfb7", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b4fb97bf-1ba7-40d5-829d-a817c623f9bf", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.696737Z", + "modified": "2024-10-22T00:37:16.696737Z", + "name": "CVE-2022-48957", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove()\n\nThe cmd_buff needs to be freed when error happened in\ndpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48957" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b752bdaa-3403-4190-be7f-818eb6e03c0f.json b/objects/vulnerability/vulnerability--b752bdaa-3403-4190-be7f-818eb6e03c0f.json new file mode 100644 index 00000000000..db410fc4f33 --- /dev/null +++ b/objects/vulnerability/vulnerability--b752bdaa-3403-4190-be7f-818eb6e03c0f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--824fc6fa-12eb-4079-894d-8160bddfed0e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b752bdaa-3403-4190-be7f-818eb6e03c0f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.870568Z", + "modified": "2024-10-22T00:37:10.870568Z", + "name": "CVE-2024-47757", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential oob read in nilfs_btree_check_delete()\n\nThe function nilfs_btree_check_delete(), which checks whether degeneration\nto direct mapping occurs before deleting a b-tree entry, causes memory\naccess outside the block buffer when retrieving the maximum key if the\nroot node has no entries.\n\nThis does not usually happen because b-tree mappings with 0 child nodes\nare never created by mkfs.nilfs2 or nilfs2 itself. However, it can happen\nif the b-tree root node read from a device is configured that way, so fix\nthis potential issue by adding a check for that case.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47757" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b764be02-9344-4570-8ff0-f6adad0a28c1.json b/objects/vulnerability/vulnerability--b764be02-9344-4570-8ff0-f6adad0a28c1.json new file mode 100644 index 00000000000..ad1e7e44c80 --- /dev/null +++ b/objects/vulnerability/vulnerability--b764be02-9344-4570-8ff0-f6adad0a28c1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6ce70fc3-cafe-4c49-ab55-94fc62d66084", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b764be02-9344-4570-8ff0-f6adad0a28c1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.048845Z", + "modified": "2024-10-22T00:37:12.048845Z", + "name": "CVE-2024-49926", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()\n\nFor kernels built with CONFIG_FORCE_NR_CPUS=y, the nr_cpu_ids is\ndefined as NR_CPUS instead of the number of possible cpus, this\nwill cause the following system panic:\n\nsmpboot: Allowing 4 CPUs, 0 hotplug CPUs\n...\nsetup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:512 nr_node_ids:1\n...\nBUG: unable to handle page fault for address: ffffffff9911c8c8\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 0 PID: 15 Comm: rcu_tasks_trace Tainted: G W\n6.6.21 #1 5dc7acf91a5e8e9ac9dcfc35bee0245691283ea6\nRIP: 0010:rcu_tasks_need_gpcb+0x25d/0x2c0\nRSP: 0018:ffffa371c00a3e60 EFLAGS: 00010082\nCR2: ffffffff9911c8c8 CR3: 000000040fa20005 CR4: 00000000001706f0\nCall Trace:\n\n? __die+0x23/0x80\n? page_fault_oops+0xa4/0x180\n? exc_page_fault+0x152/0x180\n? asm_exc_page_fault+0x26/0x40\n? rcu_tasks_need_gpcb+0x25d/0x2c0\n? __pfx_rcu_tasks_kthread+0x40/0x40\nrcu_tasks_one_gp+0x69/0x180\nrcu_tasks_kthread+0x94/0xc0\nkthread+0xe8/0x140\n? __pfx_kthread+0x40/0x40\nret_from_fork+0x34/0x80\n? __pfx_kthread+0x40/0x40\nret_from_fork_asm+0x1b/0x80\n\n\nConsidering that there may be holes in the CPU numbers, use the\nmaximum possible cpu number, instead of nr_cpu_ids, for configuring\nenqueue and dequeue limits.\n\n[ neeraj.upadhyay: Fix htmldocs build error reported by Stephen Rothwell ]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49926" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b78f4235-cda5-44ab-b1a4-53c560c35540.json b/objects/vulnerability/vulnerability--b78f4235-cda5-44ab-b1a4-53c560c35540.json new file mode 100644 index 00000000000..08174330ad4 --- /dev/null +++ b/objects/vulnerability/vulnerability--b78f4235-cda5-44ab-b1a4-53c560c35540.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--7b2587c0-2f32-4e49-a84e-c53aee5c617d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b78f4235-cda5-44ab-b1a4-53c560c35540", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.043512Z", + "modified": "2024-10-22T00:37:12.043512Z", + "name": "CVE-2024-49912", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'\n\nThis commit adds a null check for 'stream_status' in the function\n'planes_changed_for_existing_stream'. Previously, the code assumed\n'stream_status' could be null, but did not handle the case where it was\nactually null. This could lead to a null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream() error: we previously assumed 'stream_status' could be null (see line 3774)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49912" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b7b4334e-fd52-43c1-84db-313eabc1d244.json b/objects/vulnerability/vulnerability--b7b4334e-fd52-43c1-84db-313eabc1d244.json new file mode 100644 index 00000000000..8f64979fc0a --- /dev/null +++ b/objects/vulnerability/vulnerability--b7b4334e-fd52-43c1-84db-313eabc1d244.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e6b2bb9a-f0b2-46b2-ab12-ee7f7091f11c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b7b4334e-fd52-43c1-84db-313eabc1d244", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.172144Z", + "modified": "2024-10-22T00:37:12.172144Z", + "name": "CVE-2024-49871", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: adp5589-keys - fix NULL pointer dereference\n\nWe register a devm action to call adp5589_clear_config() and then pass\nthe i2c client as argument so that we can call i2c_get_clientdata() in\norder to get our device object. However, i2c_set_clientdata() is only\nbeing set at the end of the probe function which means that we'll get a\nNULL pointer dereference in case the probe function fails early.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49871" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b81d7fe8-3128-4f30-a62f-36d30afad35e.json b/objects/vulnerability/vulnerability--b81d7fe8-3128-4f30-a62f-36d30afad35e.json new file mode 100644 index 00000000000..2ea913cd4ba --- /dev/null +++ b/objects/vulnerability/vulnerability--b81d7fe8-3128-4f30-a62f-36d30afad35e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f9125206-b50d-41e5-8a1a-ac9d1354d720", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b81d7fe8-3128-4f30-a62f-36d30afad35e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.958104Z", + "modified": "2024-10-22T00:37:10.958104Z", + "name": "CVE-2024-47737", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: call cache_put if xdr_reserve_space returns NULL\n\nIf not enough buffer space available, but idmap_lookup has triggered\nlookup_fn which calls cache_get and returns successfully. Then we\nmissed to call cache_put here which pairs with cache_get.\n\nReviwed-by: Jeff Layton ", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47737" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--b941a21a-a6aa-4a6a-b149-8247c4a382c5.json b/objects/vulnerability/vulnerability--b941a21a-a6aa-4a6a-b149-8247c4a382c5.json new file mode 100644 index 00000000000..dce4a973c91 --- /dev/null +++ b/objects/vulnerability/vulnerability--b941a21a-a6aa-4a6a-b149-8247c4a382c5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--449ce448-0242-4cb6-a652-f3ee862fd820", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--b941a21a-a6aa-4a6a-b149-8247c4a382c5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.033691Z", + "modified": "2024-10-22T00:37:11.033691Z", + "name": "CVE-2024-50043", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix possible badness in FREE_STATEID\n\nWhen multiple FREE_STATEIDs are sent for the same delegation stateid,\nit can lead to a possible either use-after-free or counter refcount\nunderflow errors.\n\nIn nfsd4_free_stateid() under the client lock we find a delegation\nstateid, however the code drops the lock before calling nfs4_put_stid(),\nthat allows another FREE_STATE to find the stateid again. The first one\nwill proceed to then free the stateid which leads to either\nuse-after-free or decrementing already zeroed counter.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50043" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--baec1cea-3c2e-45c2-886d-c2eb45629145.json b/objects/vulnerability/vulnerability--baec1cea-3c2e-45c2-886d-c2eb45629145.json new file mode 100644 index 00000000000..ca60b9c0cf8 --- /dev/null +++ b/objects/vulnerability/vulnerability--baec1cea-3c2e-45c2-886d-c2eb45629145.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--674fbd35-ae61-4b17-b856-56bba9d3cb88", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--baec1cea-3c2e-45c2-886d-c2eb45629145", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.001621Z", + "modified": "2024-10-22T00:37:11.001621Z", + "name": "CVE-2024-50010", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: don't WARN for racy path_noexec check\n\nBoth i_mode and noexec checks wrapped in WARN_ON stem from an artifact\nof the previous implementation. They used to legitimately check for the\ncondition, but that got moved up in two commits:\n633fb6ac3980 (\"exec: move S_ISREG() check earlier\")\n0fd338b2d2cd (\"exec: move path_noexec() check earlier\")\n\nInstead of being removed said checks are WARN_ON'ed instead, which\nhas some debug value.\n\nHowever, the spurious path_noexec check is racy, resulting in\nunwarranted warnings should someone race with setting the noexec flag.\n\nOne can note there is more to perm-checking whether execve is allowed\nand none of the conditions are guaranteed to still hold after they were\ntested for.\n\nAdditionally this does not validate whether the code path did any perm\nchecking to begin with -- it will pass if the inode happens to be\nregular.\n\nKeep the redundant path_noexec() check even though it's mindless\nnonsense checking for guarantee that isn't given so drop the WARN.\n\nReword the commentary and do small tidy ups while here.\n\n[brauner: keep redundant path_noexec() check]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50010" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--bb915663-b658-4abc-9b5f-84bc5b715a9f.json b/objects/vulnerability/vulnerability--bb915663-b658-4abc-9b5f-84bc5b715a9f.json new file mode 100644 index 00000000000..573ed6bb98f --- /dev/null +++ b/objects/vulnerability/vulnerability--bb915663-b658-4abc-9b5f-84bc5b715a9f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8df8bdc4-11ba-4080-aa8a-1d6ce190bde1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--bb915663-b658-4abc-9b5f-84bc5b715a9f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.187477Z", + "modified": "2024-10-22T00:37:12.187477Z", + "name": "CVE-2024-49938", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit\n\nSyzbot points out that skb_trim() has a sanity check on the existing length of\nthe skb, which can be uninitialised in some error paths. The intent here is\nclearly just to reset the length to zero before resubmitting, so switch to\ncalling __skb_set_length(skb, 0) directly. In addition, __skb_set_length()\nalready contains a call to skb_reset_tail_pointer(), so remove the redundant\ncall.\n\nThe syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar\nusage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49938" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--bd05a2b6-35ab-45f1-8cbb-68a8eb347034.json b/objects/vulnerability/vulnerability--bd05a2b6-35ab-45f1-8cbb-68a8eb347034.json new file mode 100644 index 00000000000..ddef8cbfdaa --- /dev/null +++ b/objects/vulnerability/vulnerability--bd05a2b6-35ab-45f1-8cbb-68a8eb347034.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--568c281e-5f58-4e68-b761-8f2db8c2afbf", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--bd05a2b6-35ab-45f1-8cbb-68a8eb347034", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.108345Z", + "modified": "2024-10-22T00:37:12.108345Z", + "name": "CVE-2024-49943", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc_submit: add missing locking in wedged_fini\n\nAny non-wedged queue can have a zero refcount here and can be running\nconcurrently with an async queue destroy, therefore dereferencing the\nqueue ptr to check wedge status after the lookup can trigger UAF if\nqueue is not wedged. Fix this by keeping the submission_state lock held\naround the check to postpone the free and make the check safe, before\ndropping again around the put() to avoid the deadlock.\n\n(cherry picked from commit d28af0b6b9580b9f90c265a7da0315b0ad20bbfd)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49943" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--bd223e83-3f8f-4677-a111-e7cc9f8a0739.json b/objects/vulnerability/vulnerability--bd223e83-3f8f-4677-a111-e7cc9f8a0739.json new file mode 100644 index 00000000000..baa3872804b --- /dev/null +++ b/objects/vulnerability/vulnerability--bd223e83-3f8f-4677-a111-e7cc9f8a0739.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a0838ddd-30c4-4d61-bb41-7a0d9503aee1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--bd223e83-3f8f-4677-a111-e7cc9f8a0739", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.918698Z", + "modified": "2024-10-22T00:37:17.918698Z", + "name": "CVE-2022-49019", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: nixge: fix NULL dereference\n\nIn function nixge_hw_dma_bd_release() dereference of NULL pointer\npriv->rx_bd_v is possible for the case of its allocation failure in\nnixge_hw_dma_bd_init().\n\nMove for() loop with priv->rx_bd_v dereference under the check for\nits validity.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49019" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--bd6dae7a-4d76-4e4f-bc2d-861806c09b21.json b/objects/vulnerability/vulnerability--bd6dae7a-4d76-4e4f-bc2d-861806c09b21.json new file mode 100644 index 00000000000..508ff55b1eb --- /dev/null +++ b/objects/vulnerability/vulnerability--bd6dae7a-4d76-4e4f-bc2d-861806c09b21.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6fccb2d7-70ff-4d4d-ac43-72a6ea448d6f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--bd6dae7a-4d76-4e4f-bc2d-861806c09b21", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.830378Z", + "modified": "2024-10-22T00:37:10.830378Z", + "name": "CVE-2024-47756", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: keystone: Fix if-statement expression in ks_pcie_quirk()\n\nThis code accidentally uses && where || was intended. It potentially\nresults in a NULL dereference.\n\nThus, fix the if-statement expression to use the correct condition.\n\n[kwilczynski: commit log]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47756" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--be7bafae-047b-4b17-85c6-0a3142e24244.json b/objects/vulnerability/vulnerability--be7bafae-047b-4b17-85c6-0a3142e24244.json new file mode 100644 index 00000000000..8bf6d53fc59 --- /dev/null +++ b/objects/vulnerability/vulnerability--be7bafae-047b-4b17-85c6-0a3142e24244.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--997ec199-798c-4160-84f3-86eb80e4ea10", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--be7bafae-047b-4b17-85c6-0a3142e24244", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.953984Z", + "modified": "2024-10-22T00:37:10.953984Z", + "name": "CVE-2024-47678", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nicmp: change the order of rate limits\n\nICMP messages are ratelimited :\n\nAfter the blamed commits, the two rate limiters are applied in this order:\n\n1) host wide ratelimit (icmp_global_allow())\n\n2) Per destination ratelimit (inetpeer based)\n\nIn order to avoid side-channels attacks, we need to apply\nthe per destination check first.\n\nThis patch makes the following change :\n\n1) icmp_global_allow() checks if the host wide limit is reached.\n But credits are not yet consumed. This is deferred to 3)\n\n2) The per destination limit is checked/updated.\n This might add a new node in inetpeer tree.\n\n3) icmp_global_consume() consumes tokens if prior operations succeeded.\n\nThis means that host wide ratelimit is still effective\nin keeping inetpeer tree small even under DDOS.\n\nAs a bonus, I removed icmp_global.lock as the fast path\ncan use a lock-free operation.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47678" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--bec55ea9-2b14-4bfc-bdf0-d73a8dbca2f6.json b/objects/vulnerability/vulnerability--bec55ea9-2b14-4bfc-bdf0-d73a8dbca2f6.json new file mode 100644 index 00000000000..c84c251133a --- /dev/null +++ b/objects/vulnerability/vulnerability--bec55ea9-2b14-4bfc-bdf0-d73a8dbca2f6.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1b2e5479-f823-4447-96fe-7656e07964c6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--bec55ea9-2b14-4bfc-bdf0-d73a8dbca2f6", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.656579Z", + "modified": "2024-10-22T00:37:16.656579Z", + "name": "CVE-2022-48988", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: fix possible use-after-free in memcg_write_event_control()\n\nmemcg_write_event_control() accesses the dentry->d_name of the specified\ncontrol fd to route the write call. As a cgroup interface file can't be\nrenamed, it's safe to access d_name as long as the specified file is a\nregular cgroup file. Also, as these cgroup interface files can't be\nremoved before the directory, it's safe to access the parent too.\n\nPrior to 347c4a874710 (\"memcg: remove cgroup_event->cft\"), there was a\ncall to __file_cft() which verified that the specified file is a regular\ncgroupfs file before further accesses. The cftype pointer returned from\n__file_cft() was no longer necessary and the commit inadvertently dropped\nthe file type check with it allowing any file to slip through. With the\ninvarients broken, the d_name and parent accesses can now race against\nrenames and removals of arbitrary files and cause use-after-free's.\n\nFix the bug by resurrecting the file type check in __file_cft(). Now that\ncgroupfs is implemented through kernfs, checking the file operations needs\nto go through a layer of indirection. Instead, let's check the superblock\nand dentry type.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48988" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--bfa72a01-2b47-4df2-a044-4d1918b90e2a.json b/objects/vulnerability/vulnerability--bfa72a01-2b47-4df2-a044-4d1918b90e2a.json new file mode 100644 index 00000000000..261eaae65ae --- /dev/null +++ b/objects/vulnerability/vulnerability--bfa72a01-2b47-4df2-a044-4d1918b90e2a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0aed7347-8d56-4ac4-b878-c4dad51948a9", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--bfa72a01-2b47-4df2-a044-4d1918b90e2a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.885944Z", + "modified": "2024-10-22T00:37:10.885944Z", + "name": "CVE-2024-47753", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: Fix VP8 stateless decoder smatch warning\n\nFix a smatch static checker warning on vdec_vp8_req_if.c.\nWhich leads to a kernel crash when fb is NULL.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47753" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c081e88c-45a9-4083-8cbd-dfde97eb4876.json b/objects/vulnerability/vulnerability--c081e88c-45a9-4083-8cbd-dfde97eb4876.json new file mode 100644 index 00000000000..d2c4ec4ee89 --- /dev/null +++ b/objects/vulnerability/vulnerability--c081e88c-45a9-4083-8cbd-dfde97eb4876.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e470fc3a-e5c2-4e0b-9a9b-882439ddedba", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c081e88c-45a9-4083-8cbd-dfde97eb4876", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.937614Z", + "modified": "2024-10-22T00:37:17.937614Z", + "name": "CVE-2022-49026", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ne100: Fix possible use after free in e100_xmit_prepare\n\nIn e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so\ne100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will\nresend the skb. But the skb is already freed, which will cause UAF bug\nwhen the upper layer resends the skb.\n\nRemove the harmful free.