CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2024-43897 – net: drop bad gso csum_start and offset in virtio_net_hdr
https://notcve.org/view.php?id=CVE-2024-43897
In the Linux kernel, the following vulnerability has been resolved: net: drop bad gso csum_start and offset in virtio_net_hdr Tighten csum_start and csum_offset checks in virtio_net_hdr_to_skb for GSO packets. The function already checks that a checksum requested with VIRTIO_NET_HDR_F_NEEDS_CSUM is in skb linear. But for GSO packets this might not hold for segs after segmentation. Syzkaller demonstrated to reach this warning in skb_checksum_help offset = skb_checksum_start_offset(skb); ret = -EINVAL; if (WARN_ON_ONCE(offset >= skb_headlen(skb))) By injecting a TSO packet: WARNING: CPU: 1 PID: 3539 at net/core/dev.c:3284 skb_checksum_help+0x3d0/0x5b0 ip_do_fragment+0x209/0x1b20 net/ipv4/ip_output.c:774 ip_finish_output_gso net/ipv4/ip_output.c:279 [inline] __ip_finish_output+0x2bd/0x4b0 net/ipv4/ip_output.c:301 iptunnel_xmit+0x50c/0x930 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x2296/0x2c70 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x759/0xa60 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4850 [inline] netdev_start_xmit include/linux/netdevice.h:4864 [inline] xmit_one net/core/dev.c:3595 [inline] dev_hard_start_xmit+0x261/0x8c0 net/core/dev.c:3611 __dev_queue_xmit+0x1b97/0x3c90 net/core/dev.c:4261 packet_snd net/packet/af_packet.c:3073 [inline] The geometry of the bad input packet at tcp_gso_segment: [ 52.003050][ T8403] skb len=12202 headroom=244 headlen=12093 tailroom=0 [ 52.003050][ T8403] mac=(168,24) mac_len=24 net=(192,52) trans=244 [ 52.003050][ T8403] shinfo(txflags=0 nr_frags=1 gso(size=1552 type=3 segs=0)) [ 52.003050][ T8403] csum(0x60000c7 start=199 offset=1536 ip_summed=3 complete_sw=0 valid=0 level=0) Mitigate with stricter input validation. csum_offset: for GSO packets, deduce the correct value from gso_type. This is already done for USO. • https://git.kernel.org/stable/c/27874ca77bd2b05a3779c7b3a5c75d8dd7f0b40f https://git.kernel.org/stable/c/5b1997487a3f3373b0f580c8a20b56c1b64b0775 https://git.kernel.org/stable/c/90d41ebe0cd4635f6410471efc1dd71b33e894cf https://git.kernel.org/stable/c/e9164903b8b303c34723177b02fe91e49e3c4cd7 https://git.kernel.org/stable/c/413e785a89f8bde0d4156a54b8ac2fa003c06756 https://git.kernel.org/stable/c/f01c5e335fbb7fb612d40f14a3c02e2612a43d3b https://git.kernel.org/stable/c/6772c4868a8e7ad5305957cdb834ce881793acb7 https://git.kernel.org/stable/c/2edbb3e8838c672cd7e247e47989df9d0 •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2024-43896 – ASoC: cs-amp-lib: Fix NULL pointer crash if efi.get_variable is NULL
https://notcve.org/view.php?id=CVE-2024-43896
In the Linux kernel, the following vulnerability has been resolved: ASoC: cs-amp-lib: Fix NULL pointer crash if efi.get_variable is NULL Call efi_rt_services_supported() to check that efi.get_variable exists before calling it. • https://git.kernel.org/stable/c/1cad8725f2b98965ed3658bc917090b30adb14fa https://git.kernel.org/stable/c/5b6baaa7cbd77ff980516bad38bbc5a648bb5158 https://git.kernel.org/stable/c/dc268085e499666b9f4f0fcb4c5a94e1c0b193b3 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-43895 – drm/amd/display: Skip Recompute DSC Params if no Stream on Link
https://notcve.org/view.php?id=CVE-2024-43895
