CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2021-47434 – xhci: Fix command ring pointer corruption while aborting a command
https://notcve.org/view.php?id=CVE-2021-47434
In the Linux kernel, the following vulnerability has been resolved: xhci: Fix command ring pointer corruption while aborting a command The command ring pointer is located at [6:63] bits of the command ring control register (CRCR). All the control bits like command stop, abort are located at [0:3] bits. While aborting a command, we read the CRCR and set the abort bit and write to the CRCR. The read will always give command ring pointer as all zeros. So we essentially write only the control bits. • https://git.kernel.org/stable/c/22bcb65ea41072ab5d03c0c6290e04e0df6d09a0 https://git.kernel.org/stable/c/62c182b5e763e5f4062e72678e72ce3e02dd4d1b https://git.kernel.org/stable/c/01c2dcb67e71c351006dd17cbba86c26b7f61eaf https://git.kernel.org/stable/c/dec944bb7079b37968cf69c8a438f91f15c4cc61 https://git.kernel.org/stable/c/e54abefe703ab7c4e5983e889babd1447738ca42 https://git.kernel.org/stable/c/ff0e50d3564f33b7f4b35cadeabd951d66cfc570 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47433 – btrfs: fix abort logic in btrfs_replace_file_extents
https://notcve.org/view.php?id=CVE-2021-47433
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix abort logic in btrfs_replace_file_extents Error injection testing uncovered a case where we'd end up with a corrupt file system with a missing extent in the middle of a file. This occurs because the if statement to decide if we should abort is wrong. The only way we would abort in this case is if we got a ret != -EOPNOTSUPP and we called from the file clone code. However the prealloc code uses this path too. Instead we need to abort if there is an error, and the only error we _don't_ abort on is -EOPNOTSUPP and only if we came from the clone file code. • https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378 https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2023-52879 – tracing: Have trace_event_file have ref counters
https://notcve.org/view.php?id=CVE-2023-52879
In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd /sys/kernel/tracing # echo 'p:sched schedule' > kprobe_events # exec 5>>events/kprobes/sched/enable # > kprobe_events # exec 5>&- The above commands: 1. Change directory to the tracefs directory 2. Create a kprobe event (doesn't matter what one) 3. Open bash file descriptor 5 on the enable file of the kprobe event 4. Delete the kprobe event (removes the files too) 5. • https://git.kernel.org/stable/c/e6807c873d8791ae5a5186ad05ec66cab926539a https://git.kernel.org/stable/c/407bf1c140f0757706c0b28604bcc90837d45ce2 https://git.kernel.org/stable/c/fa6d449e4d024d8c17f4288e0567d28ace69415c https://git.kernel.org/stable/c/a46bf337a20f9edd3c8041b025639842280d0575 https://git.kernel.org/stable/c/9beec04370132a7a6cd1aa9897f6fffc6262ff28 https://git.kernel.org/stable/c/f5ca233e2e66dc1c249bf07eefa37e34a6c9346a https://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1e https://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cf •
CVSS: 4.4EPSS: 0%CPEs: 5EXPL: 0CVE-2023-52878 – can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
https://notcve.org/view.php?id=CVE-2023-52878
In the Linux kernel, the following vulnerability has been resolved: can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds If the "struct can_priv::echoo_skb" is accessed out of bounds, this would cause a kernel crash. Instead, issue a meaningful warning message and return with an error. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: dev: can_put_echo_skb(): no bloquee el kernel si se accede a can_priv::echo_skb fuera de los límites. Si se accede a "struct can_priv::echoo_skb" fuera de los límites, esto provocaría un fallo del kernel. En su lugar, emita un mensaje de advertencia significativo y regrese con un error. • https://git.kernel.org/stable/c/a6e4bc5304033e434fabccabb230b8e9ff55d76f https://git.kernel.org/stable/c/826120c9ba68f2d0dbae58e99013929c883d1444 https://git.kernel.org/stable/c/0d30931f1fa0fb893fb7d5dc32b6b7edfb775be4 https://git.kernel.org/stable/c/53c468008a7c9ca3f5fc985951f35ec2acae85bc https://git.kernel.org/stable/c/8ab67da060157362b2e0926692c659808784708f https://git.kernel.org/stable/c/6411959c10fe917288cbb1038886999148560057 https://access.redhat.com/security/cve/CVE-2023-52878 https://bugzilla.redhat.com/show_bug.cgi?id=2282680 • CWE-125: Out-of-bounds Read •
CVSS: 4.4EPSS: 0%CPEs: 5EXPL: 0CVE-2023-52877 – usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
https://notcve.org/view.php?id=CVE-2023-52877
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() It is possible that typec_register_partner() returns ERR_PTR on failure. When port->partner is an error, a NULL pointer dereference may occur as shown below. [91222.095236][ T319] typec port0: failed to register partner (-17) ... [91225.061491][ T319] Unable to handle kernel NULL pointer dereference at virtual address 000000000000039f [91225.274642][ T319] pc : tcpm_pd_data_request+0x310/0x13fc [91225.274646][ T319] lr : tcpm_pd_data_request+0x298/0x13fc [91225.308067][ T319] Call trace: [91225.308070][ T319] tcpm_pd_data_request+0x310/0x13fc [91225.308073][ T319] tcpm_pd_rx_handler+0x100/0x9e8 [91225.355900][ T319] kthread_worker_fn+0x178/0x58c [91225.355902][ T319] kthread+0x150/0x200 [91225.355905][ T319] ret_from_fork+0x10/0x30 Add a check for port->partner to avoid dereferencing a NULL pointer. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: typec: tcpm: corrige la desreferencia del puntero NULL en tcpm_pd_svdm(). Es posible que typec_register_partner() devuelva ERR_PTR en caso de fallo. Cuando port->partner es un error, puede ocurrir una desreferencia de puntero NULL como se muestra a continuación. [91222.095236][T319] typec port0: no se pudo registrar el socio (-17)... [91225.061491][T319] No se puede manejar la desreferencia del puntero NULL del kernel en la dirección virtual 000000000000039f [91225.274642][T319] pc: tcpm_pd_data_request+0x310 /0x13fc [91225.274646][ T319] lr: tcpm_pd_data_request+0x298/0x13fc [91225.308067][ T319] Rastreo de llamadas: [91225.308070][ T319] tcpm_pd_data_request+0x310/0x13fc 3][T319] tcpm_pd_rx_handler+0x100/0x9e8 [91225.355900][T319] kthread_worker_fn+0x178/0x58c [91225.355902][ T319] kthread+0x150/0x200 [91225.355905][ T319] ret_from_fork+0x10/0x30 Agregue una verificación de port->partner para evitar desreferenciar un puntero NULL. • https://git.kernel.org/stable/c/5e1d4c49fbc86dab6e005d66f066bd53c9479cde https://git.kernel.org/stable/c/e5f53a68a596e04df3fde3099273435a30b6fdac https://git.kernel.org/stable/c/e7a802447c491903aa7cb45967aa2a934a4e63fc https://git.kernel.org/stable/c/9ee038590d808a95d16adf92818dcd4752273c08 https://git.kernel.org/stable/c/b37a168c0137156042a0ca9626651b5a789e822b https://git.kernel.org/stable/c/4987daf86c152ff882d51572d154ad12e4ff3a4b https://access.redhat.com/security/cve/CVE-2023-52877 https://bugzilla.redhat.com/show_bug.cgi?id=2282712 • CWE-476: NULL Pointer Dereference •