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49026" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c0c326db-3493-4b8f-8150-ff2873894488.json b/objects/vulnerability/vulnerability--c0c326db-3493-4b8f-8150-ff2873894488.json new file mode 100644 index 00000000000..c345adc8237 --- /dev/null +++ b/objects/vulnerability/vulnerability--c0c326db-3493-4b8f-8150-ff2873894488.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--26fcba22-eb07-4bd4-8f6f-7a2a34ad2b47", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c0c326db-3493-4b8f-8150-ff2873894488", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.046985Z", + "modified": "2024-10-22T00:37:12.046985Z", + "name": "CVE-2024-49962", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()\n\nACPICA commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0\n\nACPI_ALLOCATE_ZEROED() may fail, elements might be NULL and will cause\nNULL pointer dereference later.\n\n[ rjw: Subject and changelog edits ]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49962" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c0ebce48-88d5-4ba4-80c4-5f4e3a22137c.json b/objects/vulnerability/vulnerability--c0ebce48-88d5-4ba4-80c4-5f4e3a22137c.json new file mode 100644 index 00000000000..92b7f049b36 --- /dev/null +++ b/objects/vulnerability/vulnerability--c0ebce48-88d5-4ba4-80c4-5f4e3a22137c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--dcf3c652-6989-417a-ae3e-c6772c2104b6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c0ebce48-88d5-4ba4-80c4-5f4e3a22137c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.062271Z", + "modified": "2024-10-22T00:37:12.062271Z", + "name": "CVE-2024-49973", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nr8169: add tally counter fields added with RTL8125\n\nRTL8125 added fields to the tally counter, what may result in the chip\ndma'ing these new fields to unallocated memory. Therefore make sure\nthat the allocated memory area is big enough to hold all of the\ntally counter values, even if we use only parts of it.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49973" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c17f285a-f79c-4a2c-95ef-4ddff9a714ca.json b/objects/vulnerability/vulnerability--c17f285a-f79c-4a2c-95ef-4ddff9a714ca.json new file mode 100644 index 00000000000..05b22bdfe70 --- /dev/null +++ b/objects/vulnerability/vulnerability--c17f285a-f79c-4a2c-95ef-4ddff9a714ca.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--01da347b-d7be-4187-bb4b-7b5e7b473e48", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c17f285a-f79c-4a2c-95ef-4ddff9a714ca", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.936406Z", + "modified": "2024-10-22T00:37:17.936406Z", + "name": "CVE-2022-49022", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac8021: fix possible oob access in ieee80211_get_rate_duration\n\nFix possible out-of-bound access in ieee80211_get_rate_duration routine\nas reported by the following UBSAN report:\n\nUBSAN: array-index-out-of-bounds in net/mac80211/airtime.c:455:47\nindex 15 is out of range for type 'u16 [12]'\nCPU: 2 PID: 217 Comm: kworker/u32:10 Not tainted 6.1.0-060100rc3-generic\nHardware name: Acer Aspire TC-281/Aspire TC-281, BIOS R01-A2 07/18/2017\nWorkqueue: mt76 mt76u_tx_status_data [mt76_usb]\nCall Trace:\n \n show_stack+0x4e/0x61\n dump_stack_lvl+0x4a/0x6f\n dump_stack+0x10/0x18\n ubsan_epilogue+0x9/0x43\n __ubsan_handle_out_of_bounds.cold+0x42/0x47\nieee80211_get_rate_duration.constprop.0+0x22f/0x2a0 [mac80211]\n ? ieee80211_tx_status_ext+0x32e/0x640 [mac80211]\n ieee80211_calc_rx_airtime+0xda/0x120 [mac80211]\n ieee80211_calc_tx_airtime+0xb4/0x100 [mac80211]\n mt76x02_send_tx_status+0x266/0x480 [mt76x02_lib]\n mt76x02_tx_status_data+0x52/0x80 [mt76x02_lib]\n mt76u_tx_status_data+0x67/0xd0 [mt76_usb]\n process_one_work+0x225/0x400\n worker_thread+0x50/0x3e0\n ? process_one_work+0x400/0x400\n kthread+0xe9/0x110\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49022" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c2d0138c-fcfd-40a0-8f0a-410eac3a88fe.json b/objects/vulnerability/vulnerability--c2d0138c-fcfd-40a0-8f0a-410eac3a88fe.json new file mode 100644 index 00000000000..1c482aed46b --- /dev/null +++ b/objects/vulnerability/vulnerability--c2d0138c-fcfd-40a0-8f0a-410eac3a88fe.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d6306ebd-e2f0-4911-bdc3-bbd3f8731c34", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c2d0138c-fcfd-40a0-8f0a-410eac3a88fe", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.988705Z", + "modified": "2024-10-22T00:37:10.988705Z", + "name": "CVE-2024-50034", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC\n\nEric report a panic on IPPROTO_SMC, and give the facts\nthat when INET_PROTOSW_ICSK was set, icsk->icsk_sync_mss must be set too.\n\nBug: Unable to handle kernel NULL pointer dereference at virtual address\n0000000000000000\nMem abort info:\nESR = 0x0000000086000005\nEC = 0x21: IABT (current EL), IL = 32 bits\nSET = 0, FnV = 0\nEA = 0, S1PTW = 0\nFSC = 0x05: level 1 translation fault\nuser pgtable: 4k pages, 48-bit VAs, pgdp=00000001195d1000\n[0000000000000000] pgd=0800000109c46003, p4d=0800000109c46003,\npud=0000000000000000\nInternal error: Oops: 0000000086000005 [#1] PREEMPT SMP\nModules linked in:\nCPU: 1 UID: 0 PID: 8037 Comm: syz.3.265 Not tainted\n6.11.0-rc7-syzkaller-g5f5673607153 #0\nHardware name: Google Google Compute Engine/Google Compute Engine,\nBIOS Google 08/06/2024\npstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : 0x0\nlr : cipso_v4_sock_setattr+0x2a8/0x3c0 net/ipv4/cipso_ipv4.c:1910\nsp : ffff80009b887a90\nx29: ffff80009b887aa0 x28: ffff80008db94050 x27: 0000000000000000\nx26: 1fffe0001aa6f5b3 x25: dfff800000000000 x24: ffff0000db75da00\nx23: 0000000000000000 x22: ffff0000d8b78518 x21: 0000000000000000\nx20: ffff0000d537ad80 x19: ffff0000d8b78000 x18: 1fffe000366d79ee\nx17: ffff8000800614a8 x16: ffff800080569b84 x15: 0000000000000001\nx14: 000000008b336894 x13: 00000000cd96feaa x12: 0000000000000003\nx11: 0000000000040000 x10: 00000000000020a3 x9 : 1fffe0001b16f0f1\nx8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 0000000000000040 x4 : 0000000000000001 x3 : 0000000000000000\nx2 : 0000000000000002 x1 : 0000000000000000 x0 : ffff0000d8b78000\nCall trace:\n0x0\nnetlbl_sock_setattr+0x2e4/0x338 net/netlabel/netlabel_kapi.c:1000\nsmack_netlbl_add+0xa4/0x154 security/smack/smack_lsm.c:2593\nsmack_socket_post_create+0xa8/0x14c security/smack/smack_lsm.c:2973\nsecurity_socket_post_create+0x94/0xd4 security/security.c:4425\n__sock_create+0x4c8/0x884 net/socket.c:1587\nsock_create net/socket.c:1622 [inline]\n__sys_socket_create net/socket.c:1659 [inline]\n__sys_socket+0x134/0x340 net/socket.c:1706\n__do_sys_socket net/socket.c:1720 [inline]\n__se_sys_socket net/socket.c:1718 [inline]\n__arm64_sys_socket+0x7c/0x94 net/socket.c:1718\n__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\ninvoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\nel0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\ndo_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\nel0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712\nel0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730\nel0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598\nCode: ???????? ???????? ???????? ???????? (????????)\n---[ end trace 0000000000000000 ]---\n\nThis patch add a toy implementation that performs a simple return to\nprevent such panic. This is because MSS can be set in sock_create_kern\nor smc_setsockopt, similar to how it's done in AF_SMC. However, for\nAF_SMC, there is currently no way to synchronize MSS within\n__sys_connect_file. This toy implementation lays the groundwork for us\nto support such feature for IPPROTO_SMC in the future.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50034" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c3fe1e4e-19eb-4735-b908-d6c109df4b0f.json b/objects/vulnerability/vulnerability--c3fe1e4e-19eb-4735-b908-d6c109df4b0f.json new file mode 100644 index 00000000000..bac143fc1d0 --- /dev/null +++ b/objects/vulnerability/vulnerability--c3fe1e4e-19eb-4735-b908-d6c109df4b0f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--22fd873c-154d-4a4d-9127-17df28a2af1b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c3fe1e4e-19eb-4735-b908-d6c109df4b0f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.021771Z", + "modified": "2024-10-22T00:37:12.021771Z", + "name": "CVE-2024-49947", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: test for not too small csum_start in virtio_net_hdr_to_skb()\n\nsyzbot was able to trigger this warning [1], after injecting a\nmalicious packet through af_packet, setting skb->csum_start and thus\nthe transport header to an incorrect value.\n\nWe can at least make sure the transport header is after\nthe end of the network header (with a estimated minimal size).\n\n[1]\n[ 67.873027] skb len=4096 headroom=16 headlen=14 tailroom=0\nmac=(-1,-1) mac_len=0 net=(16,-6) trans=10\nshinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0))\ncsum(0xa start=10 offset=0 ip_summed=3 complete_sw=0 valid=0 level=0)\nhash(0x0 sw=0 l4=0) proto=0x0800 pkttype=0 iif=0\npriority=0x0 mark=0x0 alloc_cpu=10 vlan_all=0x0\nencapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)\n[ 67.877172] dev name=veth0_vlan feat=0x000061164fdd09e9\n[ 67.877764] sk family=17 type=3 proto=0\n[ 67.878279] skb linear: 00000000: 00 00 10 00 00 00 00 00 0f 00 00 00 08 00\n[ 67.879128] skb frag: 00000000: 0e 00 07 00 00 00 28 00 08 80 1c 00 04 00 00 02\n[ 67.879877] skb frag: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.880647] skb frag: 00000020: 00 00 02 00 00 00 08 00 1b 00 00 00 00 00 00 00\n[ 67.881156] skb frag: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.881753] skb frag: 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.882173] skb frag: 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.882790] skb frag: 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.883171] skb frag: 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.883733] skb frag: 00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.884206] skb frag: 00000090: 00 00 00 00 00 00 00 00 00 00 69 70 76 6c 61 6e\n[ 67.884704] skb frag: 000000a0: 31 00 00 00 00 00 00 00 00 00 2b 00 00 00 00 00\n[ 67.885139] skb frag: 000000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.885677] skb frag: 000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.886042] skb frag: 000000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.886408] skb frag: 000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.887020] skb frag: 000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 67.887384] skb frag: 00000100: 00 00\n[ 67.887878] ------------[ cut here ]------------\n[ 67.887908] offset (-6) >= skb_headlen() (14)\n[ 67.888445] WARNING: CPU: 10 PID: 2088 at net/core/dev.c:3332 skb_checksum_help (net/core/dev.c:3332 (discriminator 2))\n[ 67.889353] Modules linked in: macsec macvtap macvlan hsr wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 libchacha poly1305_x86_64 dummy bridge sr_mod cdrom evdev pcspkr i2c_piix4 9pnet_virtio 9p 9pnet netfs\n[ 67.890111] CPU: 10 UID: 0 PID: 2088 Comm: b363492833 Not tainted 6.11.0-virtme #1011\n[ 67.890183] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 67.890309] RIP: 0010:skb_checksum_help (net/core/dev.c:3332 (discriminator 2))\n[ 67.891043] Call Trace:\n[ 67.891173] \n[ 67.891274] ? __warn (kernel/panic.c:741)\n[ 67.891320] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2))\n[ 67.891333] ? report_bug (lib/bug.c:180 lib/bug.c:219)\n[ 67.891348] ? handle_bug (arch/x86/kernel/traps.c:239)\n[ 67.891363] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1))\n[ 67.891372] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621)\n[ 67.891388] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2))\n[ 67.891399] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2))\n[ 67.891416] ip_do_fragment (net/ipv4/ip_output.c:777 (discriminator 1))\n[ 67.891448] ? __ip_local_out (./include/linux/skbuff.h:1146 ./include/net/l3mdev.h:196 ./include/net/l3mdev.h:213 ne\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49947" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c5b0429b-e0ab-4527-a77a-6ec796d51a46.json b/objects/vulnerability/vulnerability--c5b0429b-e0ab-4527-a77a-6ec796d51a46.json new file mode 100644 index 00000000000..f16b8640b2a --- /dev/null +++ b/objects/vulnerability/vulnerability--c5b0429b-e0ab-4527-a77a-6ec796d51a46.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9765d154-de27-4f05-8a26-bba7962df208", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c5b0429b-e0ab-4527-a77a-6ec796d51a46", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.720361Z", + "modified": "2024-10-22T00:37:16.720361Z", + "name": "CVE-2022-48977", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: af_can: fix NULL pointer dereference in can_rcv_filter\n\nAnalogue to commit 8aa59e355949 (\"can: af_can: fix NULL pointer\ndereference in can_rx_register()\") we need to check for a missing\ninitialization of ml_priv in the receive path of CAN frames.\n\nSince commit 4e096a18867a (\"net: introduce CAN specific pointer in the\nstruct net_device\") the check for dev->type to be ARPHRD_CAN is not\nsufficient anymore since bonding or tun netdevices claim to be CAN\ndevices but do not initialize ml_priv accordingly.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48977" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c64f86d6-2863-4cd9-9659-03c9216d8c53.json b/objects/vulnerability/vulnerability--c64f86d6-2863-4cd9-9659-03c9216d8c53.json new file mode 100644 index 00000000000..77568adb69c --- /dev/null +++ b/objects/vulnerability/vulnerability--c64f86d6-2863-4cd9-9659-03c9216d8c53.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--41e64c4c-574f-4d8e-93c5-6fa7fae30918", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c64f86d6-2863-4cd9-9659-03c9216d8c53", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.194401Z", + "modified": "2024-10-22T00:37:12.194401Z", + "name": "CVE-2024-49989", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix double free issue during amdgpu module unload\n\nFlexible endpoints use DIGs from available inflexible endpoints,\nso only the encoders of inflexible links need to be freed.\nOtherwise, a double free issue may occur when unloading the\namdgpu module.\n\n[ 279.190523] RIP: 0010:__slab_free+0x152/0x2f0\n[ 279.190577] Call Trace:\n[ 279.190580] \n[ 279.190582] ? show_regs+0x69/0x80\n[ 279.190590] ? die+0x3b/0x90\n[ 279.190595] ? do_trap+0xc8/0xe0\n[ 279.190601] ? do_error_trap+0x73/0xa0\n[ 279.190605] ? __slab_free+0x152/0x2f0\n[ 279.190609] ? exc_invalid_op+0x56/0x70\n[ 279.190616] ? __slab_free+0x152/0x2f0\n[ 279.190642] ? asm_exc_invalid_op+0x1f/0x30\n[ 279.190648] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]\n[ 279.191096] ? __slab_free+0x152/0x2f0\n[ 279.191102] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]\n[ 279.191469] kfree+0x260/0x2b0\n[ 279.191474] dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]\n[ 279.191821] link_destroy+0xd7/0x130 [amdgpu]\n[ 279.192248] dc_destruct+0x90/0x270 [amdgpu]\n[ 279.192666] dc_destroy+0x19/0x40 [amdgpu]\n[ 279.193020] amdgpu_dm_fini+0x16e/0x200 [amdgpu]\n[ 279.193432] dm_hw_fini+0x26/0x40 [amdgpu]\n[ 279.193795] amdgpu_device_fini_hw+0x24c/0x400 [amdgpu]\n[ 279.194108] amdgpu_driver_unload_kms+0x4f/0x70 [amdgpu]\n[ 279.194436] amdgpu_pci_remove+0x40/0x80 [amdgpu]\n[ 279.194632] pci_device_remove+0x3a/0xa0\n[ 279.194638] device_remove+0x40/0x70\n[ 279.194642] device_release_driver_internal+0x1ad/0x210\n[ 279.194647] driver_detach+0x4e/0xa0\n[ 279.194650] bus_remove_driver+0x6f/0xf0\n[ 279.194653] driver_unregister+0x33/0x60\n[ 279.194657] pci_unregister_driver+0x44/0x90\n[ 279.194662] amdgpu_exit+0x19/0x1f0 [amdgpu]\n[ 279.194939] __do_sys_delete_module.isra.0+0x198/0x2f0\n[ 279.194946] __x64_sys_delete_module+0x16/0x20\n[ 279.194950] do_syscall_64+0x58/0x120\n[ 279.194954] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[ 279.194980] ", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49989" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c7acfa96-dc8d-4f3a-b59a-4fccbbc8c5e9.json b/objects/vulnerability/vulnerability--c7acfa96-dc8d-4f3a-b59a-4fccbbc8c5e9.json new file mode 100644 index 00000000000..2e79637cf99 --- /dev/null +++ b/objects/vulnerability/vulnerability--c7acfa96-dc8d-4f3a-b59a-4fccbbc8c5e9.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--15b5c800-0754-4e05-abab-121fa00bd100", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c7acfa96-dc8d-4f3a-b59a-4fccbbc8c5e9", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.128587Z", + "modified": "2024-10-22T00:37:12.128587Z", + "name": "CVE-2024-49935", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: PAD: fix crash in exit_round_robin()\n\nThe kernel occasionally crashes in cpumask_clear_cpu(), which is called\nwithin exit_round_robin(), because when executing clear_bit(nr, addr) with\nnr set to 0xffffffff, the address calculation may cause misalignment within\nthe memory, leading to access to an invalid memory address.\n\n----------\nBUG: unable to handle kernel paging request at ffffffffe0740618\n ...\nCPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G OE X --------- - - 4.18.0-425.19.2.el8_7.x86_64 #1\n ...\nRIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]\nCode: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31\nRSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202\nRAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246\nRBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8\nR10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e\nR13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e\nFS: 0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n ? acpi_pad_add+0x120/0x120 [acpi_pad]\n kthread+0x10b/0x130\n ? set_kthread_struct+0x50/0x50\n ret_from_fork+0x1f/0x40\n ...\nCR2: ffffffffe0740618\n\ncrash> dis -lr ffffffffc0726923\n ...\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 114\n0xffffffffc0726918 :\tmov %r12d,%r12d\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 325\n0xffffffffc072691b :\tmov -0x3f8d7de0(,%r12,4),%eax\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 80\n0xffffffffc0726923 :\tlock btr %rax,0x19cf4(%rip) # 0xffffffffc0740620 \n\ncrash> px tsk_in_cpu[14]\n$66 = 0xffffffff\n\ncrash> px 0xffffffffc072692c+0x19cf4\n$99 = 0xffffffffc0740620\n\ncrash> sym 0xffffffffc0740620\nffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]\n\ncrash> px pad_busy_cpus_bits[0]\n$42 = 0xfffc0\n----------\n\nTo fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling\ncpumask_clear_cpu() in exit_round_robin(), just as it is done in\nround_robin_cpu().\n\n[ rjw: Subject edit, avoid updates to the same value ]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49935" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c7f8e8d1-f306-4b90-a4af-ed7bf71099fc.json b/objects/vulnerability/vulnerability--c7f8e8d1-f306-4b90-a4af-ed7bf71099fc.json new file mode 100644 index 00000000000..35300f8dc78 --- /dev/null +++ b/objects/vulnerability/vulnerability--c7f8e8d1-f306-4b90-a4af-ed7bf71099fc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--84e0e13d-2ba2-4bfa-8c81-2bb9b4716f99", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c7f8e8d1-f306-4b90-a4af-ed7bf71099fc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.203136Z", + "modified": "2024-10-22T00:37:12.203136Z", + "name": "CVE-2024-49881", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: update orig_path in ext4_find_extent()\n\nIn ext4_find_extent(), if the path is not big enough, we free it and set\n*orig_path to NULL. But after reallocating and successfully initializing\nthe path, we don't update *orig_path, in which case the caller gets a\nvalid path but a NULL ppath, and this may cause a NULL pointer dereference\nor a path memory leak. For example:\n\next4_split_extent\n path = *ppath = 2000\n ext4_find_extent\n if (depth > path[0].p_maxdepth)\n kfree(path = 2000);\n *orig_path = path = NULL;\n path = kcalloc() = 3000\n ext4_split_extent_at(*ppath = NULL)\n path = *ppath;\n ex = path[depth].p_ext;\n // NULL pointer dereference!\n\n==================================================================\nBUG: kernel NULL pointer dereference, address: 0000000000000010\nCPU: 6 UID: 0 PID: 576 Comm: fsstress Not tainted 6.11.0-rc2-dirty #847\nRIP: 0010:ext4_split_extent_at+0x6d/0x560\nCall Trace:\n \n ext4_split_extent.isra.0+0xcb/0x1b0\n ext4_ext_convert_to_initialized+0x168/0x6c0\n ext4_ext_handle_unwritten_extents+0x325/0x4d0\n ext4_ext_map_blocks+0x520/0xdb0\n ext4_map_blocks+0x2b0/0x690\n ext4_iomap_begin+0x20e/0x2c0\n[...]