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Recompute DSC Params if no Stream on Link [why] Encounter NULL pointer dereference uner mst + dsc setup. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2 Hardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022 RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper] Code: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 <48> 8> RSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224 RDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280 RBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850 R10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000 R13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224 FS: 00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0 Call Trace: <TASK> ? • https://git.kernel.org/stable/c/282f0a482ee61d5e863512f3c4fcec90216c20d9 https://git.kernel.org/stable/c/718d83f66fb07b2cab89a1fc984613a00e3db18f https://git.kernel.org/stable/c/70275bb960c71d313254473d38c14e7101cee5ad https://git.kernel.org/stable/c/50e376f1fe3bf571d0645ddf48ad37eb58323919 https://git.kernel.org/stable/c/5357141b4c2e2b332b6f11607ba8c5fbc2669a10 •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2024-43894 – drm/client: fix null pointer dereference in drm_client_modeset_probe
https://notcve.org/view.php?id=CVE-2024-43894
In the Linux kernel, the following vulnerability has been resolved: drm/client: fix null pointer dereference in drm_client_modeset_probe In drm_client_modeset_probe(), the return value of drm_mode_duplicate() is assigned to modeset->mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). • https://git.kernel.org/stable/c/cf13909aee054f5aa667d4b9da0ac7df4f6c1327 https://git.kernel.org/stable/c/24ddda932c43ffe156c7f3c568bed85131c63ae6 https://git.kernel.org/stable/c/5291d4f73452c91e8a11f71207617e3e234d418e https://git.kernel.org/stable/c/c763dfe09425152b6bb0e348900a637c62c2ce52 https://git.kernel.org/stable/c/d64847c383100423aecb6ac5f18be5f4316d9d62 https://git.kernel.org/stable/c/d64fc94f7bb24fc2be0d6bd5df8df926da461a6d https://git.kernel.org/stable/c/612cae53e99ce32a58cb821b3b67199eb6e92dff https://git.kernel.org/stable/c/113fd6372a5bb3689aba8ef5b8a265ed1 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2024-43893 – serial: core: check uartclk for zero to avoid divide by zero
https://notcve.org/view.php?id=CVE-2024-43893
In the Linux kernel, the following vulnerability has been resolved: serial: core: check uartclk for zero to avoid divide by zero Calling ioctl TIOCSSERIAL with an invalid baud_base can result in uartclk being zero, which will result in a divide by zero error in uart_get_divisor(). ... /include/linux/spinlock.h:376 ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222) uart_port_startup (drivers/tty/serial/serial_core.c:342) uart_startup (drivers/tty/serial/serial_core.c:368) uart_set_info (drivers/tty/serial/serial_core.c:1034) uart_set_info_user (drivers/tty/serial/serial_core.c:1059) tty_set_serial (drivers/tty/tty_io.c:2637) tty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791) __x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907 fs/ioctl.c:893 fs/ioctl.c:893) do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Rule: add • https://git.kernel.org/stable/c/3bbd90fca824e6fd61fb20f6dd2b0fa5f8b14bba https://git.kernel.org/stable/c/55b2a5d331a6ceb1c4372945fdb77181265ba24f https://git.kernel.org/stable/c/52b138f1021113e593ee6ad258ce08fe90693a9e https://git.kernel.org/stable/c/9196e42a3b8eeff1707e6ef769112b4b6096be49 https://git.kernel.org/stable/c/e13ba3fe5ee070f8a9dab60029d52b1f61da5051 https://git.kernel.org/stable/c/e3ad503876283ac3fcca922a1bf243ef9eb0b0e2 https://git.kernel.org/stable/c/68dc02f319b9ee54dc23caba742a5c754d1cccc8 https://git.kernel.org/stable/c/6eabce6608d6f3440f4c03aa3d3ef50a4 •