CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2024-46771 – can: bcm: Remove proc entry when dev is unregistered.
https://notcve.org/view.php?id=CVE-2024-46771
18 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: can: bcm: Remove proc entry when dev is unregistered. syzkaller reported a warning in bcm_connect() below. [0] The repro calls connect() to vxcan1, removes vxcan1, and calls connect() with ifindex == 0. Calling connect() for a BCM socket allocates a proc entry. Then, bcm_sk(sk)->bound is set to 1 to prevent further connect(). However, removing the bound device resets bcm_sk(sk)->bound to 0 in bcm_notify(). The 2nd connect() tries to allocat... • https://git.kernel.org/stable/c/ffd980f976e7fd666c2e61bf8ab35107efd11828 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-46770 – ice: Add netif_device_attach/detach into PF reset flow
https://notcve.org/view.php?id=CVE-2024-46770
18 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: ice: Add netif_device_attach/detach into PF reset flow Ethtool callbacks can be executed while reset is in progress and try to access deleted resources, e.g. getting coalesce settings can result in a NULL pointer dereference seen below. Reproduction steps: Once the driver is fully initialized, trigger reset: # echo 1 > /sys/class/net/
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46769 – spi: intel: Add check devm_kasprintf() returned value
https://notcve.org/view.php?id=CVE-2024-46769
18 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: spi: intel: Add check devm_kasprintf() returned value intel_spi_populate_chip() use devm_kasprintf() to set pdata->name. This can return a NULL pointer on failure but this returned value is not checked. In the Linux kernel, the following vulnerability has been resolved: spi: intel: Add check devm_kasprintf() returned value intel_spi_populate_chip() use devm_kasprintf() to set pdata->name. This can return a NULL pointer on failure but this r... • https://git.kernel.org/stable/c/e58db3bcd93b9e0bf5068a29f7e1a97c29926830 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-46768 – hwmon: (hp-wmi-sensors) Check if WMI event data exists
https://notcve.org/view.php?id=CVE-2024-46768
18 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Check if WMI event data exists The BIOS can choose to return no event data in response to a WMI event, so the ACPI object passed to the WMI notify handler can be NULL. Check for such a situation and ignore the event in such a case. In the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Check if WMI event data exists The BIOS can choose to return no event data in response to a WMI ... • https://git.kernel.org/stable/c/23902f98f8d4811ab84dde6419569a5b374f8122 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-46767 – net: phy: Fix missing of_node_put() for leds
https://notcve.org/view.php?id=CVE-2024-46767
18 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix missing of_node_put() for leds The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fix it. In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix missing of_node_put() for leds The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fi... • https://git.kernel.org/stable/c/01e5b728e9e43ae444e0369695a5f72209906464 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46766 – ice: move netif_queue_set_napi to rtnl-protected sections
https://notcve.org/view.php?id=CVE-2024-46766
18 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: ice: move netif_queue_set_napi to rtnl-protected sections Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is not rtnl-locked when called from the reset. This creates the need to take the rtnl_lock just for a single function and complicates the synchronization with .ndo_bpf. At the same time, there no actual need to fill napi-to-queue information at this exact point. Fill napi-to-queue information when opening the VSI... • https://git.kernel.org/stable/c/080b0c8d6d261b400f24bb1075fbab8c6daaf69e •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-46765 – ice: protect XDP configuration with a mutex
https://notcve.org/view.php?id=CVE-2024-46765
18 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: ice: protect XDP configuration with a mutex The main threat to data consistency in ice_xdp() is a possible asynchronous PF reset. It can be triggered by a user or by TX timeout handler. XDP setup and PF reset code access the same resources in the following sections: * ice_vsi_close() in ice_prepare_for_reset() - already rtnl-locked * ice_vsi_rebuild() for the PF VSI - not protected * ice_vsi_open() - already rtnl-locked With an unfortunate ... • https://git.kernel.org/stable/c/2d4238f5569722197612656163d824098208519c •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46764 – bpf: add check for invalid name in btf_name_valid_section()
https://notcve.org/view.php?id=CVE-2024-46764
18 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: bpf: add check for invalid name in btf_name_valid_section() If the length of the name string is 1 and the value of name[0] is NULL byte, an OOB vulnerability occurs in btf_name_valid_section() and the return value is true, so the invalid name passes the check. To solve this, you need to check if the first position is NULL byte and if the first character is printable. In the Linux kernel, the following vulnerability has been resolved: bpf: a... • https://git.kernel.org/stable/c/bd70a8fb7ca4fcb078086f4d96b048aaf1aa4786 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-46763 – fou: Fix null-ptr-deref in GRO.
https://notcve.org/view.php?id=CVE-2024-46763
18 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: fou: Fix null-ptr-deref in GRO. We observed a null-ptr-deref in fou_gro_receive() while shutting down a host. [0] The NULL pointer is sk->sk_user_data, and the offset 8 is of protocol in struct fou. When fou_release() is called due to netns dismantle or explicit tunnel teardown, udp_tunnel_sock_release() sets NULL to sk->sk_user_data. Then, the tunnel socket is destroyed after a single RCU grace period. So, in-flight udp4_gro_receive() coul... • https://git.kernel.org/stable/c/d92283e338f6d6503b7417536bf3478f466cbc01 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-46762 – xen: privcmd: Fix possible access to a freed kirqfd instance
https://notcve.org/view.php?id=CVE-2024-46762
18 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: xen: privcmd: Fix possible access to a freed kirqfd instance Nothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and privcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd created and added to the irqfds_list by privcmd_irqfd_assign() may get removed by another thread executing privcmd_irqfd_deassign(), while the former is still using it after dropping the locks. This can lead to a situation where an already... • https://git.kernel.org/stable/c/e997b357b13a7d95de31681fc54fcc34235fa527 •