\n==================================================================\n\nTherefore, *orig_path is updated when the extent lookup succeeds, so that\nthe caller can safely use path or *ppath.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49881" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c8504a75-8a75-4061-9193-db0e17f39944.json b/objects/vulnerability/vulnerability--c8504a75-8a75-4061-9193-db0e17f39944.json new file mode 100644 index 00000000000..ebabd2ab1b5 --- /dev/null +++ b/objects/vulnerability/vulnerability--c8504a75-8a75-4061-9193-db0e17f39944.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f44adc5e-9718-4d7b-90b0-e640854ca024", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c8504a75-8a75-4061-9193-db0e17f39944", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.025118Z", + "modified": "2024-10-22T00:37:12.025118Z", + "name": "CVE-2024-49942", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Prevent null pointer access in xe_migrate_copy\n\nxe_migrate_copy designed to copy content of TTM resources. When source\nresource is null, it will trigger a NULL pointer dereference in\nxe_migrate_copy. To avoid this situation, update lacks source flag to\ntrue for this case, the flag will trigger xe_migrate_clear rather than\nxe_migrate_copy.\n\nIssue trace:\n<7> [317.089847] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 14,\n sizes: 4194304 & 4194304\n<7> [317.089945] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 15,\n sizes: 4194304 & 4194304\n<1> [317.128055] BUG: kernel NULL pointer dereference, address:\n 0000000000000010\n<1> [317.128064] #PF: supervisor read access in kernel mode\n<1> [317.128066] #PF: error_code(0x0000) - not-present page\n<6> [317.128069] PGD 0 P4D 0\n<4> [317.128071] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\n<4> [317.128074] CPU: 1 UID: 0 PID: 1440 Comm: kunit_try_catch Tainted:\n G U N 6.11.0-rc7-xe #1\n<4> [317.128078] Tainted: [U]=USER, [N]=TEST\n<4> [317.128080] Hardware name: Intel Corporation Lunar Lake Client\n Platform/LNL-M LP5 RVP1, BIOS LNLMFWI1.R00.3221.D80.2407291239 07/29/2024\n<4> [317.128082] RIP: 0010:xe_migrate_copy+0x66/0x13e0 [xe]\n<4> [317.128158] Code: 00 00 48 89 8d e0 fe ff ff 48 8b 40 10 4c 89 85 c8\n fe ff ff 44 88 8d bd fe ff ff 65 48 8b 3c 25 28 00 00 00 48 89 7d d0 31\n ff <8b> 79 10 48 89 85 a0 fe ff ff 48 8b 00 48 89 b5 d8 fe ff ff 83 ff\n<4> [317.128162] RSP: 0018:ffffc9000167f9f0 EFLAGS: 00010246\n<4> [317.128164] RAX: ffff8881120d8028 RBX: ffff88814d070428 RCX:\n 0000000000000000\n<4> [317.128166] RDX: ffff88813cb99c00 RSI: 0000000004000000 RDI:\n 0000000000000000\n<4> [317.128168] RBP: ffffc9000167fbb8 R08: ffff88814e7b1f08 R09:\n 0000000000000001\n<4> [317.128170] R10: 0000000000000001 R11: 0000000000000001 R12:\n ffff88814e7b1f08\n<4> [317.128172] R13: ffff88814e7b1f08 R14: ffff88813cb99c00 R15:\n 0000000000000001\n<4> [317.128174] FS: 0000000000000000(0000) GS:ffff88846f280000(0000)\n knlGS:0000000000000000\n<4> [317.128176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n<4> [317.128178] CR2: 0000000000000010 CR3: 000000011f676004 CR4:\n 0000000000770ef0\n<4> [317.128180] DR0: 0000000000000000 DR1: 0000000000000000 DR2:\n 0000000000000000\n<4> [317.128182] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7:\n 0000000000000400\n<4> [317.128184] PKRU: 55555554\n<4> [317.128185] Call Trace:\n<4> [317.128187] \n<4> [317.128189] ? show_regs+0x67/0x70\n<4> [317.128194] ? __die_body+0x20/0x70\n<4> [317.128196] ? __die+0x2b/0x40\n<4> [317.128198] ? page_fault_oops+0x15f/0x4e0\n<4> [317.128203] ? do_user_addr_fault+0x3fb/0x970\n<4> [317.128205] ? lock_acquire+0xc7/0x2e0\n<4> [317.128209] ? exc_page_fault+0x87/0x2b0\n<4> [317.128212] ? asm_exc_page_fault+0x27/0x30\n<4> [317.128216] ? xe_migrate_copy+0x66/0x13e0 [xe]\n<4> [317.128263] ? __lock_acquire+0xb9d/0x26f0\n<4> [317.128265] ? __lock_acquire+0xb9d/0x26f0\n<4> [317.128267] ? sg_free_append_table+0x20/0x80\n<4> [317.128271] ? lock_acquire+0xc7/0x2e0\n<4> [317.128273] ? mark_held_locks+0x4d/0x80\n<4> [317.128275] ? trace_hardirqs_on+0x1e/0xd0\n<4> [317.128278] ? _raw_spin_unlock_irqrestore+0x31/0x60\n<4> [317.128281] ? __pm_runtime_resume+0x60/0xa0\n<4> [317.128284] xe_bo_move+0x682/0xc50 [xe]\n<4> [317.128315] ? lock_is_held_type+0xaa/0x120\n<4> [317.128318] ttm_bo_handle_move_mem+0xe5/0x1a0 [ttm]\n<4> [317.128324] ttm_bo_validate+0xd1/0x1a0 [ttm]\n<4> [317.128328] shrink_test_run_device+0x721/0xc10 [xe]\n<4> [317.128360] ? find_held_lock+0x31/0x90\n<4> [317.128363] ? lock_release+0xd1/0x2a0\n<4> [317.128365] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10\n [kunit]\n<4> [317.128370] xe_bo_shrink_kunit+0x11/0x20 [xe]\n<4> [317.128397] kunit_try_run_case+0x6e/0x150 [kunit]\n<4> [317.128400] ? trace_hardirqs_on+0x1e/0xd0\n<4> [317.128402] ? _raw_spin_unlock_irqrestore+0x31/0x60\n<4> [317.128404] kunit_generic_run_threadfn_adapter+0x1e/0x40 [ku\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49942" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c8af07c1-eb05-45b6-b623-4696edd5831f.json b/objects/vulnerability/vulnerability--c8af07c1-eb05-45b6-b623-4696edd5831f.json new file mode 100644 index 00000000000..2a383d95b00 --- /dev/null +++ b/objects/vulnerability/vulnerability--c8af07c1-eb05-45b6-b623-4696edd5831f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--617ac607-f8d6-48ca-a0af-1750cdab284f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c8af07c1-eb05-45b6-b623-4696edd5831f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.026553Z", + "modified": "2024-10-22T00:37:11.026553Z", + "name": "CVE-2024-50046", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()\n\nOn the node of an NFS client, some files saved in the mountpoint of the\nNFS server were copied to another location of the same NFS server.\nAccidentally, the nfs42_complete_copies() got a NULL-pointer dereference\ncrash with the following syslog:\n\n[232064.838881] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116\n[232064.839360] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116\n[232066.588183] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058\n[232066.588586] Mem abort info:\n[232066.588701] ESR = 0x0000000096000007\n[232066.588862] EC = 0x25: DABT (current EL), IL = 32 bits\n[232066.589084] SET = 0, FnV = 0\n[232066.589216] EA = 0, S1PTW = 0\n[232066.589340] FSC = 0x07: level 3 translation fault\n[232066.589559] Data abort info:\n[232066.589683] ISV = 0, ISS = 0x00000007\n[232066.589842] CM = 0, WnR = 0\n[232066.589967] user pgtable: 64k pages, 48-bit VAs, pgdp=00002000956ff400\n[232066.590231] [0000000000000058] pgd=08001100ae100003, p4d=08001100ae100003, pud=08001100ae100003, pmd=08001100b3c00003, pte=0000000000000000\n[232066.590757] Internal error: Oops: 96000007 [#1] SMP\n[232066.590958] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm vhost_net vhost vhost_iotlb tap tun ipt_rpfilter xt_multiport ip_set_hash_ip ip_set_hash_net xfrm_interface xfrm6_tunnel tunnel4 tunnel6 esp4 ah4 wireguard libcurve25519_generic veth xt_addrtype xt_set nf_conntrack_netlink ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_bitmap_port ip_set_hash_ipport dummy ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs iptable_filter sch_ingress nfnetlink_cttimeout vport_gre ip_gre ip_tunnel gre vport_geneve geneve vport_vxlan vxlan ip6_udp_tunnel udp_tunnel openvswitch nf_conncount dm_round_robin dm_service_time dm_multipath xt_nat xt_MASQUERADE nft_chain_nat nf_nat xt_mark xt_conntrack xt_comment nft_compat nft_counter nf_tables nfnetlink ocfs2 ocfs2_nodemanager ocfs2_stackglue iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ipmi_ssif nbd overlay 8021q garp mrp bonding tls rfkill sunrpc ext4 mbcache jbd2\n[232066.591052] vfat fat cas_cache cas_disk ses enclosure scsi_transport_sas sg acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler ip_tables vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio dm_mirror dm_region_hash dm_log dm_mod nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc fuse xfs libcrc32c ast drm_vram_helper qla2xxx drm_kms_helper syscopyarea crct10dif_ce sysfillrect ghash_ce sysimgblt sha2_ce fb_sys_fops cec sha256_arm64 sha1_ce drm_ttm_helper ttm nvme_fc igb sbsa_gwdt nvme_fabrics drm nvme_core i2c_algo_bit i40e scsi_transport_fc megaraid_sas aes_neon_bs\n[232066.596953] CPU: 6 PID: 4124696 Comm: 10.253.166.125- Kdump: loaded Not tainted 5.15.131-9.cl9_ocfs2.aarch64 #1\n[232066.597356] Hardware name: Great Wall .\\x93\\x8e...RF6260 V5/GWMSSE2GL1T, BIOS T656FBE_V3.0.18 2024-01-06\n[232066.597721] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[232066.598034] pc : nfs4_reclaim_open_state+0x220/0x800 [nfsv4]\n[232066.598327] lr : nfs4_reclaim_open_state+0x12c/0x800 [nfsv4]\n[232066.598595] sp : ffff8000f568fc70\n[232066.598731] x29: ffff8000f568fc70 x28: 0000000000001000 x27: ffff21003db33000\n[232066.599030] x26: ffff800005521ae0 x25: ffff0100f98fa3f0 x24: 0000000000000001\n[232066.599319] x23: ffff800009920008 x22: ffff21003db33040 x21: ffff21003db33050\n[232066.599628] x20: ffff410172fe9e40 x19: ffff410172fe9e00 x18: 0000000000000000\n[232066.599914] x17: 0000000000000000 x16: 0000000000000004 x15: 0000000000000000\n[232066.600195] x14: 0000000000000000 x13: ffff800008e685a8 x12: 00000000eac0c6e6\n[232066.600498] x11: 00000000000000\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50046" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--c9b4c14e-11dd-43c7-8b2f-389365392056.json b/objects/vulnerability/vulnerability--c9b4c14e-11dd-43c7-8b2f-389365392056.json new file mode 100644 index 00000000000..06a74c0e463 --- /dev/null +++ b/objects/vulnerability/vulnerability--c9b4c14e-11dd-43c7-8b2f-389365392056.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--396291c3-c804-4bb0-9d0e-ffbea596a39d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--c9b4c14e-11dd-43c7-8b2f-389365392056", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.449787Z", + "modified": "2024-10-22T00:37:11.449787Z", + "name": "CVE-2024-8305", + "description": "prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-8305" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ca41ec25-8c74-41c3-8427-1b1d023bdf4f.json b/objects/vulnerability/vulnerability--ca41ec25-8c74-41c3-8427-1b1d023bdf4f.json new file mode 100644 index 00000000000..d4b243e1379 --- /dev/null +++ b/objects/vulnerability/vulnerability--ca41ec25-8c74-41c3-8427-1b1d023bdf4f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--bc0266ab-e5d7-4cd4-8dd1-c393b3f6208f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ca41ec25-8c74-41c3-8427-1b1d023bdf4f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.06027Z", + "modified": "2024-10-22T00:37:12.06027Z", + "name": "CVE-2024-49852", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()\n\nThe kref_put() function will call nport->release if the refcount drops to\nzero. The nport->release release function is _efc_nport_free() which frees\n\"nport\". But then we dereference \"nport\" on the next line which is a use\nafter free. Re-order these lines to avoid the use after free.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49852" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--cb61a754-3b15-42d5-b045-22d58f5bfb89.json b/objects/vulnerability/vulnerability--cb61a754-3b15-42d5-b045-22d58f5bfb89.json new file mode 100644 index 00000000000..a59a852d655 --- /dev/null +++ b/objects/vulnerability/vulnerability--cb61a754-3b15-42d5-b045-22d58f5bfb89.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--4b6d967f-5c2e-4e91-a4a6-d69dc9c6e195", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--cb61a754-3b15-42d5-b045-22d58f5bfb89", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.120319Z", + "modified": "2024-10-22T00:37:12.120319Z", + "name": "CVE-2024-49986", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors\n\nx86_android_tablet_remove() frees the pdevs[] array, so it should not\nbe used after calling x86_android_tablet_remove().\n\nWhen platform_device_register() fails, store the pdevs[x] PTR_ERR() value\ninto the local ret variable before calling x86_android_tablet_remove()\nto avoid using pdevs[] after it has been freed.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49986" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--cb9c88e2-bb92-4421-808e-0408f732bc2e.json b/objects/vulnerability/vulnerability--cb9c88e2-bb92-4421-808e-0408f732bc2e.json new file mode 100644 index 00000000000..550acb6c3fb --- /dev/null +++ b/objects/vulnerability/vulnerability--cb9c88e2-bb92-4421-808e-0408f732bc2e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6d936c41-8fc9-448b-b312-c99fe9fd0c97", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--cb9c88e2-bb92-4421-808e-0408f732bc2e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.931322Z", + "modified": "2024-10-22T00:37:17.931322Z", + "name": "CVE-2022-49002", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() for the error path to avoid reference count leak.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49002" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--cc4ff77d-6d83-44bf-b7f1-174e05d62580.json b/objects/vulnerability/vulnerability--cc4ff77d-6d83-44bf-b7f1-174e05d62580.json new file mode 100644 index 00000000000..3f43ea5a97d --- /dev/null +++ b/objects/vulnerability/vulnerability--cc4ff77d-6d83-44bf-b7f1-174e05d62580.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f57d474d-9e44-4034-9c2d-553d9e06ac3f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--cc4ff77d-6d83-44bf-b7f1-174e05d62580", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.914921Z", + "modified": "2024-10-22T00:37:10.914921Z", + "name": "CVE-2024-47725", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: restart or panic on an I/O error\n\nMaxim Suhanov reported that dm-verity doesn't crash if an I/O error\nhappens. In theory, this could be used to subvert security, because an\nattacker can create sectors that return error with the Write Uncorrectable\ncommand. Some programs may misbehave if they have to deal with EIO.\n\nThis commit fixes dm-verity, so that if \"panic_on_corruption\" or\n\"restart_on_corruption\" was specified and an I/O error happens, the\nmachine will panic or restart.\n\nThis commit also changes kernel_restart to emergency_restart -\nkernel_restart calls reboot notifiers and these reboot notifiers may wait\nfor the bio that failed. emergency_restart doesn't call the notifiers.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47725" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--cc9738d3-577d-4cd3-b4d7-6e0752e2f7b4.json b/objects/vulnerability/vulnerability--cc9738d3-577d-4cd3-b4d7-6e0752e2f7b4.json new file mode 100644 index 00000000000..9313473822f --- /dev/null +++ b/objects/vulnerability/vulnerability--cc9738d3-577d-4cd3-b4d7-6e0752e2f7b4.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d4f1f590-d0af-47ca-96c1-e0476d2eaf2b", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--cc9738d3-577d-4cd3-b4d7-6e0752e2f7b4", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.904373Z", + "modified": "2024-10-22T00:37:10.904373Z", + "name": "CVE-2024-47224", + "description": "A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perform a phishing attack.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47224" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--cce2bade-9360-44be-8276-2aeb8889a38c.json b/objects/vulnerability/vulnerability--cce2bade-9360-44be-8276-2aeb8889a38c.json new file mode 100644 index 00000000000..339505adf45 --- /dev/null +++ b/objects/vulnerability/vulnerability--cce2bade-9360-44be-8276-2aeb8889a38c.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--71ce33d3-5d09-4ac6-95d8-e22630a6f738", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--cce2bade-9360-44be-8276-2aeb8889a38c", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.722514Z", + "modified": "2024-10-22T00:37:16.722514Z", + "name": "CVE-2022-48950", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pending_task() UaF\n\nPer syzbot it is possible for perf_pending_task() to run after the\nevent is free()'d. There are two related but distinct cases:\n\n - the task_work was already queued before destroying the event;\n - destroying the event itself queues the task_work.\n\nThe first cannot be solved using task_work_cancel() since\nperf_release() itself might be called from a task_work (____fput),\nwhich means the current->task_works list is already empty and\ntask_work_cancel() won't be able to find the perf_pending_task()\nentry.\n\nThe simplest alternative is extending the perf_event lifetime to cover\nthe task_work.\n\nThe second is just silly, queueing a task_work while you know the\nevent is going away makes no sense and is easily avoided by\nre-arranging how the event is marked STATE_DEAD and ensuring it goes\nthrough STATE_OFF on the way down.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48950" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ce0fb04b-9182-465e-9c9f-db3e7c30b81a.json b/objects/vulnerability/vulnerability--ce0fb04b-9182-465e-9c9f-db3e7c30b81a.json new file mode 100644 index 00000000000..c87a3752b41 --- /dev/null +++ b/objects/vulnerability/vulnerability--ce0fb04b-9182-465e-9c9f-db3e7c30b81a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e614a612-fb8d-4983-9ab3-a63d873775a6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ce0fb04b-9182-465e-9c9f-db3e7c30b81a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.863738Z", + "modified": "2024-10-22T00:37:10.863738Z", + "name": "CVE-2024-47704", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check link_res->hpo_dp_link_enc before using it\n\n[WHAT & HOW]\nFunctions dp_enable_link_phy and dp_disable_link_phy can pass link_res\nwithout initializing hpo_dp_link_enc and it is necessary to check for\nnull before dereferencing.\n\nThis fixes 2 FORWARD_NULL issues reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47704" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ce79c28e-f560-45de-93dc-ac56cc38b038.json b/objects/vulnerability/vulnerability--ce79c28e-f560-45de-93dc-ac56cc38b038.json new file mode 100644 index 00000000000..cbe34b3079b --- /dev/null +++ b/objects/vulnerability/vulnerability--ce79c28e-f560-45de-93dc-ac56cc38b038.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--137819cf-ea21-497d-8189-05a29126c6e5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ce79c28e-f560-45de-93dc-ac56cc38b038", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.029837Z", + "modified": "2024-10-22T00:37:11.029837Z", + "name": "CVE-2024-50042", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix increasing MSI-X on VF\n\nIncreasing MSI-X value on a VF leads to invalid memory operations. This\nis caused by not reallocating some arrays.\n\nReproducer:\n modprobe ice\n echo 0 > /sys/bus/pci/devices/$PF_PCI/sriov_drivers_autoprobe\n echo 1 > /sys/bus/pci/devices/$PF_PCI/sriov_numvfs\n echo 17 > /sys/bus/pci/devices/$VF0_PCI/sriov_vf_msix_count\n\nDefault MSI-X is 16, so 17 and above triggers this issue.\n\nKASAN reports:\n\n BUG: KASAN: slab-out-of-bounds in ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]\n Read of size 8 at addr ffff8888b937d180 by task bash/28433\n (...)\n\n Call Trace:\n (...)\n ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]\n kasan_report+0xed/0x120\n ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]\n ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]\n ice_vsi_cfg_def+0x3360/0x4770 [ice]\n ? mutex_unlock+0x83/0xd0\n ? __pfx_ice_vsi_cfg_def+0x10/0x10 [ice]\n ? __pfx_ice_remove_vsi_lkup_fltr+0x10/0x10 [ice]\n ice_vsi_cfg+0x7f/0x3b0 [ice]\n ice_vf_reconfig_vsi+0x114/0x210 [ice]\n ice_sriov_set_msix_vec_count+0x3d0/0x960 [ice]\n sriov_vf_msix_count_store+0x21c/0x300\n (...)\n\n Allocated by task 28201:\n (...)\n ice_vsi_cfg_def+0x1c8e/0x4770 [ice]\n ice_vsi_cfg+0x7f/0x3b0 [ice]\n ice_vsi_setup+0x179/0xa30 [ice]\n ice_sriov_configure+0xcaa/0x1520 [ice]\n sriov_numvfs_store+0x212/0x390\n (...)\n\nTo fix it, use ice_vsi_rebuild() instead of ice_vf_reconfig_vsi(). This\ncauses the required arrays to be reallocated taking the new queue count\ninto account (ice_vsi_realloc_stat_arrays()). Set req_txq and req_rxq\nbefore ice_vsi_rebuild(), so that realloc uses the newly set queue\ncount.