CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2023-52799 – jfs: fix array-index-out-of-bounds in dbFindLeaf
https://notcve.org/view.php?id=CVE-2023-52799
21 May 2024 — In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in dbFindLeaf Currently while searching for dmtree_t for sufficient free blocks there is an array out of bounds while getting element in tp->dm_stree. To add the required check for out of bound we first need to determine the type of dmtree. Thus added an extra parameter to dbFindLeaf so that the type of tree can be determined and the required check can be applied. En el kernel de Linux, se resolvió la sigu... • https://git.kernel.org/stable/c/20f9310a18e3e99fc031e036fcbed67105ae1859 •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-52798 – wifi: ath11k: fix dfs radar event locking
https://notcve.org/view.php?id=CVE-2023-52798
21 May 2024 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix dfs radar event locking The ath11k active pdevs are protected by RCU but the DFS radar event handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Compile tested only. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: wifi: ath11k: corrige el bloqueo de ev... • https://git.kernel.org/stable/c/d5c65159f2895379e11ca13f62feabe93278985d • CWE-416: Use After Free •
CVSS: 4.7EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52797 – drivers: perf: Check find_first_bit() return value
https://notcve.org/view.php?id=CVE-2023-52797
21 May 2024 — In the Linux kernel, the following vulnerability has been resolved: drivers: perf: Check find_first_bit() return value We must check the return value of find_first_bit() before using the return value as an index array since it happens to overflow the array and then panic: [ 107.318430] Kernel BUG [#1] [ 107.319434] CPU: 3 PID: 1238 Comm: kill Tainted: G E 6.6.0-rc6ubuntu-defconfig #2 [ 107.319465] Hardware name: riscv-virtio,qemu (DT) [ 107.319551] epc : pmu_sbi_ovf_handler+0x3a4/0x3ae [ 107.319840] ra : pm... • https://git.kernel.org/stable/c/4905ec2fb7e6421c14c9fb7276f5aa92f60f2b98 •
CVSS: 4.6EPSS: 0%CPEs: 8EXPL: 0CVE-2023-52796 – ipvlan: add ipvlan_route_v6_outbound() helper
https://notcve.org/view.php?id=CVE-2023-52796
21 May 2024 — In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_outbound() helper Inspired by syzbot reports using a stack of multiple ipvlan devices. Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack, immediately reclaimed. Also make sure ipvlan_process_v4_outbound() is not inlined. We might also have to lower MAX_NEST_DEV, because on... • https://git.kernel.org/stable/c/2ad7bf3638411cb547f2823df08166c13ab04269 • CWE-121: Stack-based Buffer Overflow •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52795 – vhost-vdpa: fix use after free in vhost_vdpa_probe()
https://notcve.org/view.php?id=CVE-2023-52795
21 May 2024 — In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix use after free in vhost_vdpa_probe() The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_simple_remove() is a use after free and a double free. En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: vhost-vdpa: corrige el use after free en vhost_vdpa_probe(). El put_device() llama a vhost_vdpa_release_dev() que llama a ida_simple_remove() y libera "v".... • https://git.kernel.org/stable/c/ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 •
CVSS: 3.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52794 – thermal: intel: powerclamp: fix mismatch in get function for max_idle
https://notcve.org/view.php?id=CVE-2023-52794
21 May 2024 — In the Linux kernel, the following vulnerability has been resolved: thermal: intel: powerclamp: fix mismatch in get function for max_idle KASAN reported this [ 444.853098] BUG: KASAN: global-out-of-bounds in param_get_int+0x77/0x90 [ 444.853111] Read of size 4 at addr ffffffffc16c9220 by task cat/2105 ... [ 444.853442] The buggy address belongs to the variable: [ 444.853443] max_idle+0x0/0xffffffffffffcde0 [intel_powerclamp] There is a mismatch between the param_get_int and the definition of max_idle. Repla... • https://git.kernel.org/stable/c/ebf519710218814cf827adbf9111af081344c969 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52792 – cxl/region: Do not try to cleanup after cxl_region_setup_targets() fails
https://notcve.org/view.php?id=CVE-2023-52792
21 May 2024 — In the Linux kernel, the following vulnerability has been resolved: cxl/region: Do not try to cleanup after cxl_region_setup_targets() fails Commit 5e42bcbc3fef ("cxl/region: decrement ->nr_targets on error in cxl_region_attach()") tried to avoid 'eiw' initialization errors when ->nr_targets exceeded 16, by just decrementing ->nr_targets when cxl_region_setup_targets() failed. Commit 86987c766276 ("cxl/region: Cleanup target list on attach error") extended that cleanup to also clear cxled->pos and p->target... • https://git.kernel.org/stable/c/5e42bcbc3fef6e759dfb4d3f4cfb394c382b4249 •
CVSS: 4.6EPSS: 0%CPEs: 7EXPL: 0CVE-2023-52791 – i2c: core: Run atomic i2c xfer when !preemptible
https://notcve.org/view.php?id=CVE-2023-52791
21 May 2024 — In the Linux kernel, the following vulnerability has been resolved: i2c: core: Run atomic i2c xfer when !preemptible Since bae1d3a05a8b, i2c transfers are non-atomic if preemption is disabled. However, non-atomic i2c transfers require preemption (e.g. in wait_for_completion() while waiting for the DMA). panic() calls preempt_disable_notrace() before calling emergency_restart(). Therefore, if an i2c device is used for the restart, the xfer should be atomic. This avoids warnings like: [ 12.667612] WARNING: CP... • https://git.kernel.org/stable/c/bae1d3a05a8b99bd748168bbf8155a1d047c562e • CWE-459: Incomplete Cleanup •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-52790 – swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC
https://notcve.org/view.php?id=CVE-2023-52790
21 May 2024 — In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC Limit the free list length to the size of the IO TLB. Transient pool can be smaller than IO_TLB_SEGSIZE, but the free list is initialized with the assumption that the total number of slots is a multiple of IO_TLB_SEGSIZE. As a result, swiotlb_area_find_slots() may allocate slots past the end of a transient IO TLB buffer. En el kernel de Linux, se ha resuelto la siguiente... • https://git.kernel.org/stable/c/79636caad3618e2b38457f6e298c9b31ba82b489 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2023-52789 – tty: vcc: Add check for kstrdup() in vcc_probe()
https://notcve.org/view.php?id=CVE-2023-52789
21 May 2024 — In the Linux kernel, the following vulnerability has been resolved: tty: vcc: Add check for kstrdup() in vcc_probe() Add check for the return value of kstrdup() and return the error, if it fails in order to avoid NULL pointer dereference. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tty: vcc: Agregar verificación para kstrdup() en vcc_probe(). Agregar verificación para el valor de retorno de kstrdup() y devolver el error, si falla, para evitar la desreferencia de puntero NULL . In the ... • https://git.kernel.org/stable/c/38cd56fc9de78bf3c878790785e8c231116ef9d3 •