CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-36881 – mm/userfaultfd: reset ptes when close() for wr-protected ones
https://notcve.org/view.php?id=CVE-2024-36881
30 May 2024 — In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: reset ptes when close() for wr-protected ones Userfaultfd unregister includes a step to remove wr-protect bits from all the relevant pgtable entries, but that only covered an explicit UFFDIO_UNREGISTER ioctl, not a close() on the userfaultfd itself. Cover that too. This fixes a WARN trace. The only user visible side effect is the user can observe leftover wr-protect bits even if the user close()ed on an userfaultfd when rele... • https://git.kernel.org/stable/c/f369b07c861435bd812a9d14493f71b34132ed6f • CWE-281: Improper Preservation of Permissions •
CVSS: 6.3EPSS: 0%CPEs: 5EXPL: 0CVE-2024-36880 – Bluetooth: qca: add missing firmware sanity checks
https://notcve.org/view.php?id=CVE-2024-36880
30 May 2024 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: add missing firmware sanity checks Add the missing sanity checks when parsing the firmware files before downloading them to avoid accessing and corrupting memory beyond the vmalloced buffer. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Bluetooth: qca: agregar comprobaciones de integridad del firmware faltantes Agregue las comprobaciones de integridad del firmware faltantes al analizar los archivos de firmw... • https://git.kernel.org/stable/c/83e81961ff7ef75f97756f316caea5aa6bcc19cc •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-36033 – Bluetooth: qca: fix info leak when fetching board id
https://notcve.org/view.php?id=CVE-2024-36033
30 May 2024 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching board id Add the missing sanity check when fetching the board id to avoid leaking slab data when later requesting the firmware. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Bluetooth: qca: corrige la fuga de información al obtener la identificación de la placa. Agregue la verificación de cordura que falta al recuperar la identificación de la placa para evitar fugas de datos de l... • https://git.kernel.org/stable/c/a7f8dedb4be2cc930a29af24427b885405ecd15d •
CVSS: 2.3EPSS: 0%CPEs: 5EXPL: 0CVE-2024-36032 – Bluetooth: qca: fix info leak when fetching fw build id
https://notcve.org/view.php?id=CVE-2024-36032
30 May 2024 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching fw build id Add the missing sanity checks and move the 255-byte build-id buffer off the stack to avoid leaking stack data through debugfs in case the build-info reply is malformed. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: qca: corrige la fuga de información al recuperar el ID de compilación del firmware. Agregue las comprobaciones de cordura que faltan y mueva ... • https://git.kernel.org/stable/c/c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2024-36031 – keys: Fix overwrite of key expiration on instantiation
https://notcve.org/view.php?id=CVE-2024-36031
30 May 2024 — In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that key_set_expiry is only called when the pre-parser sets a specific expiry. En el kernel de Linux, se... • https://git.kernel.org/stable/c/97be1e865e70e5a0ad0a5b5f5dca5031ca0b53ac • CWE-324: Use of a Key Past its Expiration Date CWE-665: Improper Initialization •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2023-52882 – clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
https://notcve.org/view.php?id=CVE-2023-52882
30 May 2024 — In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) while also doing a lot of frequency switches, we can't observe any instability issues anymore when doing reparenting to stable clock like 24 MHz oscillator. E... • https://git.kernel.org/stable/c/524353ea480b0094c16f2b5684ce7e0a23ab3685 •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-36030 – octeontx2-af: fix the double free in rvu_npc_freemem()
https://notcve.org/view.php?id=CVE-2024-36030
30 May 2024 — In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix the double free in rvu_npc_freemem() Clang static checker(scan-build) warning： drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c:line 2184, column 2 Attempt to free released memory. npc_mcam_rsrcs_deinit() has released 'mcam->counters.bmap'. Deleted this redundant kfree() to fix this double free problem. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: octeontx2-af: arreglar el doble libre en rvu_npc_fr... • https://git.kernel.org/stable/c/dd7842878633453e38d6a4927593dd28b9d8ab91 • CWE-415: Double Free •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-36029 – mmc: sdhci-msm: pervent access to suspended controller
https://notcve.org/view.php?id=CVE-2024-36029
30 May 2024 — In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-msm: pervent access to suspended controller Generic sdhci code registers LED device and uses host->runtime_suspended flag to protect access to it. The sdhci-msm driver doesn't set this flag, which causes a crash when LED is accessed while controller is runtime suspended. Fix this by setting the flag correctly. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mmc: sdhci-msm: acceso prohibido al controlador suspen... • https://git.kernel.org/stable/c/67e6db113c903f2b8af924400b7b43ade4b9ac5c •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2024-36028 – mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
https://notcve.org/view.php?id=CVE-2024-36028
30 May 2024 — In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() When I did memory failure tests recently, below warning occurs: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 8 PID: 1011 at kernel/locking/lockdep.c:232 __lock_acquire+0xccb/0x1ca0 Modules linked in: mce_inject hwpoison_inject CPU: 8 PID: 1011 Comm: bash Kdump: loaded Not tainted 6.9.0-rc3-next-20240410-00012-gdb69f219f4be #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 19... • https://git.kernel.org/stable/c/1b4ce2952b4f33e198d5e993acff0611dff1e399 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2024-36027 – btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer
https://notcve.org/view.php?id=CVE-2024-36027
30 May 2024 — In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer Btrfs clears the content of an extent buffer marked as EXTENT_BUFFER_ZONED_ZEROOUT before the bio submission. This mechanism is introduced to prevent a write hole of an extent buffer, which is once allocated, marked dirty, but turns out unnecessary and cleaned up within one transaction operation. Currently, btrfs_clear_buffer_dirty() marks the extent buffer as EXTENT_BUFFER_ZONED_... • https://git.kernel.org/stable/c/aa6313e6ff2bfbf736a2739047bba355d8241584 •