\n\nAdditionally, ice_vsi_rebuild() does not remove VSI filters\n(ice_fltr_remove_all()), so ice_vf_init_host_cfg() is no longer\nnecessary.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50042" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--cfae3827-da9b-4099-a65c-be538d70a26d.json b/objects/vulnerability/vulnerability--cfae3827-da9b-4099-a65c-be538d70a26d.json new file mode 100644 index 00000000000..9ba84a21a54 --- /dev/null +++ b/objects/vulnerability/vulnerability--cfae3827-da9b-4099-a65c-be538d70a26d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--53aa732e-7b48-4d19-8814-23887c34b283", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--cfae3827-da9b-4099-a65c-be538d70a26d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.08996Z", + "modified": "2024-10-22T00:37:12.08996Z", + "name": "CVE-2024-49868", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix a NULL pointer dereference when failed to start a new trasacntion\n\n[BUG]\nSyzbot reported a NULL pointer dereference with the following crash:\n\n FAULT_INJECTION: forcing a failure.\n start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676\n prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642\n relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678\n ...\n BTRFS info (device loop0): balance: ended with status: -12\n Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667]\n RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926\n Call Trace:\n \n commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496\n btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430\n del_balance_item fs/btrfs/volumes.c:3678 [inline]\n reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742\n btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574\n btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[CAUSE]\nThe allocation failure happens at the start_transaction() inside\nprepare_to_relocate(), and during the error handling we call\nunset_reloc_control(), which makes fs_info->balance_ctl to be NULL.\n\nThen we continue the error path cleanup in btrfs_balance() by calling\nreset_balance_state() which will call del_balance_item() to fully delete\nthe balance item in the root tree.\n\nHowever during the small window between set_reloc_contrl() and\nunset_reloc_control(), we can have a subvolume tree update and created a\nreloc_root for that subvolume.\n\nThen we go into the final btrfs_commit_transaction() of\ndel_balance_item(), and into btrfs_update_reloc_root() inside\ncommit_fs_roots().\n\nThat function checks if fs_info->reloc_ctl is in the merge_reloc_tree\nstage, but since fs_info->reloc_ctl is NULL, it results a NULL pointer\ndereference.\n\n[FIX]\nJust add extra check on fs_info->reloc_ctl inside\nbtrfs_update_reloc_root(), before checking\nfs_info->reloc_ctl->merge_reloc_tree.\n\nThat DEAD_RELOC_TREE handling is to prevent further modification to the\nreloc tree during merge stage, but since there is no reloc_ctl at all,\nwe do not need to bother that.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49868" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d0749e60-42b8-42b7-abf0-b1de1882c7af.json b/objects/vulnerability/vulnerability--d0749e60-42b8-42b7-abf0-b1de1882c7af.json new file mode 100644 index 00000000000..27036ccb3e6 --- /dev/null +++ b/objects/vulnerability/vulnerability--d0749e60-42b8-42b7-abf0-b1de1882c7af.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--94591d7c-79a7-49a6-8ab9-49613aa5ab15", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d0749e60-42b8-42b7-abf0-b1de1882c7af", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.899329Z", + "modified": "2024-10-22T00:37:10.899329Z", + "name": "CVE-2024-47223", + "description": "A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access non-sensitive user provisioning information and execute arbitrary SQL database commands.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47223" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d0a21fd2-6c4a-4e5e-bac6-af047cdaaf53.json b/objects/vulnerability/vulnerability--d0a21fd2-6c4a-4e5e-bac6-af047cdaaf53.json new file mode 100644 index 00000000000..66e1aadcb0a --- /dev/null +++ b/objects/vulnerability/vulnerability--d0a21fd2-6c4a-4e5e-bac6-af047cdaaf53.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--cfa31da8-1542-4929-9085-8cff0f798378", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d0a21fd2-6c4a-4e5e-bac6-af047cdaaf53", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.916505Z", + "modified": "2024-10-22T00:37:10.916505Z", + "name": "CVE-2024-47752", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: Fix H264 stateless decoder smatch warning\n\nFix a smatch static checker warning on vdec_h264_req_if.c.\nWhich leads to a kernel crash when fb is NULL.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47752" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d1018f9c-3294-4c7c-bed4-56234370425b.json b/objects/vulnerability/vulnerability--d1018f9c-3294-4c7c-bed4-56234370425b.json new file mode 100644 index 00000000000..01122c01034 --- /dev/null +++ b/objects/vulnerability/vulnerability--d1018f9c-3294-4c7c-bed4-56234370425b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--04553c3f-42c9-4ea7-bc58-03490de55a4a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d1018f9c-3294-4c7c-bed4-56234370425b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.665038Z", + "modified": "2024-10-22T00:37:16.665038Z", + "name": "CVE-2022-48982", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix crash when replugging CSR fake controllers\n\nIt seems fake CSR 5.0 clones can cause the suspend notifier to be\nregistered twice causing the following kernel panic:\n\n[ 71.986122] Call Trace:\n[ 71.986124] \n[ 71.986125] blocking_notifier_chain_register+0x33/0x60\n[ 71.986130] hci_register_dev+0x316/0x3d0 [bluetooth 99b5497ea3d09708fa1366c1dc03288bf3cca8da]\n[ 71.986154] btusb_probe+0x979/0xd85 [btusb e1e0605a4f4c01984a4b9c8ac58c3666ae287477]\n[ 71.986159] ? __pm_runtime_set_status+0x1a9/0x300\n[ 71.986162] ? ktime_get_mono_fast_ns+0x3e/0x90\n[ 71.986167] usb_probe_interface+0xe3/0x2b0\n[ 71.986171] really_probe+0xdb/0x380\n[ 71.986174] ? pm_runtime_barrier+0x54/0x90\n[ 71.986177] __driver_probe_device+0x78/0x170\n[ 71.986180] driver_probe_device+0x1f/0x90\n[ 71.986183] __device_attach_driver+0x89/0x110\n[ 71.986186] ? driver_allows_async_probing+0x70/0x70\n[ 71.986189] bus_for_each_drv+0x8c/0xe0\n[ 71.986192] __device_attach+0xb2/0x1e0\n[ 71.986195] bus_probe_device+0x92/0xb0\n[ 71.986198] device_add+0x422/0x9a0\n[ 71.986201] ? sysfs_merge_group+0xd4/0x110\n[ 71.986205] usb_set_configuration+0x57a/0x820\n[ 71.986208] usb_generic_driver_probe+0x4f/0x70\n[ 71.986211] usb_probe_device+0x3a/0x110\n[ 71.986213] really_probe+0xdb/0x380\n[ 71.986216] ? pm_runtime_barrier+0x54/0x90\n[ 71.986219] __driver_probe_device+0x78/0x170\n[ 71.986221] driver_probe_device+0x1f/0x90\n[ 71.986224] __device_attach_driver+0x89/0x110\n[ 71.986227] ? driver_allows_async_probing+0x70/0x70\n[ 71.986230] bus_for_each_drv+0x8c/0xe0\n[ 71.986232] __device_attach+0xb2/0x1e0\n[ 71.986235] bus_probe_device+0x92/0xb0\n[ 71.986237] device_add+0x422/0x9a0\n[ 71.986239] ? _dev_info+0x7d/0x98\n[ 71.986242] ? blake2s_update+0x4c/0xc0\n[ 71.986246] usb_new_device.cold+0x148/0x36d\n[ 71.986250] hub_event+0xa8a/0x1910\n[ 71.986255] process_one_work+0x1c4/0x380\n[ 71.986259] worker_thread+0x51/0x390\n[ 71.986262] ? rescuer_thread+0x3b0/0x3b0\n[ 71.986264] kthread+0xdb/0x110\n[ 71.986266] ? kthread_complete_and_exit+0x20/0x20\n[ 71.986268] ret_from_fork+0x1f/0x30\n[ 71.986273] \n[ 71.986274] ---[ end trace 0000000000000000 ]---\n[ 71.986284] btusb: probe of 2-1.6:1.0 failed with error -17", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48982" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d1414843-f033-46aa-ab77-587162d44378.json b/objects/vulnerability/vulnerability--d1414843-f033-46aa-ab77-587162d44378.json new file mode 100644 index 00000000000..a2c0317f2ff --- /dev/null +++ b/objects/vulnerability/vulnerability--d1414843-f033-46aa-ab77-587162d44378.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6ef513e2-7f00-453e-8d36-ce920c28b783", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d1414843-f033-46aa-ab77-587162d44378", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.905704Z", + "modified": "2024-10-22T00:37:10.905704Z", + "name": "CVE-2024-47676", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb.c: fix UAF of vma in hugetlb fault pathway\n\nSyzbot reports a UAF in hugetlb_fault(). This happens because\nvmf_anon_prepare() could drop the per-VMA lock and allow the current VMA\nto be freed before hugetlb_vma_unlock_read() is called.\n\nWe can fix this by using a modified version of vmf_anon_prepare() that\ndoesn't release the VMA lock on failure, and then release it ourselves\nafter hugetlb_vma_unlock_read().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47676" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d2f9cbdc-7869-4d33-8995-f02bd76776b5.json b/objects/vulnerability/vulnerability--d2f9cbdc-7869-4d33-8995-f02bd76776b5.json new file mode 100644 index 00000000000..5d8ebd08a85 --- /dev/null +++ b/objects/vulnerability/vulnerability--d2f9cbdc-7869-4d33-8995-f02bd76776b5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--dd4281be-f567-4734-8548-9123f7ef7ca2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d2f9cbdc-7869-4d33-8995-f02bd76776b5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.996598Z", + "modified": "2024-10-22T00:37:10.996598Z", + "name": "CVE-2024-50027", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Free tzp copy along with the thermal zone\n\nThe object pointed to by tz->tzp may still be accessed after being\nfreed in thermal_zone_device_unregister(), so move the freeing of it\nto the point after the removal completion has been completed at which\nit cannot be accessed any more.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50027" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d523d628-8b5f-4149-b71b-1d20fcc0b32f.json b/objects/vulnerability/vulnerability--d523d628-8b5f-4149-b71b-1d20fcc0b32f.json new file mode 100644 index 00000000000..08446561c8d --- /dev/null +++ b/objects/vulnerability/vulnerability--d523d628-8b5f-4149-b71b-1d20fcc0b32f.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--88cf62d9-604a-49bc-95cb-5f3eca6cf127", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d523d628-8b5f-4149-b71b-1d20fcc0b32f", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.085677Z", + "modified": "2024-10-22T00:37:12.085677Z", + "name": "CVE-2024-49902", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: check if leafidx greater than num leaves per dmap tree\n\nsyzbot report a out of bounds in dbSplit, it because dmt_leafidx greater\nthan num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.\n\nShaggy:\nModified sanity check to apply to control pages as well as leaf pages.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49902" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d5cb5f6b-5a02-43a8-bf98-ffa5272a3ea5.json b/objects/vulnerability/vulnerability--d5cb5f6b-5a02-43a8-bf98-ffa5272a3ea5.json new file mode 100644 index 00000000000..5dfa6510bd6 --- /dev/null +++ b/objects/vulnerability/vulnerability--d5cb5f6b-5a02-43a8-bf98-ffa5272a3ea5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--30e03812-eb76-4b04-84a6-ed4cb3a4cf97", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d5cb5f6b-5a02-43a8-bf98-ffa5272a3ea5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.961411Z", + "modified": "2024-10-22T00:37:10.961411Z", + "name": "CVE-2024-50014", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix access to uninitialised lock in fc replay path\n\nThe following kernel trace can be triggered with fstest generic/629 when\nexecuted against a filesystem with fast-commit feature enabled:\n\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nyou didn't initialize this object before use?\nturning off the locking correctness validator.\nCPU: 0 PID: 866 Comm: mount Not tainted 6.10.0+ #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \n dump_stack_lvl+0x66/0x90\n register_lock_class+0x759/0x7d0\n __lock_acquire+0x85/0x2630\n ? __find_get_block+0xb4/0x380\n lock_acquire+0xd1/0x2d0\n ? __ext4_journal_get_write_access+0xd5/0x160\n _raw_spin_lock+0x33/0x40\n ? __ext4_journal_get_write_access+0xd5/0x160\n __ext4_journal_get_write_access+0xd5/0x160\n ext4_reserve_inode_write+0x61/0xb0\n __ext4_mark_inode_dirty+0x79/0x270\n ? ext4_ext_replay_set_iblocks+0x2f8/0x450\n ext4_ext_replay_set_iblocks+0x330/0x450\n ext4_fc_replay+0x14c8/0x1540\n ? jread+0x88/0x2e0\n ? rcu_is_watching+0x11/0x40\n do_one_pass+0x447/0xd00\n jbd2_journal_recover+0x139/0x1b0\n jbd2_journal_load+0x96/0x390\n ext4_load_and_init_journal+0x253/0xd40\n ext4_fill_super+0x2cc6/0x3180\n...\n\nIn the replay path there's an attempt to lock sbi->s_bdev_wb_lock in\nfunction ext4_check_bdev_write_error(). Unfortunately, at this point this\nspinlock has not been initialized yet. Moving it's initialization to an\nearlier point in __ext4_fill_super() fixes this splat.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50014" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d5d5d32b-0b03-4b2a-97ed-c7cf9b95adab.json b/objects/vulnerability/vulnerability--d5d5d32b-0b03-4b2a-97ed-c7cf9b95adab.json new file mode 100644 index 00000000000..29ae93872c2 --- /dev/null +++ b/objects/vulnerability/vulnerability--d5d5d32b-0b03-4b2a-97ed-c7cf9b95adab.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e7d6359c-c243-42e7-b06b-7d2aa4c42d4a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d5d5d32b-0b03-4b2a-97ed-c7cf9b95adab", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.917658Z", + "modified": "2024-10-22T00:37:17.917658Z", + "name": "CVE-2022-49003", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix SRCU protection of nvme_ns_head list\n\nWalking the nvme_ns_head siblings list is protected by the head's srcu\nin nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths().\nRemoving namespaces from the list also fails to synchronize the srcu.\nConcurrent scan work can therefore cause use-after-frees.\n\nHold the head's srcu lock in nvme_mpath_revalidate_paths() and\nsynchronize with the srcu, not the global RCU, in nvme_ns_remove().\n\nObserved the following panic when making NVMe/RDMA connections\nwith native multipath on the Rocky Linux 8.6 kernel\n(it seems the upstream kernel has the same race condition).\nDisassembly shows the faulting instruction is cmp 0x50(%rdx),%rcx;\ncomputing capacity != get_capacity(ns->disk).\nAddress 0x50 is dereferenced because ns->disk is NULL.\nThe NULL disk appears to be the result of concurrent scan work\nfreeing the namespace (note the log line in the middle of the panic).\n\n[37314.206036] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050\n[37314.206036] nvme0n3: detected capacity change from 0 to 11811160064\n[37314.299753] PGD 0 P4D 0\n[37314.299756] Oops: 0000 [#1] SMP PTI\n[37314.299759] CPU: 29 PID: 322046 Comm: kworker/u98:3 Kdump: loaded Tainted: G W X --------- - - 4.18.0-372.32.1.el8test86.x86_64 #1\n[37314.299762] Hardware name: Dell Inc. PowerEdge R720/0JP31P, BIOS 2.7.0 05/23/2018\n[37314.299763] Workqueue: nvme-wq nvme_scan_work [nvme_core]\n[37314.299783] RIP: 0010:nvme_mpath_revalidate_paths+0x26/0xb0 [nvme_core]\n[37314.299790] Code: 1f 44 00 00 66 66 66 66 90 55 53 48 8b 5f 50 48 8b 83 c8 c9 00 00 48 8b 13 48 8b 48 50 48 39 d3 74 20 48 8d 42 d0 48 8b 50 20 <48> 3b 4a 50 74 05 f0 80 60 70 ef 48 8b 50 30 48 8d 42 d0 48 39 d3\n[37315.058803] RSP: 0018:ffffabe28f913d10 EFLAGS: 00010202\n[37315.121316] RAX: ffff927a077da800 RBX: ffff92991dd70000 RCX: 0000000001600000\n[37315.206704] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff92991b719800\n[37315.292106] RBP: ffff929a6b70c000 R08: 000000010234cd4a R09: c0000000ffff7fff\n[37315.377501] R10: 0000000000000001 R11: ffffabe28f913a30 R12: 0000000000000000\n[37315.462889] R13: ffff92992716600c R14: ffff929964e6e030 R15: ffff92991dd70000\n[37315.548286] FS: 0000000000000000(0000) GS:ffff92b87fb80000(0000) knlGS:0000000000000000\n[37315.645111] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[37315.713871] CR2: 0000000000000050 CR3: 0000002208810006 CR4: 00000000000606e0\n[37315.799267] Call Trace:\n[37315.828515] nvme_update_ns_info+0x1ac/0x250 [nvme_core]\n[37315.892075] nvme_validate_or_alloc_ns+0x2ff/0xa00 [nvme_core]\n[37315.961871] ? __blk_mq_free_request+0x6b/0x90\n[37316.015021] nvme_scan_work+0x151/0x240 [nvme_core]\n[37316.073371] process_one_work+0x1a7/0x360\n[37316.121318] ? create_worker+0x1a0/0x1a0\n[37316.168227] worker_thread+0x30/0x390\n[37316.212024] ? create_worker+0x1a0/0x1a0\n[37316.258939] kthread+0x10a/0x120\n[37316.297557] ? set_kthread_struct+0x50/0x50\n[37316.347590] ret_from_fork+0x35/0x40\n[37316.390360] Modules linked in: nvme_rdma nvme_tcp(X) nvme_fabrics nvme_core netconsole iscsi_tcp libiscsi_tcp dm_queue_length dm_service_time nf_conntrack_netlink br_netfilter bridge stp llc overlay nft_chain_nat ipt_MASQUERADE nf_nat xt_addrtype xt_CT nft_counter xt_state xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_comment xt_multiport nft_compat nf_tables libcrc32c nfnetlink dm_multipath tg3 rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm intel_rapl_msr iTCO_wdt iTCO_vendor_support dcdbas intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel ipmi_ssif kvm irqbypass crct10dif_pclmul crc32_pclmul mlx5_ib ghash_clmulni_intel ib_uverbs rapl intel_cstate intel_uncore ib_core ipmi_si joydev mei_me pcspkr ipmi_devintf mei lpc_ich wmi ipmi_msghandler acpi_power_meter ex\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49003" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d5f76168-2014-4cb1-b10f-7a5e735f8f87.json b/objects/vulnerability/vulnerability--d5f76168-2014-4cb1-b10f-7a5e735f8f87.json new file mode 100644 index 00000000000..0b2ffbbc0d8 --- /dev/null +++ b/objects/vulnerability/vulnerability--d5f76168-2014-4cb1-b10f-7a5e735f8f87.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--d21e9cf9-0c42-4369-b70f-714fbca687ef", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d5f76168-2014-4cb1-b10f-7a5e735f8f87", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.032411Z", + "modified": "2024-10-22T00:37:11.032411Z", + "name": "CVE-2024-50029", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync\n\nThis checks if the ACL connection remains valid as it could be destroyed\nwhile hci_enhanced_setup_sync is pending on cmd_sync leading to the\nfollowing trace:\n\nBUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0x91b/0xa60\nRead of size 1 at addr ffff888002328ffd by task kworker/u5:2/37\n\nCPU: 0 UID: 0 PID: 37 Comm: kworker/u5:2 Not tainted 6.11.0-rc6-01300-g810be445d8d6 #7099\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nWorkqueue: hci0 hci_cmd_sync_work\nCall Trace:\n \n dump_stack_lvl+0x5d/0x80\n ? hci_enhanced_setup_sync+0x91b/0xa60\n print_report+0x152/0x4c0\n ? hci_enhanced_setup_sync+0x91b/0xa60\n ? __virt_addr_valid+0x1fa/0x420\n ? hci_enhanced_setup_sync+0x91b/0xa60\n kasan_report+0xda/0x1b0\n ? hci_enhanced_setup_sync+0x91b/0xa60\n hci_enhanced_setup_sync+0x91b/0xa60\n ? __pfx_hci_enhanced_setup_sync+0x10/0x10\n ? __pfx___mutex_lock+0x10/0x10\n hci_cmd_sync_work+0x1c2/0x330\n process_one_work+0x7d9/0x1360\n ? __pfx_lock_acquire+0x10/0x10\n ? __pfx_process_one_work+0x10/0x10\n ? assign_work+0x167/0x240\n worker_thread+0x5b7/0xf60\n ? __kthread_parkme+0xac/0x1c0\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x293/0x360\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2f/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n\nAllocated by task 34:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __hci_conn_add+0x187/0x17d0\n hci_connect_sco+0x2e1/0xb90\n sco_sock_connect+0x2a2/0xb80\n __sys_connect+0x227/0x2a0\n __x64_sys_connect+0x6d/0xb0\n do_syscall_64+0x71/0x140\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 37:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x101/0x160\n kfree+0xd0/0x250\n device_release+0x9a/0x210\n kobject_put+0x151/0x280\n hci_conn_del+0x448/0xbf0\n hci_abort_conn_sync+0x46f/0x980\n hci_cmd_sync_work+0x1c2/0x330\n process_one_work+0x7d9/0x1360\n worker_thread+0x5b7/0xf60\n kthread+0x293/0x360\n ret_from_fork+0x2f/0x70\n ret_from_fork_asm+0x1a/0x30", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50029" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d82f12b8-279e-44f7-a6b5-3d522c317dfd.json b/objects/vulnerability/vulnerability--d82f12b8-279e-44f7-a6b5-3d522c317dfd.json new file mode 100644 index 00000000000..64ad69d2659 --- /dev/null +++ b/objects/vulnerability/vulnerability--d82f12b8-279e-44f7-a6b5-3d522c317dfd.