CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47407 – KVM: x86: Handle SRCU initialization failure during page track init
https://notcve.org/view.php?id=CVE-2021-47407
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Handle SRCU initialization failure during page track init Check the return of init_srcu_struct(), which can fail due to OOM, when initializing the page track mechanism. Lack of checking leads to a NULL pointer deref found by a modified syzkaller. [Move the call towards the beginning of kvm_arch_init_vm. - Paolo] En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86: Manejar el error de inicialización de SRCU durante el inicio del seguimiento de la página. Verifique el retorno de init_srcu_struct(), que puede fallar debido a OOM, al inicializar el mecanismo de seguimiento de la página. La falta de verificación conduce a un puntero NULL deref encontrado por un syzkaller modificado. [Mueva la llamada hacia el principio de kvm_arch_init_vm. • https://git.kernel.org/stable/c/deb2949417677649e2413266d7ce8c2ff73952b4 https://git.kernel.org/stable/c/4664318f73e496cd22c71b10888e75434a123e23 https://git.kernel.org/stable/c/eb7511bf9182292ef1df1082d23039e856d1ddfb •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2021-47405 – HID: usbhid: free raw_report buffers in usbhid_stop
https://notcve.org/view.php?id=CVE-2021-47405
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: free raw_report buffers in usbhid_stop Free the unsent raw_report buffers when the device is removed. Fixes a memory leak reported by syzbot at: https://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47 En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: usbhid: buffers raw_report libres en usbhid_stop. Libera los buffers raw_report no enviados cuando se elimina el dispositivo. Corrige una pérdida de memoria informada por syzbot en: https://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47 • https://git.kernel.org/stable/c/7ce4e49146612261265671b1d30d117139021030 https://git.kernel.org/stable/c/efc5c8d29256955cc90d8d570849b2d6121ed09f https://git.kernel.org/stable/c/c3156fea4d8a0e643625dff69a0421e872d1fdae https://git.kernel.org/stable/c/764ac04de056801dfe52a716da63f6e7018e7f3b https://git.kernel.org/stable/c/965147067fa1bedff3ae1f07ce3f89f1a14d2df3 https://git.kernel.org/stable/c/f7ac4d24e1610b92689946fa88177673f1e88a3f https://git.kernel.org/stable/c/2b704864c92dcec2b295f276fcfbfb81d9831f81 https://git.kernel.org/stable/c/f7744fa16b96da57187dc8e5634152d3b •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2021-47404 – HID: betop: fix slab-out-of-bounds Write in betop_probe
https://notcve.org/view.php?id=CVE-2021-47404
In the Linux kernel, the following vulnerability has been resolved: HID: betop: fix slab-out-of-bounds Write in betop_probe Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: HID: betop: corrige escritura slab-out-of-bounds en betop_probe. Syzbot informó un error de escritura slab-out-of-bounds en el controlador hid-betopff. El problema es que el controlador supone que el dispositivo debe tener un informe de entrada, pero algunos dispositivos maliciosos violan esta suposición. Entonces, este parche verifica que la entrada de hid_device no esté vacía antes de usarse. • https://git.kernel.org/stable/c/a4faa7153b87fbcfe4be15f4278676f79ca6e019 https://git.kernel.org/stable/c/6fc4476dda58f6c00097c7ddec3b772513f57525 https://git.kernel.org/stable/c/1c83c38dec83d57bc18d0c01d82c413d3b34ccb9 https://git.kernel.org/stable/c/bb8b72374db69afa25a5b65cf1c092860c6fe914 https://git.kernel.org/stable/c/fe9bb925e7096509711660d39c0493a1546e9550 https://git.kernel.org/stable/c/dedfc35a2de2bae9fa3da8210a05bfd515f83fee https://git.kernel.org/stable/c/708107b80aa616976d1c5fa60ac0c1390749db5e https://git.kernel.org/stable/c/1e4ce418b1cb1a810256b5fb3fd33d22d •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2021-47403 – ipack: ipoctal: fix module reference leak
https://notcve.org/view.php?id=CVE-2021-47403
In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix module reference leak A reference to the carrier module was taken on every open but was only released once when the final reference to the tty struct was dropped. Fix this by taking the module reference and initialising the tty driver data when installing the tty. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ipack: ipoctal: reparar fuga de referencia del módulo. Se tomó una referencia al módulo portador en cada apertura, pero solo se publicó una vez cuando se eliminó la referencia final a la estructura tty. Solucione este problema tomando la referencia del módulo e inicializando los datos del controlador tty al instalar el tty. • https://git.kernel.org/stable/c/82a82340bab6c251e0705339f60763718eaa2a22 https://git.kernel.org/stable/c/31398849b84ebae0d43a1cf379cb9895597f221a https://git.kernel.org/stable/c/c0adb5a947dec6cff7050ec56d78ecd3916f9ce6 https://git.kernel.org/stable/c/dde4c1429b97383689f755ce92b4ed1e84a9c92b https://git.kernel.org/stable/c/9c5b77a7ffc983b2429ce158b50497c5d3c86a69 https://git.kernel.org/stable/c/3253c87e1e5bc0107aab773af2f135ebccf38666 https://git.kernel.org/stable/c/7cea848678470daadbfdaa6a112b823c290f900c https://git.kernel.org/stable/c/811178f296b16af30264def74c8d2179a • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47402 – net: sched: flower: protect fl_walk() with rcu
https://notcve.org/view.php?id=CVE-2021-47402
In the Linux kernel, the following vulnerability has been resolved: net: sched: flower: protect fl_walk() with rcu Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul() also removed rcu protection of individual filters which causes following use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain rcu read lock while iterating and taking the filter reference and temporary release the lock while calling arg->fn() callback that can sleep. KASAN trace: [ 352.773640] ================================================================== [ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower] [ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987 [ 352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2 [ 352.778980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 352.781022] Call Trace: [ 352.781573] dump_stack_lvl+0x46/0x5a [ 352.782332] print_address_description.constprop.0+0x1f/0x140 [ 352.783400] ? fl_walk+0x159/0x240 [cls_flower] [ 352.784292] ? fl_walk+0x159/0x240 [cls_flower] [ 352.785138] kasan_report.cold+0x83/0xdf [ 352.785851] ? fl_walk+0x159/0x240 [cls_flower] [ 352.786587] kasan_check_range+0x145/0x1a0 [ 352.787337] fl_walk+0x159/0x240 [cls_flower] [ 352.788163] ? • https://git.kernel.org/stable/c/d39d714969cda5cbda291402c8c6b1fb1047f42e https://git.kernel.org/stable/c/694b0cee7f8546b69a80996a29cb3cf4149c0453 https://git.kernel.org/stable/c/d0d520c19e7ea19ed38dc5797b12397b6ccf9f88 https://git.kernel.org/stable/c/dab4677bdbffa5c8270e79e34e51c89efa0728a0 https://git.kernel.org/stable/c/d5ef190693a7d76c5c192d108e8dec48307b46ee •