CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2023-52867 – drm/radeon: possible buffer overflow
https://notcve.org/view.php?id=CVE-2023-52867
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: possible buffer overflow Buffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is checked after access. En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: drm/radeon: posible desbordamiento del búfer. El búfer 'afmt_status' de tamaño 6 podría desbordarse, ya que el índice 'afmt_idx' se comprueba después del acceso. • https://git.kernel.org/stable/c/5cc4e5fc293bfe2634535f544427e8c6061492a5 https://git.kernel.org/stable/c/112d4b02d94bf9fa4f1d3376587878400dd74783 https://git.kernel.org/stable/c/caaa74541459c4c9e2c10046cf66ad2890483d0f https://git.kernel.org/stable/c/ddc42881f170f1f518496f5a70447501335fc783 https://git.kernel.org/stable/c/7b063c93bece827fde237fae1c101bceeee4e896 https://git.kernel.org/stable/c/347f025a02b3a5d715a0b471fc3b1439c338ad94 https://git.kernel.org/stable/c/341e79f8aec6af6b0061b8171d77b085835c6a58 https://git.kernel.org/stable/c/d9b4fa249deaae1145d6fc2b64dae718e •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2023-52865 – clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
https://notcve.org/view.php?id=CVE-2023-52865
In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data Add the check for the return value of mtk_alloc_clk_data() in order to avoid NULL pointer dereference. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clk: mediatek: clk-mt6797: Agregar verificación para mtk_alloc_clk_data Agregue la verificación para el valor de retorno de mtk_alloc_clk_data() para evitar la desreferencia al puntero NULL. • https://git.kernel.org/stable/c/96596aa06628e86ea0e1c08c34b0ccc7619e43ac https://git.kernel.org/stable/c/c26feedbc561f2a3cee1a4f717e61bdbdfb4fa92 https://git.kernel.org/stable/c/4c79cbfb8e9e2311be77182893fda5ea4068c836 https://git.kernel.org/stable/c/2705c5b97f504e831ae1935c05f0e44f80dfa6b3 https://git.kernel.org/stable/c/81b16286110728674dcf81137be0687c5055e7bf https://git.kernel.org/stable/c/3aefc6fcfbada57fac27f470602d5565e5b76cb4 https://git.kernel.org/stable/c/357df1c2f6ace96defd557fad709ed1f9f70e16c https://git.kernel.org/stable/c/be3f12f16038a558f08fa93cc32fa7157 •
CVSS: 4.4EPSS: 0%CPEs: 8EXPL: 0CVE-2023-52864 – platform/x86: wmi: Fix opening of char device
https://notcve.org/view.php?id=CVE-2023-52864
In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->private_data, which means that private_data will not be NULL when wmi_char_open() is called. This might cause memory corruption should wmi_char_open() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmi_free_devices(). Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using container_of(). This also avoids wmi_char_open() picking a wrong WMI device bound to a driver with the same name as the original driver. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: plataforma/x86: wmi: corrige la apertura del dispositivo char. Desde la confirmación fa1f68db6ca7 ("drivers: misc: pasar el puntero del dispositivo misc a través de datos privados del archivo"), el dispositivo misc almacena un puntero a sí mismo en su interior. filp->private_data, lo que significa que private_data no será NULL cuando se llame a wmi_char_open(). • https://git.kernel.org/stable/c/44b6b7661132b1b0e5fd3147ded66f1e4a817ca9 https://git.kernel.org/stable/c/cf098e937dd125c0317a0d6f261ac2a950a233d6 https://git.kernel.org/stable/c/9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203 https://git.kernel.org/stable/c/d426a2955e45a95b2282764105fcfb110a540453 https://git.kernel.org/stable/c/e0bf076b734a2fab92d8fddc2b8b03462eee7097 https://git.kernel.org/stable/c/44a96796d25809502c75771d40ee693c2e44724e https://git.kernel.org/stable/c/36d85fa7ae0d6be651c1a745191fa7ef055db43e https://git.kernel.org/stable/c/fb7b06b59c6887659c6ed0ecd3110835e • CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak') •
CVSS: 6.2EPSS: 0%CPEs: 7EXPL: 0CVE-2023-52858 – clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
https://notcve.org/view.php?id=CVE-2023-52858
In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data Add the check for the return value of mtk_alloc_clk_data() in order to avoid NULL pointer dereference. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clk: mediatek: clk-mt7629: Agregar verificación para mtk_alloc_clk_data. Agregue la verificación para el valor de retorno de mtk_alloc_clk_data() para evitar la desreferencia al puntero NULL. • https://git.kernel.org/stable/c/3b5e748615e714711220b2a95d19bd25a037db09 https://git.kernel.org/stable/c/e8ae4b49dd9cfde69d8de8c0c0cd7cf1b004482e https://git.kernel.org/stable/c/4f861b63945e076f9f003a5fad958174096df1ee https://git.kernel.org/stable/c/e964d21dc034b650d719c4ea39564bec72b42f94 https://git.kernel.org/stable/c/a836efc21ef04608333d6d05753e558ebd1f85d0 https://git.kernel.org/stable/c/1d89430fc3158f872d492f1b88d07262f48290c0 https://git.kernel.org/stable/c/5fbea47eebff5daeca7d918c99289bcd3ae4dc8d https://git.kernel.org/stable/c/2befa515c1bb6cdd33c262b909d93d197 • CWE-476: NULL Pointer Dereference •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2023-52855 – usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
https://notcve.org/view.php?id=CVE-2023-52855
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency In _dwc2_hcd_urb_enqueue(), "urb->hcpriv = NULL" is executed without holding the lock "hsotg->lock". In _dwc2_hcd_urb_dequeue(): spin_lock_irqsave(&hsotg->lock, flags); ... if (!urb->hcpriv) { dev_dbg(hsotg->dev, "## urb->hcpriv is NULL ##\n"); goto out; } rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv ... out: spin_unlock_irqrestore(&hsotg->lock, flags); When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are concurrently executed, the NULL check of "urb->hcpriv" can be executed before "urb->hcpriv = NULL". After urb->hcpriv is NULL, it can be used in the function call to dwc2_hcd_urb_dequeue(), which can cause a NULL pointer dereference. This possible bug is found by an experimental static analysis tool developed by myself. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. • https://git.kernel.org/stable/c/33ad261aa62be02f0cedeb4d5735cc726de84a3f https://git.kernel.org/stable/c/14c9ec34e8118fbffd7f5431814d767726323e72 https://git.kernel.org/stable/c/fed492aa6493a91a77ebd51da6fb939c98d94a0d https://git.kernel.org/stable/c/64c47749fc7507ed732e155c958253968c1d275e https://git.kernel.org/stable/c/bdb3dd4096302d6b87441fdc528439f171b04be6 https://git.kernel.org/stable/c/fcaafb574fc88a52dce817f039f7ff2f9da38001 https://git.kernel.org/stable/c/6b21a22728852d020a6658d39cd7bb7e14b07790 https://git.kernel.org/stable/c/3e851a77a13ce944d703721793f49ee82 •