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--dc32cab5-f455-4f30-8204-a85d6098f2a0", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d82f12b8-279e-44f7-a6b5-3d522c317dfd", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.956634Z", + "modified": "2024-10-22T00:37:17.956634Z", + "name": "CVE-2022-49000", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix PCI device refcount leak in has_external_pci()\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() before 'return true' to avoid reference count leak.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49000" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d957e712-e733-47f7-b61d-fb8c53dfe9a1.json b/objects/vulnerability/vulnerability--d957e712-e733-47f7-b61d-fb8c53dfe9a1.json new file mode 100644 index 00000000000..5cb58e484ef --- /dev/null +++ b/objects/vulnerability/vulnerability--d957e712-e733-47f7-b61d-fb8c53dfe9a1.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0f2b13a7-1410-48e2-9e54-59a12550838e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d957e712-e733-47f7-b61d-fb8c53dfe9a1", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.477319Z", + "modified": "2024-10-22T00:37:11.477319Z", + "name": "CVE-2024-8625", + "description": "The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-8625" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--d9969528-9713-4196-89bc-8e33d286d0e5.json b/objects/vulnerability/vulnerability--d9969528-9713-4196-89bc-8e33d286d0e5.json new file mode 100644 index 00000000000..64175581fc2 --- /dev/null +++ b/objects/vulnerability/vulnerability--d9969528-9713-4196-89bc-8e33d286d0e5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9bf72b30-4306-40e3-aee3-c5e8e3321116", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--d9969528-9713-4196-89bc-8e33d286d0e5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.078881Z", + "modified": "2024-10-22T00:37:12.078881Z", + "name": "CVE-2024-49961", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ar0521: Use cansleep version of gpiod_set_value()\n\nIf we use GPIO reset from I2C port expander, we must use *_cansleep()\nvariant of GPIO functions.\nThis was not done in ar0521_power_on()/ar0521_power_off() functions.\nLet's fix that.\n\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 11 at drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x74/0x7c\nModules linked in:\nCPU: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.10.0 #53\nHardware name: Diasom DS-RK3568-SOM-EVB (DT)\nWorkqueue: events_unbound deferred_probe_work_func\npstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : gpiod_set_value+0x74/0x7c\nlr : ar0521_power_on+0xcc/0x290\nsp : ffffff8001d7ab70\nx29: ffffff8001d7ab70 x28: ffffff80027dcc90 x27: ffffff8003c82000\nx26: ffffff8003ca9250 x25: ffffffc080a39c60 x24: ffffff8003ca9088\nx23: ffffff8002402720 x22: ffffff8003ca9080 x21: ffffff8003ca9088\nx20: 0000000000000000 x19: ffffff8001eb2a00 x18: ffffff80efeeac80\nx17: 756d2d6332692f30 x16: 0000000000000000 x15: 0000000000000000\nx14: ffffff8001d91d40 x13: 0000000000000016 x12: ffffffc080e98930\nx11: ffffff8001eb2880 x10: 0000000000000890 x9 : ffffff8001d7a9f0\nx8 : ffffff8001d92570 x7 : ffffff80efeeac80 x6 : 000000003fc6e780\nx5 : ffffff8001d91c80 x4 : 0000000000000002 x3 : 0000000000000000\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001\nCall trace:\n gpiod_set_value+0x74/0x7c\n ar0521_power_on+0xcc/0x290\n...", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49961" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--dac79194-1688-45e7-b6ab-a32af56aca66.json b/objects/vulnerability/vulnerability--dac79194-1688-45e7-b6ab-a32af56aca66.json new file mode 100644 index 00000000000..b85f6cea675 --- /dev/null +++ b/objects/vulnerability/vulnerability--dac79194-1688-45e7-b6ab-a32af56aca66.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--1d691193-1007-414a-b9d5-02352c6ed87a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--dac79194-1688-45e7-b6ab-a32af56aca66", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.281071Z", + "modified": "2024-10-22T00:37:12.281071Z", + "name": "CVE-2024-49909", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the dcn32_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for null, but then it was being\ndereferenced without any null check. This could lead to a null pointer\ndereference if set_output_gamma is null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a null check for set_output_gamma\nbefore the call to set_output_gamma.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49909" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--dbb61ccb-724d-4b9d-bb04-aa013fa936ad.json b/objects/vulnerability/vulnerability--dbb61ccb-724d-4b9d-bb04-aa013fa936ad.json new file mode 100644 index 00000000000..54c85f9e4f0 --- /dev/null +++ b/objects/vulnerability/vulnerability--dbb61ccb-724d-4b9d-bb04-aa013fa936ad.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--bc449ddb-b4aa-4802-9951-b0a8fac0f639", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--dbb61ccb-724d-4b9d-bb04-aa013fa936ad", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.082442Z", + "modified": "2024-10-22T00:37:12.082442Z", + "name": "CVE-2024-49918", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn32_acquire_idle_pipe_for_head_pipe_in_layer` function. The issue\ncould occur when `head_pipe` is null.\n\nThe fix adds a check to ensure `head_pipe` is not null before asserting\nit. If `head_pipe` is null, the function returns NULL to prevent a\npotential null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn32/dcn32_resource.c:2690 dcn32_acquire_idle_pipe_for_head_pipe_in_layer() error: we previously assumed 'head_pipe' could be null (see line 2681)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49918" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--dc513a08-32ea-472a-b1a8-2adf4819b5cb.json b/objects/vulnerability/vulnerability--dc513a08-32ea-472a-b1a8-2adf4819b5cb.json new file mode 100644 index 00000000000..132d36f0ad9 --- /dev/null +++ b/objects/vulnerability/vulnerability--dc513a08-32ea-472a-b1a8-2adf4819b5cb.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0b489281-e27e-415a-8dcf-91d4985da11a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--dc513a08-32ea-472a-b1a8-2adf4819b5cb", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.909162Z", + "modified": "2024-10-22T00:37:10.909162Z", + "name": "CVE-2024-47698", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error\n\nEnsure index in rtl2832_pid_filter does not exceed 31 to prevent\nout-of-bounds access.\n\ndev->filters is a 32-bit value, so set_bit and clear_bit functions should\nonly operate on indices from 0 to 31. If index is 32, it will attempt to\naccess a non-existent 33rd bit, leading to out-of-bounds access.\nChange the boundary check from index > 32 to index >= 32 to resolve this\nissue.\n\n[hverkuil: added fixes tag, rtl2830_pid_filter -> rtl2832_pid_filter in logmsg]", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47698" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--dc9e5a03-7427-4cac-b9df-2b7b7369f857.json b/objects/vulnerability/vulnerability--dc9e5a03-7427-4cac-b9df-2b7b7369f857.json new file mode 100644 index 00000000000..10ef522944c --- /dev/null +++ b/objects/vulnerability/vulnerability--dc9e5a03-7427-4cac-b9df-2b7b7369f857.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--781b2377-b3ea-4453-a89e-57b8f396807e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--dc9e5a03-7427-4cac-b9df-2b7b7369f857", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.940224Z", + "modified": "2024-10-22T00:37:17.940224Z", + "name": "CVE-2022-49016", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mdiobus: fix unbalanced node reference count\n\nI got the following report while doing device(mscc-miim) load test\nwith CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled:\n\n OF: ERROR: memory leak, expected refcount 1 instead of 2,\n of_node_get()/of_node_put() unbalanced - destroy cset entry:\n attach overlay node /spi/soc@0/mdio@7107009c/ethernet-phy@0\n\nIf the 'fwnode' is not an acpi node, the refcount is get in\nfwnode_mdiobus_phy_device_register(), but it has never been\nput when the device is freed in the normal path. So call\nfwnode_handle_put() in phy_device_release() to avoid leak.\n\nIf it's an acpi node, it has never been get, but it's put\nin the error path, so call fwnode_handle_get() before\nphy_device_register() to keep get/put operation balanced.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49016" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--dca7aa29-6ab3-49bc-a76a-e22397c29fdc.json b/objects/vulnerability/vulnerability--dca7aa29-6ab3-49bc-a76a-e22397c29fdc.json new file mode 100644 index 00000000000..9e83a4224cf --- /dev/null +++ b/objects/vulnerability/vulnerability--dca7aa29-6ab3-49bc-a76a-e22397c29fdc.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3a53d97f-2299-4822-949d-fe33ebfa4f67", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--dca7aa29-6ab3-49bc-a76a-e22397c29fdc", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.094735Z", + "modified": "2024-10-22T00:37:12.094735Z", + "name": "CVE-2024-49929", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: avoid NULL pointer dereference\n\niwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta\npointer is not NULL.\nIt retrieves this pointer using iwl_mvm_sta_from_mac80211, which is\ndereferencing the ieee80211_sta pointer.\nIf sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL\npointer.\nFix this by checking the sta pointer before retrieving the mvmsta\nfrom it. If sta is not NULL, then mvmsta isn't either.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49929" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--df21f18f-880e-423c-8830-90eefef676fe.json b/objects/vulnerability/vulnerability--df21f18f-880e-423c-8830-90eefef676fe.json new file mode 100644 index 00000000000..2c68f896ccb --- /dev/null +++ b/objects/vulnerability/vulnerability--df21f18f-880e-423c-8830-90eefef676fe.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b0eb5b34-71d8-469f-9b8b-ec2ea5158f4f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--df21f18f-880e-423c-8830-90eefef676fe", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.838842Z", + "modified": "2024-10-22T00:37:10.838842Z", + "name": "CVE-2024-47732", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: iaa - Fix potential use after free bug\n\nThe free_device_compression_mode(iaa_device, device_mode) function frees\n\"device_mode\" but it iss passed to iaa_compression_modes[i]->free() a few\nlines later resulting in a use after free.\n\nThe good news is that, so far as I can tell, nothing implements the\n->free() function and the use after free happens in dead code. But, with\nthis fix, when something does implement it, we'll be ready. :)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47732" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--df625eb3-71d5-4290-81b2-2a149eb9ad33.json b/objects/vulnerability/vulnerability--df625eb3-71d5-4290-81b2-2a149eb9ad33.json new file mode 100644 index 00000000000..c4701d3b13d --- /dev/null +++ b/objects/vulnerability/vulnerability--df625eb3-71d5-4290-81b2-2a149eb9ad33.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ee1c4d61-b0aa-4ecb-9085-6c4d99bfe540", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--df625eb3-71d5-4290-81b2-2a149eb9ad33", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.01326Z", + "modified": "2024-10-22T00:37:11.01326Z", + "name": "CVE-2024-50013", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix memory leak in exfat_load_bitmap()\n\nIf the first directory entry in the root directory is not a bitmap\ndirectory entry, 'bh' will not be released and reassigned, which\nwill cause a memory leak.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50013" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--df9f810f-80ef-4ae0-97f2-2980195a9425.json b/objects/vulnerability/vulnerability--df9f810f-80ef-4ae0-97f2-2980195a9425.json new file mode 100644 index 00000000000..f6aa9fda56b --- /dev/null +++ b/objects/vulnerability/vulnerability--df9f810f-80ef-4ae0-97f2-2980195a9425.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--e1277f41-1dc2-4993-9f74-7f168f80494c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--df9f810f-80ef-4ae0-97f2-2980195a9425", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.745935Z", + "modified": "2024-10-22T00:37:16.745935Z", + "name": "CVE-2022-48946", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix preallocation discarding at indirect extent boundary\n\nWhen preallocation extent is the first one in the extent block, the\ncode would corrupt extent tree header instead. Fix the problem and use\nudf_delete_aext() for deleting extent to avoid some code duplication.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48946" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e0a84db2-59b2-44de-b40e-4fdad33683e8.json b/objects/vulnerability/vulnerability--e0a84db2-59b2-44de-b40e-4fdad33683e8.json new file mode 100644 index 00000000000..fa646902c9a --- /dev/null +++ b/objects/vulnerability/vulnerability--e0a84db2-59b2-44de-b40e-4fdad33683e8.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--9659c67a-3f9e-4407-8467-fc2bf4ec7ec1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e0a84db2-59b2-44de-b40e-4fdad33683e8", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.118971Z", + "modified": "2024-10-22T00:37:12.118971Z", + "name": "CVE-2024-49931", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix array out-of-bound access in SoC stats\n\nCurrently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a\nmaximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process()\nfunction access ath12k_soc_dp_stats::hal_reo_error using the REO\ndestination SRNG ring ID, which is incorrect. SRNG ring ID differ from\nnormal ring ID, and this usage leads to out-of-bounds array access. To\nfix this issue, modify ath12k_dp_rx_process() to use the normal ring ID\ndirectly instead of the SRNG ring ID to avoid out-of-bounds array access.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49931" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e0c474c4-78dc-41b8-bfbb-350d2f09e928.json b/objects/vulnerability/vulnerability--e0c474c4-78dc-41b8-bfbb-350d2f09e928.json new file mode 100644 index 00000000000..2527917423c --- /dev/null +++ b/objects/vulnerability/vulnerability--e0c474c4-78dc-41b8-bfbb-350d2f09e928.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--77291bdc-2145-4b7b-9ff8-83288f871871", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e0c474c4-78dc-41b8-bfbb-350d2f09e928", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.138779Z", + "modified": "2024-10-22T00:37:12.138779Z", + "name": "CVE-2024-49865", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vm: move xa_alloc to prevent UAF\n\nEvil user can guess the next id of the vm before the ioctl completes and\nthen call vm destroy ioctl to trigger UAF since create ioctl is still\nreferencing the same vm. Move the xa_alloc all the way to the end to\nprevent this.\n\nv2:\n - Rebase\n\n(cherry picked from commit dcfd3971327f3ee92765154baebbaece833d3ca9)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49865" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e4294a82-d539-4612-b5da-42b9c54beb70.json b/objects/vulnerability/vulnerability--e4294a82-d539-4612-b5da-42b9c54beb70.json new file mode 100644 index 00000000000..70e38363ea1 --- /dev/null +++ b/objects/vulnerability/vulnerability--e4294a82-d539-4612-b5da-42b9c54beb70.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b4b10bdd-13bf-407b-a64e-6c3f0879385f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e4294a82-d539-4612-b5da-42b9c54beb70", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.173514Z", + "modified": "2024-10-22T00:37:12.173514Z", + "name": "CVE-2024-49964", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix memfd_pin_folios free_huge_pages leak\n\nmemfd_pin_folios followed by unpin_folios fails to restore free_huge_pages\nif the pages were not already faulted in, because the folio refcount for\npages created by memfd_alloc_folio never goes to 0. memfd_pin_folios\nneeds another folio_put to undo the folio_try_get below:\n\nmemfd_alloc_folio()\n alloc_hugetlb_folio_nodemask()\n dequeue_hugetlb_folio_nodemask()\n dequeue_hugetlb_folio_node_exact()\n folio_ref_unfreeze(folio, 1); ; adds 1 refcount\n folio_try_get() ; adds 1 refcount\n hugetlb_add_to_page_cache() ; adds 512 refcount (on x86)\n\nWith the fix, after memfd_pin_folios + unpin_folios, the refcount for the\n(unfaulted) page is 512, which is correct, as the refcount for a faulted\nunpinned page is 513.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49964" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e4390ed6-c86a-470c-8aac-bcd188973b10.json b/objects/vulnerability/vulnerability--e4390ed6-c86a-470c-8aac-bcd188973b10.json new file mode 100644 index 00000000000..1ffe73acf28 --- /dev/null +++ b/objects/vulnerability/vulnerability--e4390ed6-c86a-470c-8aac-bcd188973b10.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b000aa7a-dbb3-48b9-8f70-69fffa047c7c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e4390ed6-c86a-470c-8aac-bcd188973b10", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.00501Z", + "modified": "2024-10-22T00:37:11.00501Z", + "name": "CVE-2024-50045", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: fix panic with metadata_dst skb\n\nFix a kernel panic in the br_netfilter module when sending untagged\ntraffic via a VxLAN device.\nThis happens during the check for fragmentation in br_nf_dev_queue_xmit.\n\nIt is dependent on:\n1) the br_netfilter module being loaded;\n2) net.bridge.bridge-nf-call-iptables set to 1;\n3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port;\n4) untagged frames with size higher than the VxLAN MTU forwarded/flooded\n\nWhen forwarding the untagged packet to the VxLAN bridge port, before\nthe netfilter hooks are called, br_handle_egress_vlan_tunnel is called and\nchanges the skb_dst to the tunnel dst. The tunnel_dst is a metadata type\nof dst, i.e., skb_valid_dst(skb) is false, and metadata->dst.dev is NULL.\n\nThen in the br_netfilter hooks, in br_nf_dev_queue_xmit, there's a check\nfor frames that needs to be fragmented: frames with higher MTU than the\nVxLAN device end up calling br_nf_ip_fragment, which in turns call\nip_skb_dst_mtu.\n\nThe ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst\nwith valid dst->dev, thus the crash.\n\nThis case was never supported in the first place, so drop the packet\ninstead.\n\nPING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data.