CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-40973 – media: mtk-vcodec: potential null pointer deference in SCP
https://notcve.org/view.php?id=CVE-2024-40973
In the Linux kernel, the following vulnerability has been resolved: media: mtk-vcodec: potential null pointer deference in SCP The return value of devm_kzalloc() needs to be checked to avoid NULL pointer deference. This is similar to CVE-2022-3113. • https://git.kernel.org/stable/c/f066882293b5ad359e44c4ed24ab1811ffb0b354 https://git.kernel.org/stable/c/3a693c7e243b932faee5c1fb728efa73f0abc39b https://git.kernel.org/stable/c/53dbe08504442dc7ba4865c09b3bbf5fe849681b •
CVSS: 4.1EPSS: 0%CPEs: 4EXPL: 0CVE-2024-40972 – ext4: do not create EA inode under buffer lock
https://notcve.org/view.php?id=CVE-2024-40972
In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4_xattr_set_entry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allocation locking (which acquires locks on other buffers) under the buffer lock. This can even deadlock when the filesystem is corrupted and e.g. quota file is setup to contain xattr block as data block. Move the allocation of EA inode out of ext4_xattr_set_entry() into the callers. • https://git.kernel.org/stable/c/0752e7fb549d90c33b4d4186f11cfd25a556d1dd https://git.kernel.org/stable/c/737fb7853acd5bc8984f6f42e4bfba3334be8ae1 https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752 https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0b https://access.redhat.com/security/cve/CVE-2024-40972 https://bugzilla.redhat.com/show_bug.cgi?id=2297556 • CWE-833: Deadlock •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2024-40971 – f2fs: remove clear SB_INLINECRYPT flag in default_options
https://notcve.org/view.php?id=CVE-2024-40971
In the Linux kernel, the following vulnerability has been resolved: f2fs: remove clear SB_INLINECRYPT flag in default_options In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable. Thread A: Thread B: -f2fs_remount -f2fs_file_open or f2fs_new_inode -default_options <- clear SB_INLINECRYPT flag -fscrypt_select_encryption_impl -parse_options <- set SB_INLINECRYPT again • https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71 https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4 https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2 https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66 https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-40970 – Avoid hw_desc array overrun in dw-axi-dmac
https://notcve.org/view.php?id=CVE-2024-40970
In the Linux kernel, the following vulnerability has been resolved: Avoid hw_desc array overrun in dw-axi-dmac I have a use case where nr_buffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put() handles the hw_desc considering the descs_allocated, this scenario would result in a kernel panic (hw_desc array will be overrun). To fix this, the proposal is to add a new member to the axi_dma_desc structure, where we keep the number of allocated hw_descs (axi_desc_alloc()) and use it in axi_desc_put() to handle the hw_desc array correctly. Additionally I propose to remove the axi_chan_start_first_queued() call after completing the transfer, since it was identified that unbalance can occur (started descriptors can be interrupted and transfer ignored due to DMA channel not being enabled). • https://git.kernel.org/stable/c/7c3bb96a20cd8db3b8824b2ff08b6cde4505c7e5 https://git.kernel.org/stable/c/dd42570018f5962c10f215ad9c21274ed5d3541e https://git.kernel.org/stable/c/e151ae1ee065cf4b8ce4394ddb9d9c8df6370c66 https://git.kernel.org/stable/c/9004784e8d68bcd1ac1376407ba296fa28f04dbe https://git.kernel.org/stable/c/333e11bf47fa8d477db90e2900b1ed3c9ae9b697 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-40969 – f2fs: don't set RO when shutting down f2fs
https://notcve.org/view.php?id=CVE-2024-40969
In the Linux kernel, the following vulnerability has been resolved: f2fs: don't set RO when shutting down f2fs Shutdown does not check the error of thaw_super due to readonly, which causes a deadlock like below. f2fs_ioc_shutdown(F2FS_GOING_DOWN_FULLSYNC) issue_discard_thread - bdev_freeze - freeze_super - f2fs_stop_checkpoint() - f2fs_handle_critical_error - sb_start_write - set RO - waiting - bdev_thaw - thaw_super_locked - return -EINVAL, if sb_rdonly() - f2fs_stop_discard_thread -> wait for kthread_stop(discard_thread); • https://git.kernel.org/stable/c/1036d3ea7a32cb7cee00885c73a1f2ba7fbc499a https://git.kernel.org/stable/c/f47ed3b284b38f235355e281f57dfa8fffcc6563 https://git.kernel.org/stable/c/3bdb7f161697e2d5123b89fe1778ef17a44858e7 •