CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35948 – bcachefs: Check for journal entries overruning end of sb clean section
https://notcve.org/view.php?id=CVE-2024-35948
In the Linux kernel, the following vulnerability has been resolved: bcachefs: Check for journal entries overruning end of sb clean section Fix a missing bounds check in superblock validation. Note that we don't yet have repair code for this case - repair code for individual items is generally low priority, since the whole superblock is checksummed, validated prior to write, and we have backups. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bcachefs: comprueba si hay entradas de diario que sobrepasen el final de la sección de limpieza de sb. Corrige una comprobación de límites faltantes en la validación de superbloque. Tenga en cuenta que todavía no tenemos un código de reparación para este caso; el código de reparación para elementos individuales generalmente tiene una prioridad baja, ya que todo el superbloque se suma, se valida antes de escribir y tenemos copias de seguridad. • https://git.kernel.org/stable/c/fcdbc1d7a4b638e5d5668de461f320386f3002aa • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2024-35947 – dyndbg: fix old BUG_ON in >control parser
https://notcve.org/view.php?id=CVE-2024-35947
In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >control parser Fix a BUG_ON from 2009. Even if it looks "unreachable" (I didn't really look), lets make sure by removing it, doing pr_err and return -EINVAL instead. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dyndbg: corrige el antiguo BUG_ON en >control parser. Corrige un BUG_ON de 2009. Incluso si parece "unreachable" (realmente no lo miré), asegurémonos eliminándolo. haciendo pr_err y devuelve -EINVAL en su lugar. • https://git.kernel.org/stable/c/3c718bddddca9cbef177ac475b94c5c91147fb38 https://git.kernel.org/stable/c/343081c21e56bd6690d342e2f5ae8c00183bf081 https://git.kernel.org/stable/c/41d8ac238ab1cab01a8c71798d61903304f4e79b https://git.kernel.org/stable/c/ba3c118cff7bcb0fe6aa84ae1f9080d50e31c561 https://git.kernel.org/stable/c/a66c869b17c4c4dcf81d273b02cb0efe88e127ab https://git.kernel.org/stable/c/a69e1bdd777ce51061111dc419801e8a2fd241cc https://git.kernel.org/stable/c/529e1852785599160415e964ca322ee7add7aef0 https://git.kernel.org/stable/c/00e7d3bea2ce7dac7bee1cf501fb071fd •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35946 – wifi: rtw89: fix null pointer access when abort scan
https://notcve.org/view.php?id=CVE-2024-35946
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix null pointer access when abort scan During cancel scan we might use vif that weren't scanning. Fix this by using the actual scanning vif. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: rtw89: corrige el acceso al puntero null al cancelar el escaneo. Durante la cancelación del escaneo podríamos usar vif que no estaban escaneando. Solucione este problema utilizando el vif de escaneo real. • https://git.kernel.org/stable/c/b34d64e9aa5505e3c84570aed5c757f1839573e8 https://git.kernel.org/stable/c/4f11c741908dab7dd48fa5a986b210d4fc74ca8d https://git.kernel.org/stable/c/7e11a2966f51695c0af0b1f976a32d64dee243b2 https://access.redhat.com/security/cve/CVE-2024-35946 https://bugzilla.redhat.com/show_bug.cgi?id=2281833 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35945 – net: phy: phy_device: Prevent nullptr exceptions on ISR
https://notcve.org/view.php?id=CVE-2024-35945
In the Linux kernel, the following vulnerability has been resolved: net: phy: phy_device: Prevent nullptr exceptions on ISR If phydev->irq is set unconditionally, check for valid interrupt handler or fall back to polling mode to prevent nullptr exceptions in interrupt service routine. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: phy: phy_device: previene excepciones nullptr en ISR. Si phydev->irq está configurado incondicionalmente, verifique si hay un controlador de interrupciones válido o recurra al modo de sondeo para evitar excepciones nullptr en la rutina del servicio de interrupciones . • https://git.kernel.org/stable/c/7a71f61ebf95cedd3f245db6da397822971d8db5 https://git.kernel.org/stable/c/3419ee39e3d3162ab2ec9942bb537613ed5b6311 https://git.kernel.org/stable/c/61c81872815f46006982bb80460c0c80a949b35b •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2024-35944 – VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