\n[ 176.291791] Unable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000110\n[ 176.292101] Mem abort info:\n[ 176.292184] ESR = 0x0000000096000004\n[ 176.292322] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 176.292530] SET = 0, FnV = 0\n[ 176.292709] EA = 0, S1PTW = 0\n[ 176.292862] FSC = 0x04: level 0 translation fault\n[ 176.293013] Data abort info:\n[ 176.293104] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[ 176.293488] CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 176.293787] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000\n[ 176.294166] [0000000000000110] pgd=0000000000000000,\np4d=0000000000000000\n[ 176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[ 176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth\nbr_netfilter bridge stp llc ipv6 crct10dif_ce\n[ 176.295923] CPU: 0 PID: 188 Comm: ping Not tainted\n6.8.0-rc3-g5b3fbd61b9d1 #2\n[ 176.296314] Hardware name: linux,dummy-virt (DT)\n[ 176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS\nBTYPE=--)\n[ 176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter]\n[ 176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter]\n[ 176.297636] sp : ffff800080003630\n[ 176.297743] x29: ffff800080003630 x28: 0000000000000008 x27:\nffff6828c49ad9f8\n[ 176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24:\n00000000000003e8\n[ 176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21:\nffff6828c3b16d28\n[ 176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18:\n0000000000000014\n[ 176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15:\n0000000095744632\n[ 176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12:\nffffb7e137926a70\n[ 176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 :\n0000000000000000\n[ 176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 :\nf20e0100bebafeca\n[ 176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 :\n0000000000000000\n[ 176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 :\nffff6828c7f918f0\n[ 176.300889] Call trace:\n[ 176.301123] br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter]\n[ 176.301411] br_nf_post_routing+0x2a8/0x3e4 [br_netfilter]\n[ 176.301703] nf_hook_slow+0x48/0x124\n[ 176.302060] br_forward_finish+0xc8/0xe8 [bridge]\n[ 176.302371] br_nf_hook_thresh+0x124/0x134 [br_netfilter]\n[ 176.302605] br_nf_forward_finish+0x118/0x22c [br_netfilter]\n[ 176.302824] br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter]\n[ 176.303136] br_nf_forward+0x2b8/0x4e0 [br_netfilter]\n[ 176.303359] nf_hook_slow+0x48/0x124\n[ 176.303\n---truncated---", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50045" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e454f364-5c4c-42e7-b63e-50f0c3f1c47b.json b/objects/vulnerability/vulnerability--e454f364-5c4c-42e7-b63e-50f0c3f1c47b.json new file mode 100644 index 00000000000..a761724602b --- /dev/null +++ b/objects/vulnerability/vulnerability--e454f364-5c4c-42e7-b63e-50f0c3f1c47b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--07523a81-b59d-4216-94b5-9524f90d9742", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e454f364-5c4c-42e7-b63e-50f0c3f1c47b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.960775Z", + "modified": "2024-10-22T00:37:17.960775Z", + "name": "CVE-2022-49033", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()\n\nSyzkaller reported BUG as follows:\n\n BUG: sleeping function called from invalid context at\n include/linux/sched/mm.h:274\n Call Trace:\n \n dump_stack_lvl+0xcd/0x134\n __might_resched.cold+0x222/0x26b\n kmem_cache_alloc+0x2e7/0x3c0\n update_qgroup_limit_item+0xe1/0x390\n btrfs_qgroup_inherit+0x147b/0x1ee0\n create_subvol+0x4eb/0x1710\n btrfs_mksubvol+0xfe5/0x13f0\n __btrfs_ioctl_snap_create+0x2b0/0x430\n btrfs_ioctl_snap_create_v2+0x25a/0x520\n btrfs_ioctl+0x2a1c/0x5ce0\n __x64_sys_ioctl+0x193/0x200\n do_syscall_64+0x35/0x80\n\nFix this by calling qgroup_dirty() on @dstqgroup, and update limit item in\nbtrfs_run_qgroups() later outside of the spinlock context.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49033" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e4550d29-e756-4a04-bbd5-58f339ac4423.json b/objects/vulnerability/vulnerability--e4550d29-e756-4a04-bbd5-58f339ac4423.json new file mode 100644 index 00000000000..c2808690111 --- /dev/null +++ b/objects/vulnerability/vulnerability--e4550d29-e756-4a04-bbd5-58f339ac4423.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f1ed0b3d-4673-4242-be9b-6a2c48e5c05c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e4550d29-e756-4a04-bbd5-58f339ac4423", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.913724Z", + "modified": "2024-10-22T00:37:10.913724Z", + "name": "CVE-2024-47722", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: use correct end address of kernel for conflict checking\n\nWhen running as a Xen PV dom0 the kernel is loaded by the hypervisor\nusing a different memory map than that of the host. In order to\nminimize the required changes in the kernel, the kernel adapts its\nmemory map to that of the host. In order to do that it is checking\nfor conflicts of its load address with the host memory map.\n\nUnfortunately the tested memory range does not include the .brk\narea, which might result in crashes or memory corruption when this\narea does conflict with the memory map of the host.\n\nFix the test by using the _end label instead of __bss_stop.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47722" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e607d7c6-daad-4de1-906e-e314b56eee61.json b/objects/vulnerability/vulnerability--e607d7c6-daad-4de1-906e-e314b56eee61.json new file mode 100644 index 00000000000..ed326002c2d --- /dev/null +++ b/objects/vulnerability/vulnerability--e607d7c6-daad-4de1-906e-e314b56eee61.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--bc2565a4-c63d-47e8-bdc0-1b8222184289", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e607d7c6-daad-4de1-906e-e314b56eee61", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.962472Z", + "modified": "2024-10-22T00:37:10.962472Z", + "name": "CVE-2024-50061", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition\n\nIn the cdns_i3c_master_probe function, &master->hj_work is bound with\ncdns_i3c_master_hj. And cdns_i3c_master_interrupt can call\ncnds_i3c_master_demux_ibis function to start the work.\n\nIf we remove the module which will call cdns_i3c_master_remove to\nmake cleanup, it will free master->base through i3c_master_unregister\nwhile the work mentioned above will be used. The sequence of operations\nthat may lead to a UAF bug is as follows:\n\nCPU0 CPU1\n\n | cdns_i3c_master_hj\ncdns_i3c_master_remove |\ni3c_master_unregister(&master->base) |\ndevice_unregister(&master->dev) |\ndevice_release |\n//free master->base |\n | i3c_master_do_daa(&master->base)\n | //use master->base\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in cdns_i3c_master_remove.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50061" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e7cc28b2-a278-4c4a-a45c-7535f2b4c61a.json b/objects/vulnerability/vulnerability--e7cc28b2-a278-4c4a-a45c-7535f2b4c61a.json new file mode 100644 index 00000000000..48b625c5d6b --- /dev/null +++ b/objects/vulnerability/vulnerability--e7cc28b2-a278-4c4a-a45c-7535f2b4c61a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--17158158-ad2a-4de6-88af-f7b3bbe915be", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e7cc28b2-a278-4c4a-a45c-7535f2b4c61a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.851363Z", + "modified": "2024-10-22T00:37:10.851363Z", + "name": "CVE-2024-47730", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - inject error before stopping queue\n\nThe master ooo cannot be completely closed when the\naccelerator core reports memory error. Therefore, the driver\nneeds to inject the qm error to close the master ooo. Currently,\nthe qm error is injected after stopping queue, memory may be\nreleased immediately after stopping queue, causing the device to\naccess the released memory. Therefore, error is injected to close master\nooo before stopping queue to ensure that the device does not access\nthe released memory.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47730" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e874e905-4d57-42e6-9834-1565e7505044.json b/objects/vulnerability/vulnerability--e874e905-4d57-42e6-9834-1565e7505044.json new file mode 100644 index 00000000000..b7d8ad9eae1 --- /dev/null +++ b/objects/vulnerability/vulnerability--e874e905-4d57-42e6-9834-1565e7505044.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a36e80ee-7b2c-4ccf-9b21-df32c42ed923", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e874e905-4d57-42e6-9834-1565e7505044", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.968752Z", + "modified": "2024-10-22T00:37:10.968752Z", + "name": "CVE-2024-50015", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: dax: fix overflowing extents beyond inode size when partially writing\n\nThe dax_iomap_rw() does two things in each iteration: map written blocks\nand copy user data to blocks. If the process is killed by user(See signal\nhandling in dax_iomap_iter()), the copied data will be returned and added\non inode size, which means that the length of written extents may exceed\nthe inode size, then fsck will fail. An example is given as:\n\ndd if=/dev/urandom of=file bs=4M count=1\n dax_iomap_rw\n iomap_iter // round 1\n ext4_iomap_begin\n ext4_iomap_alloc // allocate 0~2M extents(written flag)\n dax_iomap_iter // copy 2M data\n iomap_iter // round 2\n iomap_iter_advance\n iter->pos += iter->processed // iter->pos = 2M\n ext4_iomap_begin\n ext4_iomap_alloc // allocate 2~4M extents(written flag)\n dax_iomap_iter\n fatal_signal_pending\n done = iter->pos - iocb->ki_pos // done = 2M\n ext4_handle_inode_extension\n ext4_update_inode_size // inode size = 2M\n\nfsck reports: Inode 13, i_size is 2097152, should be 4194304. Fix?\n\nFix the problem by truncating extents if the written length is smaller\nthan expected.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50015" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e8f8b049-1ec8-434f-9106-80724c471d75.json b/objects/vulnerability/vulnerability--e8f8b049-1ec8-434f-9106-80724c471d75.json new file mode 100644 index 00000000000..a5fbf23d000 --- /dev/null +++ b/objects/vulnerability/vulnerability--e8f8b049-1ec8-434f-9106-80724c471d75.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f2f374f1-3448-4484-9d90-2b56897482b1", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e8f8b049-1ec8-434f-9106-80724c471d75", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.655462Z", + "modified": "2024-10-22T00:37:16.655462Z", + "name": "CVE-2022-48993", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Use kzalloc() in fbcon_prepare_logo()\n\nA kernel built with syzbot's config file reported that\n\n scr_memcpyw(q, save, array3_size(logo_lines, new_cols, 2))\n\ncauses uninitialized \"save\" to be copied.\n\n ----------\n [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0\n [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1\n Console: switching to colour frame buffer device 128x48\n =====================================================\n BUG: KMSAN: uninit-value in do_update_region+0x4b8/0xba0\n do_update_region+0x4b8/0xba0\n update_region+0x40d/0x840\n fbcon_switch+0x3364/0x35e0\n redraw_screen+0xae3/0x18a0\n do_bind_con_driver+0x1cb3/0x1df0\n do_take_over_console+0x11cb/0x13f0\n fbcon_fb_registered+0xacc/0xfd0\n register_framebuffer+0x1179/0x1320\n __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40\n drm_fbdev_client_hotplug+0xbea/0xda0\n drm_fbdev_generic_setup+0x65e/0x9d0\n vkms_init+0x9f3/0xc76\n (...snipped...)\n\n Uninit was stored to memory at:\n fbcon_prepare_logo+0x143b/0x1940\n fbcon_init+0x2c1b/0x31c0\n visual_init+0x3e7/0x820\n do_bind_con_driver+0x14a4/0x1df0\n do_take_over_console+0x11cb/0x13f0\n fbcon_fb_registered+0xacc/0xfd0\n register_framebuffer+0x1179/0x1320\n __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40\n drm_fbdev_client_hotplug+0xbea/0xda0\n drm_fbdev_generic_setup+0x65e/0x9d0\n vkms_init+0x9f3/0xc76\n (...snipped...)\n\n Uninit was created at:\n __kmem_cache_alloc_node+0xb69/0x1020\n __kmalloc+0x379/0x680\n fbcon_prepare_logo+0x704/0x1940\n fbcon_init+0x2c1b/0x31c0\n visual_init+0x3e7/0x820\n do_bind_con_driver+0x14a4/0x1df0\n do_take_over_console+0x11cb/0x13f0\n fbcon_fb_registered+0xacc/0xfd0\n register_framebuffer+0x1179/0x1320\n __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40\n drm_fbdev_client_hotplug+0xbea/0xda0\n drm_fbdev_generic_setup+0x65e/0x9d0\n vkms_init+0x9f3/0xc76\n (...snipped...)\n\n CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc4-00356-g8f2975c2bb4c #924\n Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\n ----------", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48993" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e91324d3-8863-4726-903c-0f6ce7d2ae9a.json b/objects/vulnerability/vulnerability--e91324d3-8863-4726-903c-0f6ce7d2ae9a.json new file mode 100644 index 00000000000..e1daea55885 --- /dev/null +++ b/objects/vulnerability/vulnerability--e91324d3-8863-4726-903c-0f6ce7d2ae9a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--213da8e6-a994-4c0b-8f6c-fb108d428bbc", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e91324d3-8863-4726-903c-0f6ce7d2ae9a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.651687Z", + "modified": "2024-10-22T00:37:16.651687Z", + "name": "CVE-2022-48985", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix race on per-CQ variable napi work_done\n\nAfter calling napi_complete_done(), the NAPIF_STATE_SCHED bit may be\ncleared, and another CPU can start napi thread and access per-CQ variable,\ncq->work_done. If the other thread (for example, from busy_poll) sets\nit to a value >= budget, this thread will continue to run when it should\nstop, and cause memory corruption and panic.\n\nTo fix this issue, save the per-CQ work_done variable in a local variable\nbefore napi_complete_done(), so it won't be corrupted by a possible\nconcurrent thread after napi_complete_done().\n\nAlso, add a flag bit to advertise to the NIC firmware: the NAPI work_done\nvariable race is fixed, so the driver is able to reliably support features\nlike busy_poll.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48985" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--e9a0cfd5-a47c-441f-b08d-9ccbb40eb57a.json b/objects/vulnerability/vulnerability--e9a0cfd5-a47c-441f-b08d-9ccbb40eb57a.json new file mode 100644 index 00000000000..68921c4d6f4 --- /dev/null +++ b/objects/vulnerability/vulnerability--e9a0cfd5-a47c-441f-b08d-9ccbb40eb57a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--bcb87f69-ffe8-4f3e-a1ba-c0fd6dc6781f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--e9a0cfd5-a47c-441f-b08d-9ccbb40eb57a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.990286Z", + "modified": "2024-10-22T00:37:10.990286Z", + "name": "CVE-2024-50063", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent tail call between progs attached to different hooks\n\nbpf progs can be attached to kernel functions, and the attached functions\ncan take different parameters or return different return values. If\nprog attached to one kernel function tail calls prog attached to another\nkernel function, the ctx access or return value verification could be\nbypassed.\n\nFor example, if prog1 is attached to func1 which takes only 1 parameter\nand prog2 is attached to func2 which takes two parameters. Since verifier\nassumes the bpf ctx passed to prog2 is constructed based on func2's\nprototype, verifier allows prog2 to access the second parameter from\nthe bpf ctx passed to it. The problem is that verifier does not prevent\nprog1 from passing its bpf ctx to prog2 via tail call. In this case,\nthe bpf ctx passed to prog2 is constructed from func1 instead of func2,\nthat is, the assumption for ctx access verification is bypassed.\n\nAnother example, if BPF LSM prog1 is attached to hook file_alloc_security,\nand BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier\nknows the return value rules for these two hooks, e.g. it is legal for\nbpf_lsm_audit_rule_known to return positive number 1, and it is illegal\nfor file_alloc_security to return positive number. So verifier allows\nprog2 to return positive number 1, but does not allow prog1 to return\npositive number. The problem is that verifier does not prevent prog1\nfrom calling prog2 via tail call. In this case, prog2's return value 1\nwill be used as the return value for prog1's hook file_alloc_security.\nThat is, the return value rule is bypassed.\n\nThis patch adds restriction for tail call to prevent such bypasses.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50063" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--eb7015ee-8dc3-47dd-a21b-334ef0fe61e3.json b/objects/vulnerability/vulnerability--eb7015ee-8dc3-47dd-a21b-334ef0fe61e3.json new file mode 100644 index 00000000000..398a405269b --- /dev/null +++ b/objects/vulnerability/vulnerability--eb7015ee-8dc3-47dd-a21b-334ef0fe61e3.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--01d5559f-d635-4074-99e0-3d5373b2970d", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--eb7015ee-8dc3-47dd-a21b-334ef0fe61e3", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.010712Z", + "modified": "2024-10-22T00:37:11.010712Z", + "name": "CVE-2024-50035", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: fix ppp_async_encode() illegal access\n\nsyzbot reported an issue in ppp_async_encode() [1]\n\nIn this case, pppoe_sendmsg() is called with a zero size.\nThen ppp_async_encode() is called with an empty skb.\n\nBUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline]\n BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675\n ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline]\n ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675\n ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634\n ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline]\n ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304\n pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379\n sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113\n __release_sock+0x1da/0x330 net/core/sock.c:3072\n release_sock+0x6b/0x250 net/core/sock.c:3626\n pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903\n sock_sendmsg_nosec net/socket.c:729 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:744\n ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n __do_sys_sendmmsg net/socket.c:2771 [inline]\n __se_sys_sendmmsg net/socket.c:2768 [inline]\n __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4092 [inline]\n slab_alloc_node mm/slub.c:4135 [inline]\n kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\n __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\n alloc_skb include/linux/skbuff.h:1322 [inline]\n sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732\n pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867\n sock_sendmsg_nosec net/socket.c:729 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:744\n ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n __do_sys_sendmmsg net/socket.c:2771 [inline]\n __se_sys_sendmmsg net/socket.c:2768 [inline]\n __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50035" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ebfadac7-bed4-4060-80a7-1f63a1531e15.json b/objects/vulnerability/vulnerability--ebfadac7-bed4-4060-80a7-1f63a1531e15.json new file mode 100644 index 00000000000..dc238f4549e --- /dev/null +++ b/objects/vulnerability/vulnerability--ebfadac7-bed4-4060-80a7-1f63a1531e15.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--42cd7c0d-8576-4938-8103-fe2d410fd2fa", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ebfadac7-bed4-4060-80a7-1f63a1531e15", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.741794Z", + "modified": "2024-10-22T00:37:16.741794Z", + "name": "CVE-2022-48953", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: cmos: Fix event handler registration ordering issue\n\nBecause acpi_install_fixed_event_handler() enables the event\nautomatically on success, it is incorrect to call it before the\nhandler routine passed to it is ready to handle events.\n\nUnfortunately, the rtc-cmos driver does exactly the incorrect thing\nby calling cmos_wake_setup(), which passes rtc_handler() to\nacpi_install_fixed_event_handler(), before cmos_do_probe(), because\nrtc_handler() uses dev_get_drvdata() to get to the cmos object\npointer and the driver data pointer is only populated in\ncmos_do_probe().\n\nThis leads to a NULL pointer dereference in rtc_handler() on boot\nif the RTC fixed event happens to be active at the init time.\n\nTo address this issue, change the initialization ordering of the\ndriver so that cmos_wake_setup() is always called after a successful\ncmos_do_probe() call.\n\nWhile at it, change cmos_pnp_probe() to call cmos_do_probe() after\nthe initial if () statement used for computing the IRQ argument to\nbe passed to cmos_do_probe() which is cleaner than calling it in\neach branch of that if () (local variable \"irq\" can be of type int,\nbecause it is passed to that function as an argument of type int).\n\nNote that commit 6492fed7d8c9 (\"rtc: rtc-cmos: Do not check\nACPI_FADT_LOW_POWER_S0\") caused this issue to affect a larger number\nof systems, because previously it only affected systems with\nACPI_FADT_LOW_POWER_S0 set, but it is present regardless of that\ncommit.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48953" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ec05e684-82c9-4388-8cfd-3bb788405165.json b/objects/vulnerability/vulnerability--ec05e684-82c9-4388-8cfd-3bb788405165.json new file mode 100644 index 00000000000..d4777bb28b2 --- /dev/null +++ b/objects/vulnerability/vulnerability--ec05e684-82c9-4388-8cfd-3bb788405165.