CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2024-26956 – nilfs2: fix failure to detect DAT corruption in btree and direct mappings
https://notcve.org/view.php?id=CVE-2024-26956
Dado que hay dos fallas involucradas, hice un parche para cada uno por separado. ... Hay dos errores involucrados en este tema. • https://git.kernel.org/stable/c/c3a7abf06ce719a51139e62a034590be99abbc2c https://git.kernel.org/stable/c/b67189690eb4b7ecc84ae16fa1e880e0123eaa35 https://git.kernel.org/stable/c/9cbe1ad5f4354f4df1445e5f4883983328cd6d8e https://git.kernel.org/stable/c/c3b5c5c31e723b568f83d8cafab8629d9d830ffb https://git.kernel.org/stable/c/2e2619ff5d0def4bb6c2037a32a6eaa28dd95c84 https://git.kernel.org/stable/c/46b832e09d43b394ac0f6d9485d2b1a06593f0b7 https://git.kernel.org/stable/c/f69e81396aea66304d214f175aa371f1b5578862 https://git.kernel.org/stable/c/a8e4d098de1c0f4c5c1f2ed4633a860f0 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-26947 – ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
https://notcve.org/view.php?id=CVE-2024-26947
This flaw allows an attacker who can specify or alter memory layouts to cause a denial of service. • https://git.kernel.org/stable/c/a4d5613c4dc6d413e0733e37db9d116a2a36b9f3 https://git.kernel.org/stable/c/6026d4032dbbe3d7f4ac2c8daa923fe74dcf41c4 https://git.kernel.org/stable/c/65c578935bcc26ddc04e6757b2c7be95bf235b31 https://git.kernel.org/stable/c/0c027c2bad7f5111c51a358b5d392e1a695dabff https://git.kernel.org/stable/c/9f7ddc222cae8254e93d5c169a8ae11a49d912a7 https://git.kernel.org/stable/c/fb3a122a978626b33de3367ee1762da934c0f512 https://git.kernel.org/stable/c/0c66c6f4e21cb22220cbd8821c5c73fc157d20dc https://access.redhat.com/security/cve/CVE-2024-26947 • CWE-439: Behavioral Change in New Version or Environment •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-26940 – drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
https://notcve.org/view.php?id=CVE-2024-26940
Trying to read the /sys/kernel/debug/dri/0/mob_ttm file when the ttm_resource_manager is not allocated will cause a crash, resulting in a denial of service. • https://git.kernel.org/stable/c/af4a25bbe5e7e60ff696ef5c1ec48ab2d51c17c6 https://git.kernel.org/stable/c/016119154981d81c9e8f2ea3f56b9e2b4ea14500 https://git.kernel.org/stable/c/042ef0afc40fa1a22b3608f22915b91ce39d128f https://git.kernel.org/stable/c/25e3ce59c1200f1f0563e39de151f34962ab0fe1 https://git.kernel.org/stable/c/eb08db0fc5354fa17b7ed66dab3c503332423451 https://git.kernel.org/stable/c/4be9075fec0a639384ed19975634b662bfab938f https://access.redhat.com/security/cve/CVE-2024-26940 https://bugzilla.redhat.com/show_bug.cgi?id=2278218 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-26939 – drm/i915/vma: Fix UAF on destroy against retire race
https://notcve.org/view.php?id=CVE-2024-26939
Sin embargo, su visibilidad para la herramienta de depuración de objetos fue suprimida por un error en i915_active que se solucionó dos semanas después con el commit e92eb246feb9 ("drm/i915/active: Reparar la activación del objeto de depuración que falta"). • https://git.kernel.org/stable/c/d93939730347360db0afe6a4367451b6f84ab7b1 https://git.kernel.org/stable/c/704edc9252f4988ae1ad7dafa23d0db8d90d7190 https://git.kernel.org/stable/c/5e3eb862df9f972ab677fb19e0d4b9b1be8db7b5 https://git.kernel.org/stable/c/59b2626dd8c8a2e13f18054b3530e0c00073d79f https://git.kernel.org/stable/c/0e45882ca829b26b915162e8e86dbb1095768e9e https://access.redhat.com/security/cve/CVE-2024-26939 https://bugzilla.redhat.com/show_bug.cgi?id=2278220 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-26932 – usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()
https://notcve.org/view.php?id=CVE-2024-26932
La causa principal es que la misma capacidad se liberará dos veces, la primera vez se liberará mediante pd_capabilities_release() y la segunda vez se liberará explícitamente mediante tcpm_port_unregister_pd(). [3.988059] ERROR: KASAN: doble liberación en tcpm_port_unregister_pd+0x1a4/0x3dc [3.995001] Libre de dirección ffff0008164d3000 por tarea kworker/u16:0/10 [4.001206] [4.002712] CPU: 2 PID: 10 Co mm: ktrabajador/u16: 0 No contaminado 6.8.0-rc5-next-20240220-05616-g52728c567a55 #53 [4.012402] Nombre del hardware: Freescale i.MX8QXP MEK (DT) [4.017569] Cola de trabajo: events_unbound deferred_probe_work_func [4.023456] Seguimiento de llamadas: [ 4.025920] dump_backtrace+ 0x94/0xec [ 4.029629] show_stack+0x18/0x24 [ 4.032974] dump_stack_lvl+0x78/0x90 [ 4.036675] print_report+0xfc/0x5c0 [ 4.040289] kasan_report_invalid_free+0xa0/0xc0 [ 4 .044937] __kasan_slab_free+0x124/0x154 [ 4.049072] kfree+0xb4/ 0x1e8 [ 4.052069] tcpm_port_unregister_pd+0x1a4/0x3dc [ 4.056725] tcpm_register_port+0x1dd0/0x2558 [ 4.061121] tcpci_register_port+0x420/0x71c [ 4.065430] +0x118/0x2e0 Para solucionar el problema, esto eliminará kree() de tcpm_port_unregister_pd(). • https://git.kernel.org/stable/c/cd099cde4ed264403b434d8344994f97ac2a4349 https://git.kernel.org/stable/c/242e425ed580b2f4dbcb86c8fc03a410a4084a69 https://git.kernel.org/stable/c/b63f90487bdf93a4223ce7853d14717e9d452856 • CWE-415: Double Free •