https://notcve.org/view.php?id=CVE-2024-35944
In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in dg_dispatch_as_host' bug. memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg" at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24) WARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237 dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237 Some code commentry, based on my understanding: 544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size) /// This is 24 + payload_size memcpy(&dg_info->msg, dg, dg_size); Destination = dg_info->msg ---> this is a 24 byte structure(struct vmci_datagram) Source = dg --> this is a 24 byte structure (struct vmci_datagram) Size = dg_size = 24 + payload_size {payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32. 35 struct delayed_datagram_info { 36 struct datagram_entry *entry; 37 struct work_struct work; 38 bool in_dg_host_queue; 39 /* msg and msg_payload must be together. */ 40 struct vmci_datagram msg; 41 u8 msg_payload[]; 42 }; So those extra bytes of payload are copied into msg_payload[], a run time warning is seen while fuzzing with Syzkaller. One possible way to fix the warning is to split the memcpy() into two parts -- one -- direct assignment of msg and second taking care of payload. Gustavo quoted: "Under FORTIFY_SOURCE we should not copy data across multiple members in a structure." En el kernel de Linux, se resolvió la siguiente vulnerabilidad: VMCI: corrigió la advertencia de tiempo de ejecución de memcpy() en dg_dispatch_as_host() Syzkaller presionó el error 'ADVERTENCIA en dg_dispatch_as_host'. memcpy: se detectó escritura que abarca todos los campos (tamaño 56) de un solo campo "&dg_info->msg" en drivers/misc/vmw_vmci/vmci_datagram.c:237 (tamaño 24) ADVERTENCIA: CPU: 0 PID: 1555 en drivers/misc/vmw_vmci /vmci_datagram.c:237 dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237 Algunos comentarios de código, según tengo entendido: 544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size ) /// Esto es 24 + payload_size memcpy(&dg_info->msg, dg, dg_size); Destino = dg_info->msg ---> esta es una estructura de 24 bytes (struct vmci_datagram) Fuente = dg --> esta es una estructura de 24 bytes (struct vmci_datagram) Tamaño = dg_size = 24 + payload_size {payload_size = 56-24 = 32} -- Syzkaller logró establecer payload_size en 32. 35 struct delay_datagram_info { 36 struct datagram_entry *entry; 37 struct work_struct work; 38 bool in_dg_host_queue; 39 /* msg y msg_payload deben estar juntos. */ 40 struct vmci_datagram mensaje; 41 u8 msg_payload[]; 42}; Entonces, esos bytes adicionales de payload se copian en msg_payload[], se ve una advertencia de tiempo de ejecución mientras se utiliza Syzkaller. Una forma posible de solucionar la advertencia es dividir memcpy() en dos partes: una, asignación directa del mensaje y la segunda, encargada del payload. Gustavo citó: "Bajo FORTIFY_SOURCE no debemos copiar datos entre varios miembros de una estructura". • https://git.kernel.org/stable/c/e87bb99d2df6512d8ee37a5d63d2ca9a39a8c051 https://git.kernel.org/stable/c/f15eca95138b3d4ec17b63c3c1937b0aa0d3624b https://git.kernel.org/stable/c/ad78c5047dc4076d0b3c4fad4f42ffe9c86e8100 https://git.kernel.org/stable/c/130b0cd064874e0d0f58e18fb00e6f3993e90c74 https://git.kernel.org/stable/c/feacd430b42bbfa9ab3ed9e4f38b86c43e348c75 https://git.kernel.org/stable/c/dae70a57565686f16089737adb8ac64471570f73 https://git.kernel.org/stable/c/491a1eb07c2bd8841d63cb5263455e185be5866f https://git.kernel.org/stable/c/19b070fefd0d024af3daa7329cbc0d00d •