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f5b3ee88-8d2d-4db8-abdb-b69458da13ef", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ec05e684-82c9-4388-8cfd-3bb788405165", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.020335Z", + "modified": "2024-10-22T00:37:12.020335Z", + "name": "CVE-2024-49992", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/stm: Avoid use-after-free issues with crtc and plane\n\nltdc_load() calls functions drm_crtc_init_with_planes(),\ndrm_universal_plane_init() and drm_encoder_init(). These functions\nshould not be called with parameters allocated with devm_kzalloc()\nto avoid use-after-free issues [1].\n\nUse allocations managed by the DRM framework.\n\nFound by Linux Verification Center (linuxtesting.org).\n\n[1]\nhttps://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49992" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ec3e2b7c-96c3-488b-be70-07edf9774353.json b/objects/vulnerability/vulnerability--ec3e2b7c-96c3-488b-be70-07edf9774353.json new file mode 100644 index 00000000000..57df529bd3b --- /dev/null +++ b/objects/vulnerability/vulnerability--ec3e2b7c-96c3-488b-be70-07edf9774353.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--8b479673-42b4-4a69-854b-ddd4383a5235", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ec3e2b7c-96c3-488b-be70-07edf9774353", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.963816Z", + "modified": "2024-10-22T00:37:10.963816Z", + "name": "CVE-2024-50002", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstatic_call: Handle module init failure correctly in static_call_del_module()\n\nModule insertion invokes static_call_add_module() to initialize the static\ncalls in a module. static_call_add_module() invokes __static_call_init(),\nwhich allocates a struct static_call_mod to either encapsulate the built-in\nstatic call sites of the associated key into it so further modules can be\nadded or to append the module to the module chain.\n\nIf that allocation fails the function returns with an error code and the\nmodule core invokes static_call_del_module() to clean up eventually added\nstatic_call_mod entries.\n\nThis works correctly, when all keys used by the module were converted over\nto a module chain before the failure. If not then static_call_del_module()\ncauses a #GP as it blindly assumes that key::mods points to a valid struct\nstatic_call_mod.\n\nThe problem is that key::mods is not a individual struct member of struct\nstatic_call_key, it's part of a union to save space:\n\n union {\n /* bit 0: 0 = mods, 1 = sites */\n unsigned long type;\n struct static_call_mod *mods;\n struct static_call_site *sites;\n\t};\n\nkey::sites is a pointer to the list of built-in usage sites of the static\ncall. The type of the pointer is differentiated by bit 0. A mods pointer\nhas the bit clear, the sites pointer has the bit set.\n\nAs static_call_del_module() blidly assumes that the pointer is a valid\nstatic_call_mod type, it fails to check for this failure case and\ndereferences the pointer to the list of built-in call sites, which is\nobviously bogus.\n\nCure it by checking whether the key has a sites or a mods pointer.\n\nIf it's a sites pointer then the key is not to be touched. As the sites are\nwalked in the same order as in __static_call_init() the site walk can be\nterminated because all subsequent sites have not been touched by the init\ncode due to the error exit.\n\nIf it was converted before the allocation fail, then the inner loop which\nsearches for a module match will find nothing.\n\nA fail in the second allocation in __static_call_init() is harmless and\ndoes not require special treatment. The first allocation succeeded and\nconverted the key to a module chain. That first entry has mod::mod == NULL\nand mod::next == NULL, so the inner loop of static_call_del_module() will\nneither find a module match nor a module chain. The next site in the walk\nwas either already converted, but can't match the module, or it will exit\nthe outer loop because it has a static_call_site pointer and not a\nstatic_call_mod pointer.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50002" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ec42bdec-6869-43d3-9555-6f89a486d980.json b/objects/vulnerability/vulnerability--ec42bdec-6869-43d3-9555-6f89a486d980.json new file mode 100644 index 00000000000..098f9d13dc5 --- /dev/null +++ b/objects/vulnerability/vulnerability--ec42bdec-6869-43d3-9555-6f89a486d980.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--a3bbffd4-3496-4f7e-9615-45115e2992f6", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ec42bdec-6869-43d3-9555-6f89a486d980", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:11.008273Z", + "modified": "2024-10-22T00:37:11.008273Z", + "name": "CVE-2024-50001", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix error path in multi-packet WQE transmit\n\nRemove the erroneous unmap in case no DMA mapping was established\n\nThe multi-packet WQE transmit code attempts to obtain a DMA mapping for\nthe skb. This could fail, e.g. under memory pressure, when the IOMMU\ndriver just can't allocate more memory for page tables. While the code\ntries to handle this in the path below the err_unmap label it erroneously\nunmaps one entry from the sq's FIFO list of active mappings. Since the\ncurrent map attempt failed this unmap is removing some random DMA mapping\nthat might still be required. If the PCI function now presents that IOVA,\nthe IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI\nfunction in error state.\n\nThe erroneous behavior was seen in a stress-test environment that created\nmemory pressure.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50001" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ec5d3a0d-873b-4bb1-975b-1c966829bf83.json b/objects/vulnerability/vulnerability--ec5d3a0d-873b-4bb1-975b-1c966829bf83.json new file mode 100644 index 00000000000..40456140ee9 --- /dev/null +++ b/objects/vulnerability/vulnerability--ec5d3a0d-873b-4bb1-975b-1c966829bf83.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--ea4e889c-1ed4-4184-ac89-69c4c2f0dd1c", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ec5d3a0d-873b-4bb1-975b-1c966829bf83", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.636757Z", + "modified": "2024-10-22T00:37:16.636757Z", + "name": "CVE-2022-48970", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Get user_ns from in_skb in unix_diag_get_exact().\n\nWei Chen reported a NULL deref in sk_user_ns() [0][1], and Paolo diagnosed\nthe root cause: in unix_diag_get_exact(), the newly allocated skb does not\nhave sk. [2]\n\nWe must get the user_ns from the NETLINK_CB(in_skb).sk and pass it to\nsk_diag_fill().\n\n[0]:\nBUG: kernel NULL pointer dereference, address: 0000000000000270\n#PF: supervisor read access in kernel mode\n#PF: error_code(0x0000) - not-present page\nPGD 12bbce067 P4D 12bbce067 PUD 12bc40067 PMD 0\nOops: 0000 [#1] PREEMPT SMP\nCPU: 0 PID: 27942 Comm: syz-executor.0 Not tainted 6.1.0-rc5-next-20221118 #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014\nRIP: 0010:sk_user_ns include/net/sock.h:920 [inline]\nRIP: 0010:sk_diag_dump_uid net/unix/diag.c:119 [inline]\nRIP: 0010:sk_diag_fill+0x77d/0x890 net/unix/diag.c:170\nCode: 89 ef e8 66 d4 2d fd c7 44 24 40 00 00 00 00 49 8d 7c 24 18 e8\n54 d7 2d fd 49 8b 5c 24 18 48 8d bb 70 02 00 00 e8 43 d7 2d fd <48> 8b\n9b 70 02 00 00 48 8d 7b 10 e8 33 d7 2d fd 48 8b 5b 10 48 8d\nRSP: 0018:ffffc90000d67968 EFLAGS: 00010246\nRAX: ffff88812badaa48 RBX: 0000000000000000 RCX: ffffffff840d481d\nRDX: 0000000000000465 RSI: 0000000000000000 RDI: 0000000000000270\nRBP: ffffc90000d679a8 R08: 0000000000000277 R09: 0000000000000000\nR10: 0001ffffffffffff R11: 0001c90000d679a8 R12: ffff88812ac03800\nR13: ffff88812c87c400 R14: ffff88812ae42210 R15: ffff888103026940\nFS: 00007f08b4e6f700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000270 CR3: 000000012c58b000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n unix_diag_get_exact net/unix/diag.c:285 [inline]\n unix_diag_handler_dump+0x3f9/0x500 net/unix/diag.c:317\n __sock_diag_cmd net/core/sock_diag.c:235 [inline]\n sock_diag_rcv_msg+0x237/0x250 net/core/sock_diag.c:266\n netlink_rcv_skb+0x13e/0x250 net/netlink/af_netlink.c:2564\n sock_diag_rcv+0x24/0x40 net/core/sock_diag.c:277\n netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]\n netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1356\n netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1932\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg net/socket.c:734 [inline]\n ____sys_sendmsg+0x38f/0x500 net/socket.c:2476\n ___sys_sendmsg net/socket.c:2530 [inline]\n __sys_sendmsg+0x197/0x230 net/socket.c:2559\n __do_sys_sendmsg net/socket.c:2568 [inline]\n __se_sys_sendmsg net/socket.c:2566 [inline]\n __x64_sys_sendmsg+0x42/0x50 net/socket.c:2566\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x4697f9\nCode: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48\n89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d\n01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f08b4e6ec48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 000000000077bf80 RCX: 00000000004697f9\nRDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003\nRBP: 00000000004d29e9 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 000000000077bf80\nR13: 0000000000000000 R14: 000000000077bf80 R15: 00007ffdb36bc6c0\n \nModules linked in:\nCR2: 0000000000000270\n\n[1]: https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/\n[2]: https://lore.kernel.org/netdev/e04315e7c90d9a75613f3993c2baf2d344eef7eb.camel@redhat.com/", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48970" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ed69adc4-7b7b-4fe1-8f09-636168cccabf.json b/objects/vulnerability/vulnerability--ed69adc4-7b7b-4fe1-8f09-636168cccabf.json new file mode 100644 index 00000000000..868ac21c471 --- /dev/null +++ b/objects/vulnerability/vulnerability--ed69adc4-7b7b-4fe1-8f09-636168cccabf.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--70769128-2571-4e10-9a27-456586d570e2", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ed69adc4-7b7b-4fe1-8f09-636168cccabf", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.847143Z", + "modified": "2024-10-22T00:37:10.847143Z", + "name": "CVE-2024-47721", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading\n\nThe handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn't\nimplemented, but driver expects number of handlers is\nNUM_OF_RTW89_MAC_C2H_FUNC_WOW causing out-of-bounds access. Fix it by\nremoving ID.\n\nAddresses-Coverity-ID: 1598775 (\"Out-of-bounds read\")", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47721" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--edee80a5-e27f-4d25-b4e6-e0da12d58015.json b/objects/vulnerability/vulnerability--edee80a5-e27f-4d25-b4e6-e0da12d58015.json new file mode 100644 index 00000000000..723ff22ce69 --- /dev/null +++ b/objects/vulnerability/vulnerability--edee80a5-e27f-4d25-b4e6-e0da12d58015.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--92888947-250b-4935-83db-7e28c15fba67", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--edee80a5-e27f-4d25-b4e6-e0da12d58015", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.027603Z", + "modified": "2024-10-22T00:37:12.027603Z", + "name": "CVE-2024-49895", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation\n\nThis commit addresses a potential index out of bounds issue in the\n`cm3_helper_translate_curve_to_degamma_hw_format` function in the DCN30\ncolor management module. The issue could occur when the index 'i'\nexceeds the number of transfer function points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds, the function returns\nfalse to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:338 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:339 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:340 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49895" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--edeebba7-aa0e-419a-8d02-875487fea579.json b/objects/vulnerability/vulnerability--edeebba7-aa0e-419a-8d02-875487fea579.json new file mode 100644 index 00000000000..3d918a27acd --- /dev/null +++ b/objects/vulnerability/vulnerability--edeebba7-aa0e-419a-8d02-875487fea579.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--782ccd9d-967b-4be6-b4cc-7ca9a11dd403", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--edeebba7-aa0e-419a-8d02-875487fea579", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.054484Z", + "modified": "2024-10-22T00:37:12.054484Z", + "name": "CVE-2024-49906", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointer before try to access it\n\n[why & how]\nChange the order of the pipe_ctx->plane_state check to ensure that\nplane_state is not null before accessing it.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49906" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--eeefa952-061b-4aac-9ec2-6842e96454c8.json b/objects/vulnerability/vulnerability--eeefa952-061b-4aac-9ec2-6842e96454c8.json new file mode 100644 index 00000000000..fa61fc963f0 --- /dev/null +++ b/objects/vulnerability/vulnerability--eeefa952-061b-4aac-9ec2-6842e96454c8.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--15207e8d-87eb-4a07-aa93-579e71b38099", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--eeefa952-061b-4aac-9ec2-6842e96454c8", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.854134Z", + "modified": "2024-10-22T00:37:10.854134Z", + "name": "CVE-2024-47700", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: check stripe size compatibility on remount as well\n\nWe disable stripe size in __ext4_fill_super if it is not a multiple of\nthe cluster ratio however this check is missed when trying to remount.\nThis can leave us with cases where stripe < cluster_ratio after\nremount:set making EXT4_B2C(sbi->s_stripe) become 0 that can cause some\nunforeseen bugs like divide by 0.\n\nFix that by adding the check in remount path as well.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47700" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ef36da7e-453b-4d05-b181-28119bb825fd.json b/objects/vulnerability/vulnerability--ef36da7e-453b-4d05-b181-28119bb825fd.json new file mode 100644 index 00000000000..5859de20fdc --- /dev/null +++ b/objects/vulnerability/vulnerability--ef36da7e-453b-4d05-b181-28119bb825fd.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--116e9998-1765-423e-8a01-ab5321dc8933", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ef36da7e-453b-4d05-b181-28119bb825fd", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.858771Z", + "modified": "2024-10-22T00:37:10.858771Z", + "name": "CVE-2024-47702", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fail verification for sign-extension of packet data/data_end/data_meta\n\nsyzbot reported a kernel crash due to\n commit 1f1e864b6555 (\"bpf: Handle sign-extenstin ctx member accesses\").\nThe reason is due to sign-extension of 32-bit load for\npacket data/data_end/data_meta uapi field.\n\nThe original code looks like:\n r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */\n r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */\n r0 = r2\n r0 += 8\n if r3 > r0 goto +1\n ...\nNote that __sk_buff->data load has 32-bit sign extension.\n\nAfter verification and convert_ctx_accesses(), the final asm code looks like:\n r2 = *(u64 *)(r1 +208)\n r2 = (s32)r2\n r3 = *(u64 *)(r1 +80)\n r0 = r2\n r0 += 8\n if r3 > r0 goto pc+1\n ...\nNote that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalid\nwhich may cause runtime failure.\n\nCurrently, in C code, typically we have\n void *data = (void *)(long)skb->data;\n void *data_end = (void *)(long)skb->data_end;\n ...\nand it will generate\n r2 = *(u64 *)(r1 +208)\n r3 = *(u64 *)(r1 +80)\n r0 = r2\n r0 += 8\n if r3 > r0 goto pc+1\n\nIf we allow sign-extension,\n void *data = (void *)(long)(int)skb->data;\n void *data_end = (void *)(long)skb->data_end;\n ...\nthe generated code looks like\n r2 = *(u64 *)(r1 +208)\n r2 <<= 32\n r2 s>>= 32\n r3 = *(u64 *)(r1 +80)\n r0 = r2\n r0 += 8\n if r3 > r0 goto pc+1\nand this will cause verification failure since \"r2 <<= 32\" is not allowed\nas \"r2\" is a packet pointer.\n\nTo fix this issue for case\n r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */\nthis patch added additional checking in is_valid_access() callback\nfunction for packet data/data_end/data_meta access. If those accesses\nare with sign-extenstion, the verification will fail.\n\n [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47702" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ef4093a9-2354-413c-856b-884d466b534a.json b/objects/vulnerability/vulnerability--ef4093a9-2354-413c-856b-884d466b534a.json new file mode 100644 index 00000000000..9aea57d4cd0 --- /dev/null +++ b/objects/vulnerability/vulnerability--ef4093a9-2354-413c-856b-884d466b534a.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--712bdf66-1cbc-47d7-a1d5-4b29fe00f76a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ef4093a9-2354-413c-856b-884d466b534a", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.822346Z", + "modified": "2024-10-22T00:37:10.822346Z", + "name": "CVE-2024-47746", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: use exclusive lock when FUSE_I_CACHE_IO_MODE is set\n\nThis may be a typo. The comment has said shared locks are\nnot allowed when this bit is set. If using shared lock, the\nwait in `fuse_file_cached_io_open` may be forever.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47746" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--f0ac32e3-bbd6-4936-ba79-e51ee8d962ba.json b/objects/vulnerability/vulnerability--f0ac32e3-bbd6-4936-ba79-e51ee8d962ba.json new file mode 100644 index 00000000000..782b87f4caa --- /dev/null +++ b/objects/vulnerability/vulnerability--f0ac32e3-bbd6-4936-ba79-e51ee8d962ba.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--262b0624-6594-4486-b88f-65888f97f4d8", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--f0ac32e3-bbd6-4936-ba79-e51ee8d962ba", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.114275Z", + "modified": "2024-10-22T00:37:12.114275Z", + "name": "CVE-2024-49919", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn201_acquire_free_pipe_for_layer` function. The issue could occur\nwhen `head_pipe` is null.\n\nThe fix adds a check to ensure `head_pipe` is not null before asserting\nit. If `head_pipe` is null, the function returns NULL to prevent a\npotential null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn201/dcn201_resource.c:1016 dcn201_acquire_free_pipe_for_layer() error: we previously assumed 'head_pipe' could be null (see line 1010)", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49919" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--f23e9480-450d-421b-8bac-eaf8f592d075.json b/objects/vulnerability/vulnerability--f23e9480-450d-421b-8bac-eaf8f592d075.json new file mode 100644 index 00000000000..a8dbdda1c55 --- /dev/null +++ b/objects/vulnerability/vulnerability--f23e9480-450d-421b-8bac-eaf8f592d075.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--86c1b01a-00e4-4389-a5bf-3038d202701f", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--f23e9480-450d-421b-8bac-eaf8f592d075", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:17.950345Z", + "modified": "2024-10-22T00:37:17.950345Z", + "name": "CVE-2022-49014", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: Fix use-after-free in tun_detach()\n\nsyzbot reported use-after-free in tun_detach() [1]. This causes call\ntrace like below:\n\n==================================================================\nBUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75\nRead of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673\n\nCPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nCall Trace:\n \n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:284 [inline]\n print_report+0x15e/0x461 mm/kasan/report.c:395\n kasan_report+0xbf/0x1f0 mm/kasan/report.c:495\n notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75\n call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942\n call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]\n call_netdevice_notifiers net/core/dev.c:1997 [inline]\n netdev_wait_allrefs_any net/core/dev.c:10237 [inline]\n netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351\n tun_detach drivers/net/tun.c:704 [inline]\n tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467\n __fput+0x27c/0xa90 fs/file_table.c:320\n task_work_run+0x16f/0x270 kernel/task_work.c:179\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0xb3d/0x2a30 kernel/exit.c:820\n do_group_exit+0xd4/0x2a0 kernel/exit.c:950\n get_signal+0x21b1/0x2440 kernel/signal.c:2858\n arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869\n exit_to_user_mode_loop kernel/entry/common.c:168 [inline]\n exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203\n __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]\n syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296\n do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe cause of the issue is that sock_put() from __tun_detach() drops\nlast reference count for struct net, and then notifier_call_chain()\nfrom netdev_state_change() accesses that struct net.