CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2024-44986 – ipv6: fix possible UAF in ip6_finish_output2()
https://notcve.org/view.php?id=CVE-2024-44986
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in ip6_finish_output2() If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. • https://git.kernel.org/stable/c/5796015fa968a3349027a27dcd04c71d95c53ba5 https://git.kernel.org/stable/c/ded37d03440d0ab346a8287cc2ba88b8dc90ceb0 https://git.kernel.org/stable/c/2323690eb05865a657709f4d28eb9538ea97bfc2 https://git.kernel.org/stable/c/b34c668a867ffdcf8bd8db4a36512572e82b4a15 https://git.kernel.org/stable/c/e891b36de161fcd96f12ff83667473e5067b9037 https://git.kernel.org/stable/c/3574d28caf9a09756ae87ad1ea096c6f47b6101e https://git.kernel.org/stable/c/6ab6bf731354a6fdbaa617d1ec194960db61cf3b https://git.kernel.org/stable/c/56efc253196751ece1fc535a5b582be12 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-44983 – netfilter: flowtable: validate vlan header
https://notcve.org/view.php?id=CVE-2024-44983
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate vlan header Ensure there is sufficient room to access the protocol field of the VLAN header, validate it once before the flowtable lookup. ===================================================== BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x45a/0x5f0 net/netfilter/nf_flow_table_inet.c:32 nf_flow_offload_inet_hook+0x45a/0x5f0 net/netfilter/nf_flow_table_inet.c:32 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline] nf_ingress net/core/dev.c:5440 [inline] • https://git.kernel.org/stable/c/4cd91f7c290f64fe430867ddbae10bff34657b6a https://git.kernel.org/stable/c/c05155cc455785916164aa5e1b4605a2ae946537 https://git.kernel.org/stable/c/d9384ae7aec46036d248d1c2c2757e471ab486c3 https://git.kernel.org/stable/c/0279c35d242d037abeb73d60d06a6d1bb7f672d9 https://git.kernel.org/stable/c/043a18bb6cf16adaa2f8642acfde6e8956a9caaa https://git.kernel.org/stable/c/6ea14ccb60c8ab829349979b22b58a941ec4a3ee •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-44982 – drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
https://notcve.org/view.php?id=CVE-2024-44982
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails If the dpu_format_populate_layout() fails, then FB is prepared, but not cleaned up. This ends up leaking the pin_count on the GEM object and causes a splat during DRM file closure: msm_obj->pin_count WARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc [...] Call trace: update_lru_locked+0xc4/0xcc put_pages+0xac/0x100 msm_gem_free_object+0x138/0x180 drm_gem_object_free+0x1c/0x30 drm_gem_object_handle_put_unlocked+0x108/0x10c drm_gem_object_release_handle+0x58/0x70 idr_for_each+0x68/0xec drm_gem_release+0x28/0x40 drm_file_free+0x174/0x234 drm_release+0xb0/0x160 __fput+0xc0/0x2c8 __fput_sync+0x50/0x5c __arm64_sys_close+0x38/0x7c invoke_syscall+0x48/0x118 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x4c/0x120 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 irq event stamp: 129818 hardirqs last enabled at (129817): [<ffffa5f6d953fcc0>] console_unlock+0x118/0x124 hardirqs last disabled at (129818): [<ffffa5f6da7dcf04>] el1_dbg+0x24/0x8c softirqs last enabled at (129808): [<ffffa5f6d94afc18>] handle_softirqs+0x4c8/0x4e8 softirqs last disabled at (129785): [<ffffa5f6d94105e4>] __do_softirq+0x14/0x20 Patchwork: https://patchwork.freedesktop.org/patch/600714/ • https://git.kernel.org/stable/c/25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef https://git.kernel.org/stable/c/9b8b65211a880af8fe8330a101e1e239a2d4008f https://git.kernel.org/stable/c/7ecf85542169012765e4c2817cd3be6c2e009962 https://git.kernel.org/stable/c/a3c5815b07f4ee19d0b7e2ddf91ff9f03ecbf27d https://git.kernel.org/stable/c/02193c70723118889281f75b88722b26b58bf4ae https://git.kernel.org/stable/c/bfa1a6283be390947d3649c482e5167186a37016 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2024-44977 – drm/amdgpu: Validate TA binary size
https://notcve.org/view.php?id=CVE-2024-44977
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validate TA binary size Add TA binary size validation to avoid OOB write. (cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442) • https://git.kernel.org/stable/c/5ab8793b9a6cc059f503cbe6fe596f80765e0f19 https://git.kernel.org/stable/c/50553ea7cbd3344fbf40afb065f6a2d38171c1ad https://git.kernel.org/stable/c/e562415248f402203e7fb6d8c38c1b32fa99220f https://git.kernel.org/stable/c/c99769bceab4ecb6a067b9af11f9db281eea3e2a •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2024-44974 – mptcp: pm: avoid possible UaF when selecting endp
https://notcve.org/view.php?id=CVE-2024-44974
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. • https://git.kernel.org/stable/c/01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 https://git.kernel.org/stable/c/ddee5b4b6a1cc03c1e9921cf34382e094c2009f1 https://git.kernel.org/stable/c/f2c865e9e3ca44fc06b5f73b29a954775e4dbb38 https://git.kernel.org/stable/c/2b4f46f9503633dade75cb796dd1949d0e6581a1 https://git.kernel.org/stable/c/9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8 https://git.kernel.org/stable/c/0201d65d9806d287a00e0ba96f0321835631f63f https://git.kernel.org/stable/c/48e50dcbcbaaf713d82bf2da5c16aeced94ad07d •