CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-50136 – net/mlx5: Unregister notifier on eswitch init failure
https://notcve.org/view.php?id=CVE-2024-50136
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure It otherwise remains registered and a subsequent attempt at eswitch enabling might trigger warnings of the sort: [ 682.589148] ------------[ cut here ]------------ [ 682.590204] notifier callback eswitch_vport_event [mlx5_core] already registered [ 682.590256] WARNING: CPU: 13 PID: 2660 at kernel/notifier.c:31 notifier_chain_register+0x3e/0x90 [...snipped] [ 682.610052] Call Trace: [ 682.610369] <TASK> [ 682.610663] ? __warn+0x7c/0x110 [ 682.611050] ? notifier_chain_register+0x3e/0x90 [ 682.611556] ? report_bug+0x148/0x170 [ 682.611977] ? handle_bug+0x36/0x70 [ 682.612384] ? • https://git.kernel.org/stable/c/0aa1e83a20f12e9eaad32f72212ebc7fe0c29c95 https://git.kernel.org/stable/c/7624e58a8b3a251e3e5108b32f2183b34453db32 https://git.kernel.org/stable/c/dc426bd9d813aa5754ce35adaa6f97f0585c06fc https://git.kernel.org/stable/c/e58fb7ddbab6635191c26dea1af26b91cce00866 https://git.kernel.org/stable/c/9f2ccb6f3888bec45c00121ee43e4e72423b12c1 https://git.kernel.org/stable/c/599147722c5778c96292e2fbff4103abbdb45b1f https://git.kernel.org/stable/c/1da9cfd6c41c2e6bbe624d0568644e1521c33e12 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-50135 – nvme-pci: fix race condition between reset and nvme_dev_disable()
https://notcve.org/view.php?id=CVE-2024-50135
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix race condition between reset and nvme_dev_disable() nvme_dev_disable() modifies the dev->online_queues field, therefore nvme_pci_update_nr_queues() should avoid racing against it, otherwise we could end up passing invalid values to blk_mq_update_nr_hw_queues(). WARNING: CPU: 39 PID: 61303 at drivers/pci/msi/api.c:347 pci_irq_get_affinity+0x187/0x210 Workqueue: nvme-reset-wq nvme_reset_work [nvme] RIP: 0010:pci_irq_get_affinity+0x187/0x210 Call Trace: <TASK> ? blk_mq_pci_map_queues+0x87/0x3c0 ? pci_irq_get_affinity+0x187/0x210 blk_mq_pci_map_queues+0x87/0x3c0 nvme_pci_map_queues+0x189/0x460 [nvme] blk_mq_update_nr_hw_queues+0x2a/0x40 nvme_reset_work+0x1be/0x2a0 [nvme] Fix the bug by locking the shutdown_lock mutex before using dev->online_queues. Give up if nvme_dev_disable() is running or if it has been executed already. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-pci: corrige la condición de ejecución entre reset y nvme_dev_disable() nvme_dev_disable() modifica el campo dev->online_queues, por lo tanto, nvme_pci_update_nr_queues() debería evitar competir contra él, de lo contrario podríamos terminar pasando valores no válidos a blk_mq_update_nr_hw_queues(). • https://git.kernel.org/stable/c/949928c1c731417cc0f070912c63878b62b544f4 https://git.kernel.org/stable/c/4ed32cc0939b64e3d7b48c8c0d63ea038775f304 https://git.kernel.org/stable/c/b33e49a5f254474b33ce98fd45dd0ffdc247a0be https://git.kernel.org/stable/c/26bc0a81f64ce00fc4342c38eeb2eddaad084dd2 •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2024-50134 – drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
https://notcve.org/view.php?id=CVE-2024-50134
In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with a real VLA to fix a "memcpy: detected field-spanning write error" warning: [ 13.319813] memcpy: detected field-spanning write (size 16896) of single field "p->data" at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (size 4) [ 13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo] [ 13.320038] Call Trace: [ 13.320173] hgsmi_update_pointer_shape [vboxvideo] [ 13.320184] vbox_cursor_atomic_update [vboxvideo] Note as mentioned in the added comment it seems the original length calculation for the allocated and send hgsmi buffer is 4 bytes too large. Changing this is not the goal of this patch, so this behavior is kept. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/vboxvideo: Reemplazar VLA falso al final de vbva_mouse_pointer_shape con VLA real Reemplace el VLA falso al final de la forma vbva_mouse_pointer_shape con un VLA real para corregir una advertencia "memcpy: error de escritura que abarca el campo detectado": [ 13.319813] memcpy: se detectó una escritura que abarca el campo (tamaño 16896) de un solo campo "p->data" en drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (tamaño 4) [ 13.319841] ADVERTENCIA: CPU: 0 PID: 1105 en drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo] [ [13.320038] Seguimiento de llamadas: [13.320173] hgsmi_update_pointer_shape [vboxvideo] [13.320184] vbox_cursor_atomic_update [vboxvideo] Tenga en cuenta que, como se menciona en el comentario agregado, parece que el cálculo de longitud original para el búfer hgsmi asignado y enviado es 4 bytes más grande. Cambiar esto no es el objetivo de este parche, por lo que se mantiene este comportamiento. • https://git.kernel.org/stable/c/02c86c5d5ef4bbba17d38859c74872825f536617 https://git.kernel.org/stable/c/75f828e944dacaac8870418461d3d48a1ecf2331 https://git.kernel.org/stable/c/34a422274b693507025a7db21519865d1862afcb https://git.kernel.org/stable/c/7458a6cdaebb3dc59af8578ee354fae78a154c4a https://git.kernel.org/stable/c/9eb32bd23bbcec44bcbef27b7f282b7a7f3d0391 https://git.kernel.org/stable/c/fae9dc12c61ce23cf29d09824a741b7b1ff8f01f https://git.kernel.org/stable/c/d92b90f9a54d9300a6e883258e79f36dab53bfae •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2024-50133 – LoongArch: Don't crash in stack_top() for tasks without vDSO
https://notcve.org/view.php?id=CVE-2024-50133
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Don't crash in stack_top() for tasks without vDSO Not all tasks have a vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL vdso pointer and crash. This can for example happen when using kunit: [<9000000000203874>] stack_top+0x58/0xa8 [<90000000002956cc>] arch_pick_mmap_layout+0x164/0x220 [<90000000003c284c>] kunit_vm_mmap_init+0x108/0x12c [<90000000003c1fbc>] __kunit_add_resource+0x38/0x8c [<90000000003c2704>] kunit_vm_mmap+0x88/0xc8 [<9000000000410b14>] usercopy_test_init+0xbc/0x25c [<90000000003c1db4>] kunit_try_run_case+0x5c/0x184 [<90000000003c3d54>] kunit_generic_run_threadfn_adapter+0x24/0x48 [<900000000022e4bc>] kthread+0xc8/0xd4 [<9000000000200ce8>] ret_from_kernel_thread+0xc/0xa4 En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: LoongArch: No se bloquea en stack_top() para tareas sin vDSO No todas las tareas tienen un vDSO asignado, por ejemplo, kthreads nunca lo tiene. Si alguna vez una tarea de este tipo termina llamando a stack_top(), desreferenciará el puntero vdso NULL y se bloqueará. Esto puede suceder, por ejemplo, al usar kunit: [<9000000000203874>] stack_top+0x58/0xa8 [<90000000002956cc>] arch_pick_mmap_layout+0x164/0x220 [<90000000003c284c>] kunit_vm_mmap_init+0x108/0x12c [<90000000003c1fbc>] __kunit_add_resource+0x38/0x8c [<90000000003c2704>] kunit_vm_mmap+0x88/0xc8 [<9000000000410b14>] usercopy_test_init+0xbc/0x25c [<90000000003c1db4>] kunit_try_run_case+0x5c/0x184 [<90000000003c3d54>] kunit_generic_run_threadfn_adapter+0x24/0x48 [<900000000022e4bc>] kthread+0xc8/0xd4 [<9000000000200ce8>] ret_from_kernel_thread+0xc/0xa4 • https://git.kernel.org/stable/c/803b0fc5c3f2baa6e54978cd576407896f789b08 https://git.kernel.org/stable/c/a67d4a02bf43e15544179895ede7d5f97b84b550 https://git.kernel.org/stable/c/a94c197d4d749954dfaa37e907fcc8c04e4aad7e https://git.kernel.org/stable/c/041cc3860b06770357876d1114d615333b0fbf31 https://git.kernel.org/stable/c/134475a9ab8487527238d270639a8cb74c10aab2 •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2024-50132 – tracing/probes: Fix MAX_TRACE_ARGS limit handling
https://notcve.org/view.php?id=CVE-2024-50132
In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix MAX_TRACE_ARGS limit handling When creating a trace_probe we would set nr_args prior to truncating the arguments to MAX_TRACE_ARGS. However, we would only initialize arguments up to the limit. This caused invalid memory access when attempting to set up probes with more than 128 fetchargs. BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 1769 Comm: cat Not tainted 6.11.0-rc7+ #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:__set_print_fmt+0x134/0x330 Resolve the issue by applying the MAX_TRACE_ARGS limit earlier. Return an error when there are too many arguments instead of silently truncating. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rastreo/sondas: Se corrige el manejo del límite MAX_TRACE_ARGS Al crear un trace_probe, estableceríamos nr_args antes de truncar los argumentos a MAX_TRACE_ARGS. Sin embargo, solo inicializaríamos los argumentos hasta el límite. • https://git.kernel.org/stable/c/035ba76014c096316fa809a46ce0a1b9af1cde0d https://git.kernel.org/stable/c/08ccd1a57c4d3882e9a877eb2dcc66e50a3b0279 https://git.kernel.org/stable/c/73f35080477e893aa6f4c8d388352b871b288fbc https://git.kernel.org/stable/c/6bc24db74fe4788cc7c2f30a113fc6aafba225a3 •