\n\nThis patch fixes the issue by calling sock_put() from tun_detach()\nafter all necessary accesses for the struct net has done.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-49014" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--f26eac34-261d-41ff-beec-2a502a734337.json b/objects/vulnerability/vulnerability--f26eac34-261d-41ff-beec-2a502a734337.json new file mode 100644 index 00000000000..0890c17714f --- /dev/null +++ b/objects/vulnerability/vulnerability--f26eac34-261d-41ff-beec-2a502a734337.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--6c62916a-f4e3-407c-a4aa-5e0768c3a0c5", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--f26eac34-261d-41ff-beec-2a502a734337", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.877126Z", + "modified": "2024-10-22T00:37:10.877126Z", + "name": "CVE-2024-47697", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error\n\nEnsure index in rtl2830_pid_filter does not exceed 31 to prevent\nout-of-bounds access.\n\ndev->filters is a 32-bit value, so set_bit and clear_bit functions should\nonly operate on indices from 0 to 31. If index is 32, it will attempt to\naccess a non-existent 33rd bit, leading to out-of-bounds access.\nChange the boundary check from index > 32 to index >= 32 to resolve this\nissue.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47697" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--f496b663-ef3f-455f-b9da-ff08f45c94fd.json b/objects/vulnerability/vulnerability--f496b663-ef3f-455f-b9da-ff08f45c94fd.json new file mode 100644 index 00000000000..21d0aa64542 --- /dev/null +++ b/objects/vulnerability/vulnerability--f496b663-ef3f-455f-b9da-ff08f45c94fd.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--7ff2c3cb-084f-4190-a3f3-e0a2298828a8", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--f496b663-ef3f-455f-b9da-ff08f45c94fd", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.052683Z", + "modified": "2024-10-22T00:37:12.052683Z", + "name": "CVE-2024-49897", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check phantom_stream before it is used\n\ndcn32_enable_phantom_stream can return null, so returned value\nmust be checked before used.\n\nThis fixes 1 NULL_RETURNS issue reported by Coverity.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49897" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--f76500ea-6425-4e13-bd2b-fa33d6fa2f2d.json b/objects/vulnerability/vulnerability--f76500ea-6425-4e13-bd2b-fa33d6fa2f2d.json new file mode 100644 index 00000000000..86c06652576 --- /dev/null +++ b/objects/vulnerability/vulnerability--f76500ea-6425-4e13-bd2b-fa33d6fa2f2d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b4b0c30b-a5e0-4dfa-a927-c319da281228", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--f76500ea-6425-4e13-bd2b-fa33d6fa2f2d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.035472Z", + "modified": "2024-10-22T00:37:12.035472Z", + "name": "CVE-2024-49891", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths\n\nWhen the HBA is undergoing a reset or is handling an errata event, NULL ptr\ndereference crashes may occur in routines such as\nlpfc_sli_flush_io_rings(), lpfc_dev_loss_tmo_callbk(), or\nlpfc_abort_handler().\n\nAdd NULL ptr checks before dereferencing hdwq pointers that may have been\nfreed due to operations colliding with a reset or errata event handler.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49891" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--f848f3fb-3a73-41bd-8747-b6e206dd110e.json b/objects/vulnerability/vulnerability--f848f3fb-3a73-41bd-8747-b6e206dd110e.json new file mode 100644 index 00000000000..194bd47f34f --- /dev/null +++ b/objects/vulnerability/vulnerability--f848f3fb-3a73-41bd-8747-b6e206dd110e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f769e107-d794-41aa-97f2-7208414f937a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--f848f3fb-3a73-41bd-8747-b6e206dd110e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.191447Z", + "modified": "2024-10-22T00:37:12.191447Z", + "name": "CVE-2024-49934", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name\n\nIt's observed that a crash occurs during hot-remove a memory device,\nin which user is accessing the hugetlb. See calltrace as following:\n\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 14045 at arch/x86/mm/fault.c:1278 do_user_addr_fault+0x2a0/0x790\nModules linked in: kmem device_dax cxl_mem cxl_pmem cxl_port cxl_pci dax_hmem dax_pmem nd_pmem cxl_acpi nd_btt cxl_core crc32c_intel nvme virtiofs fuse nvme_core nfit libnvdimm dm_multipath scsi_dh_rdac scsi_dh_emc s\nmirror dm_region_hash dm_log dm_mod\nCPU: 1 PID: 14045 Comm: daxctl Not tainted 6.10.0-rc2-lizhijian+ #492\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:do_user_addr_fault+0x2a0/0x790\nCode: 48 8b 00 a8 04 0f 84 b5 fe ff ff e9 1c ff ff ff 4c 89 e9 4c 89 e2 be 01 00 00 00 bf 02 00 00 00 e8 b5 ef 24 00 e9 42 fe ff ff <0f> 0b 48 83 c4 08 4c 89 ea 48 89 ee 4c 89 e7 5b 5d 41 5c 41 5d 41\nRSP: 0000:ffffc90000a575f0 EFLAGS: 00010046\nRAX: ffff88800c303600 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000001000 RSI: ffffffff82504162 RDI: ffffffff824b2c36\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffffc90000a57658\nR13: 0000000000001000 R14: ffff88800bc2e040 R15: 0000000000000000\nFS: 00007f51cb57d880(0000) GS:ffff88807fd00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000001000 CR3: 00000000072e2004 CR4: 00000000001706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n ? __warn+0x8d/0x190\n ? do_user_addr_fault+0x2a0/0x790\n ? report_bug+0x1c3/0x1d0\n ? handle_bug+0x3c/0x70\n ? exc_invalid_op+0x14/0x70\n ? asm_exc_invalid_op+0x16/0x20\n ? do_user_addr_fault+0x2a0/0x790\n ? exc_page_fault+0x31/0x200\n exc_page_fault+0x68/0x200\n<...snip...>\nBUG: unable to handle page fault for address: 0000000000001000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0\n Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n ---[ end trace 0000000000000000 ]---\n BUG: unable to handle page fault for address: 0000000000001000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0\n Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 1 PID: 14045 Comm: daxctl Kdump: loaded Tainted: G W 6.10.0-rc2-lizhijian+ #492\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n RIP: 0010:dentry_name+0x1f4/0x440\n<...snip...>\n? dentry_name+0x2fa/0x440\nvsnprintf+0x1f3/0x4f0\nvprintk_store+0x23a/0x540\nvprintk_emit+0x6d/0x330\n_printk+0x58/0x80\ndump_mapping+0x10b/0x1a0\n? __pfx_free_object_rcu+0x10/0x10\n__dump_page+0x26b/0x3e0\n? vprintk_emit+0xe0/0x330\n? _printk+0x58/0x80\n? dump_page+0x17/0x50\ndump_page+0x17/0x50\ndo_migrate_range+0x2f7/0x7f0\n? do_migrate_range+0x42/0x7f0\n? offline_pages+0x2f4/0x8c0\noffline_pages+0x60a/0x8c0\nmemory_subsys_offline+0x9f/0x1c0\n? lockdep_hardirqs_on+0x77/0x100\n? _raw_spin_unlock_irqrestore+0x38/0x60\ndevice_offline+0xe3/0x110\nstate_store+0x6e/0xc0\nkernfs_fop_write_iter+0x143/0x200\nvfs_write+0x39f/0x560\nksys_write+0x65/0xf0\ndo_syscall_64+0x62/0x130\n\nPreviously, some sanity check have been done in dump_mapping() before\nthe print facility parsing '%pd' though, it's still possible to run into\nan invalid dentry.d_name.name.\n\nSince dump_mapping() only needs to dump the filename only, retrieve it\nby itself in a safer way to prevent an unnecessary crash.\n\nNote that either retrieving the filename with '%pd' or\nstrncpy_from_kernel_nofault(), the filename could be unreliable.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49934" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--f89ae087-a057-485b-91b2-49994eb34bc5.json b/objects/vulnerability/vulnerability--f89ae087-a057-485b-91b2-49994eb34bc5.json new file mode 100644 index 00000000000..d40cac876ab --- /dev/null +++ b/objects/vulnerability/vulnerability--f89ae087-a057-485b-91b2-49994eb34bc5.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--f7e470a4-64e7-4e31-be58-6e5752032dea", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--f89ae087-a057-485b-91b2-49994eb34bc5", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.571112Z", + "modified": "2024-10-22T00:37:10.571112Z", + "name": "CVE-2024-30158", + "description": "A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-30158" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--f8bb84db-debf-49a5-a800-31d46ffc994b.json b/objects/vulnerability/vulnerability--f8bb84db-debf-49a5-a800-31d46ffc994b.json new file mode 100644 index 00000000000..53a09cd6ef8 --- /dev/null +++ b/objects/vulnerability/vulnerability--f8bb84db-debf-49a5-a800-31d46ffc994b.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--70c353b4-f185-4b22-867e-205768390ba3", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--f8bb84db-debf-49a5-a800-31d46ffc994b", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.967479Z", + "modified": "2024-10-22T00:37:10.967479Z", + "name": "CVE-2024-50032", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/nocb: Fix rcuog wake-up from offline softirq\n\nAfter a CPU has set itself offline and before it eventually calls\nrcutree_report_cpu_dead(), there are still opportunities for callbacks\nto be enqueued, for example from a softirq. When that happens on NOCB,\nthe rcuog wake-up is deferred through an IPI to an online CPU in order\nnot to call into the scheduler and risk arming the RT-bandwidth after\nhrtimers have been migrated out and disabled.\n\nBut performing a synchronized IPI from a softirq is buggy as reported in\nthe following scenario:\n\n WARNING: CPU: 1 PID: 26 at kernel/smp.c:633 smp_call_function_single\n Modules linked in: rcutorture torture\n CPU: 1 UID: 0 PID: 26 Comm: migration/1 Not tainted 6.11.0-rc1-00012-g9139f93209d1 #1\n Stopper: multi_cpu_stop+0x0/0x320 <- __stop_cpus+0xd0/0x120\n RIP: 0010:smp_call_function_single\n \n swake_up_one_online\n __call_rcu_nocb_wake\n __call_rcu_common\n ? rcu_torture_one_read\n call_timer_fn\n __run_timers\n run_timer_softirq\n handle_softirqs\n irq_exit_rcu\n ? tick_handle_periodic\n sysvec_apic_timer_interrupt\n \n\nFix this with forcing deferred rcuog wake up through the NOCB timer when\nthe CPU is offline. The actual wake up will happen from\nrcutree_report_cpu_dead().", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-50032" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--f9290753-fde0-4fb8-a106-92cae84e4289.json b/objects/vulnerability/vulnerability--f9290753-fde0-4fb8-a106-92cae84e4289.json new file mode 100644 index 00000000000..b31204dce8f --- /dev/null +++ b/objects/vulnerability/vulnerability--f9290753-fde0-4fb8-a106-92cae84e4289.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--5faa275d-d90f-4849-9eef-6fc702453dd0", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--f9290753-fde0-4fb8-a106-92cae84e4289", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.684311Z", + "modified": "2024-10-22T00:37:16.684311Z", + "name": "CVE-2022-48960", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hisilicon: Fix potential use-after-free in hix5hd2_rx()\n\nThe skb is delivered to napi_gro_receive() which may free it, after\ncalling this, dereferencing skb may trigger use-after-free.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48960" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--f9767cfd-e4ad-417a-973f-9113beb55b6d.json b/objects/vulnerability/vulnerability--f9767cfd-e4ad-417a-973f-9113beb55b6d.json new file mode 100644 index 00000000000..c76a74376b3 --- /dev/null +++ b/objects/vulnerability/vulnerability--f9767cfd-e4ad-417a-973f-9113beb55b6d.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--0afbe6a9-1a36-4dd5-9926-9ab91527b974", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--f9767cfd-e4ad-417a-973f-9113beb55b6d", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.710612Z", + "modified": "2024-10-22T00:37:16.710612Z", + "name": "CVE-2022-48981", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/shmem-helper: Remove errant put in error path\n\ndrm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM\nobject getting prematurely freed leading to a later use-after-free.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48981" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--fb0043b6-e3cf-49b1-a64f-2ed6decf266e.json b/objects/vulnerability/vulnerability--fb0043b6-e3cf-49b1-a64f-2ed6decf266e.json new file mode 100644 index 00000000000..6cae5254e3c --- /dev/null +++ b/objects/vulnerability/vulnerability--fb0043b6-e3cf-49b1-a64f-2ed6decf266e.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--3b27a5dc-7788-41c3-a063-5f7839008276", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--fb0043b6-e3cf-49b1-a64f-2ed6decf266e", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:16.642259Z", + "modified": "2024-10-22T00:37:16.642259Z", + "name": "CVE-2022-48948", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: Prevent buffer overflow in setup handler\n\nSetup function uvc_function_setup permits control transfer\nrequests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE),\ndata stage handler for OUT transfer uses memcpy to copy req->actual\nbytes to uvc_event->data.data array of size 60. This may result\nin an overflow of 4 bytes.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2022-48948" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--fbee906f-5074-412c-9ca3-153b6005dbc8.json b/objects/vulnerability/vulnerability--fbee906f-5074-412c-9ca3-153b6005dbc8.json new file mode 100644 index 00000000000..e769b00cafe --- /dev/null +++ b/objects/vulnerability/vulnerability--fbee906f-5074-412c-9ca3-153b6005dbc8.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--b3464f70-a35f-4b3b-b6e9-09994461401e", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--fbee906f-5074-412c-9ca3-153b6005dbc8", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.278053Z", + "modified": "2024-10-22T00:37:12.278053Z", + "name": "CVE-2024-49952", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: prevent nf_skb_duplicated corruption\n\nsyzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write\nper-cpu variable nf_skb_duplicated in an unsafe way [1].\n\nDisabling preemption as hinted by the splat is not enough,\nwe have to disable soft interrupts as well.\n\n[1]\nBUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316\n caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87\nCPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nCall Trace:\n \n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49\n nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87\n nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288\n nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626\n nf_hook+0x2c4/0x450 include/linux/netfilter.h:269\n NF_HOOK_COND include/linux/netfilter.h:302 [inline]\n ip_output+0x185/0x230 net/ipv4/ip_output.c:433\n ip_local_out net/ipv4/ip_output.c:129 [inline]\n ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495\n udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981\n udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x1a6/0x270 net/socket.c:745\n ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597\n ___sys_sendmsg net/socket.c:2651 [inline]\n __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737\n __do_sys_sendmmsg net/socket.c:2766 [inline]\n __se_sys_sendmmsg net/socket.c:2763 [inline]\n __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f4ce4f7def9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133\nRAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9\nRDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006\nRBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68\n ", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49952" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--fdf8bee4-0434-43be-9977-6b52ae18a175.json b/objects/vulnerability/vulnerability--fdf8bee4-0434-43be-9977-6b52ae18a175.json new file mode 100644 index 00000000000..52152733d52 --- /dev/null +++ b/objects/vulnerability/vulnerability--fdf8bee4-0434-43be-9977-6b52ae18a175.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--c8825b52-7840-4299-b87b-ea3cf530125a", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--fdf8bee4-0434-43be-9977-6b52ae18a175", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:13.102699Z", + "modified": "2024-10-22T00:37:13.102699Z", + "name": "CVE-2024-43945", + "description": "Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.This issue affects LatePoint: from n/a through 4.9.91.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-43945" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--fe82be6b-96ef-4a03-8ee9-e5f6a9a930f7.json b/objects/vulnerability/vulnerability--fe82be6b-96ef-4a03-8ee9-e5f6a9a930f7.json new file mode 100644 index 00000000000..ddd9d1e612e --- /dev/null +++ b/objects/vulnerability/vulnerability--fe82be6b-96ef-4a03-8ee9-e5f6a9a930f7.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--500a7a6b-2b6a-4947-b501-ed3e59b54236", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--fe82be6b-96ef-4a03-8ee9-e5f6a9a930f7", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:10.836979Z", + "modified": "2024-10-22T00:37:10.836979Z", + "name": "CVE-2024-47733", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Delete subtree of 'fs/netfs' when netfs module exits\n\nIn netfs_init() or fscache_proc_init(), we create dentry under 'fs/netfs',\nbut in netfs_exit(), we only delete the proc entry of 'fs/netfs' without\ndeleting its subtree. This triggers the following WARNING:\n\n==================================================================\nremove_proc_entry: removing non-empty directory 'fs/netfs', leaking at least 'requests'\nWARNING: CPU: 4 PID: 566 at fs/proc/generic.c:717 remove_proc_entry+0x160/0x1c0\nModules linked in: netfs(-)\nCPU: 4 UID: 0 PID: 566 Comm: rmmod Not tainted 6.11.0-rc3 #860\nRIP: 0010:remove_proc_entry+0x160/0x1c0\nCall Trace:\n \n netfs_exit+0x12/0x620 [netfs]\n __do_sys_delete_module.isra.0+0x14c/0x2e0\n do_syscall_64+0x4b/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n==================================================================\n\nTherefore use remove_proc_subtree() instead of remove_proc_entry() to\nfix the above problem.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-47733" + } + ] + } + ] +} \ No newline at end of file diff --git a/objects/vulnerability/vulnerability--ff30e5eb-b3e0-486c-b5f0-b523081beb56.json b/objects/vulnerability/vulnerability--ff30e5eb-b3e0-486c-b5f0-b523081beb56.json new file mode 100644 index 00000000000..177a17c5a14 --- /dev/null +++ b/objects/vulnerability/vulnerability--ff30e5eb-b3e0-486c-b5f0-b523081beb56.json @@ -0,0 +1,22 @@ +{ + "type": "bundle", + "id": "bundle--fcb90f28-a683-4f0a-a0bd-040acc4af797", + "objects": [ + { + "type": "vulnerability", + "spec_version": "2.1", + "id": "vulnerability--ff30e5eb-b3e0-486c-b5f0-b523081beb56", + "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", + "created": "2024-10-22T00:37:12.14639Z", + "modified": "2024-10-22T00:37:12.14639Z", + "name": "CVE-2024-49879", + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: omapdrm: Add missing check for alloc_ordered_workqueue\n\nAs it may return NULL pointer and cause NULL pointer dereference. Add check\nfor the return value of alloc_ordered_workqueue.", + "external_references": [ + { + "source_name": "cve", + "external_id": "CVE-2024-49879" + } + ] + } + ] +} \ No newline at end of file