CVSS: 4.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-38564 – bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
https://notcve.org/view.php?id=CVE-2024-38564
In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses bpf_prog_get and relies on bpf_prog_attach_check_attach_type to properly verify prog_type <> attach_type association. Add missing attach_type enforcement for the link_create case. Otherwise, it's currently possible to attach cgroup_skb prog types to other cgroup hooks. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bpf: agregue la aplicación del tipo de archivo adjunto BPF_PROG_TYPE_CGROUP_SKB en BPF_LINK_CREATE bpf_prog_attach usa adjunto_type_to_prog_type para aplicar el tipo de archivo adjunto adecuado para BPF_PROG_TYPE_CGROUP_SKB. link_create usa bpf_prog_get y se basa en bpf_prog_attach_check_attach_type para verificar correctamente la asociación prog_type <> adjunto_tipo. Agregue la aplicación de adjunto_tipo faltante para el caso link_create. De lo contrario, actualmente es posible adjuntar tipos de programa cgroup_skb a otros enlaces de cgroup. • https://git.kernel.org/stable/c/4a1e7c0c63e02daad751842b7880f9bbcdfb6e89 https://git.kernel.org/stable/c/6675c541f540a29487a802d3135280b69b9f568d https://git.kernel.org/stable/c/67929e973f5a347f05fef064fea4ae79e7cdb5fd https://git.kernel.org/stable/c/b34bbc76651065a5eafad8ddff1eb8d1f8473172 https://git.kernel.org/stable/c/543576ec15b17c0c93301ac8297333c7b6e84ac7 https://access.redhat.com/security/cve/CVE-2024-38564 https://bugzilla.redhat.com/show_bug.cgi?id=2293429 • CWE-665: Improper Initialization •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-38561 – kunit: Fix kthread reference
https://notcve.org/view.php?id=CVE-2024-38561
In the Linux kernel, the following vulnerability has been resolved: kunit: Fix kthread reference There is a race condition when a kthread finishes after the deadline and before the call to kthread_stop(), which may lead to use after free. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: kunit: Fix kthread reference Hay una condición de ejecución cuando un kthread finaliza después de la fecha límite y antes de la llamada a kthread_stop(), lo que puede llevar a su use-after-free. • https://git.kernel.org/stable/c/adf505457032c11b79b5a7c277c62ff5d61b17c2 https://git.kernel.org/stable/c/1f2ebd3758e1cef6a1f998a1f7ea73310dcb1699 https://git.kernel.org/stable/c/1ec7ccb4cd4b6f72c2998b07880fa7aaf8dfe1d4 https://git.kernel.org/stable/c/8f5c841a559ccb700c8d27a3ca645b7a5f59b4f5 https://git.kernel.org/stable/c/b0b755cb5a5e0d7168c3ab1b3814b0d3cad9f017 https://git.kernel.org/stable/c/f8aa1b98ce40184521ed95ec26cc115a255183b2 •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2024-38560 – scsi: bfa: Ensure the copied buf is NUL terminated
https://notcve.org/view.php?id=CVE-2024-38560
In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Ensure the copied buf is NUL terminated Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: scsi: bfa: asegúrese de que el buf copiado tenga terminación NUL. Actualmente, asignamos un búfer del kernel de tamaño nbytes y copiamos nbytes del espacio de usuario a ese búfer. • https://git.kernel.org/stable/c/9f30b674759b9a2da25aefe25d885161d8a911cb https://git.kernel.org/stable/c/481fc0c8617304a67649027c4a44723a139a0462 https://git.kernel.org/stable/c/595a6b98deec01b6dbb20139f71edcd5fb760ec2 https://git.kernel.org/stable/c/00b425ff0891283207d7bad607a2412225274d7a https://git.kernel.org/stable/c/1708e3cf2488788cba5489e4f913d227de757baf https://git.kernel.org/stable/c/7d3e694c4fe30f3aba9cd5ae86fb947a54c3db5c https://git.kernel.org/stable/c/204714e68015d6946279719fd464ecaf57240f35 https://git.kernel.org/stable/c/7510fab46b1cbd1680e2a096e779aec33 •
CVSS: 4.4EPSS: 0%CPEs: 9EXPL: 0CVE-2024-38559 – scsi: qedf: Ensure the copied buf is NUL terminated
https://notcve.org/view.php?id=CVE-2024-38559
In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Ensure the copied buf is NUL terminated Currently, we allocate a count-sized kernel buffer and copy count from userspace to that buffer. Later, we use kstrtouint on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using kstrtouint. Fix this issue by using memdup_user_nul instead of memdup_user. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: scsi: qedf: asegúrese de que el buf copiado tenga terminación NUL. Actualmente, asignamos un búfer del kernel del tamaño de un conteo y copiamos el conteo desde el espacio de usuario a ese búfer. • https://git.kernel.org/stable/c/61d8658b4a435eac729966cc94cdda077a8df5cd https://git.kernel.org/stable/c/1f84a2744ad813be23fc4be99fb74bfb24aadb95 https://git.kernel.org/stable/c/a75001678e1d38aa607d5b898ec7ff8ed0700d59 https://git.kernel.org/stable/c/769b9fd2af02c069451fe9108dba73355d9a021c https://git.kernel.org/stable/c/dccd97b39ab2f2b1b9a47a1394647a4d65815255 https://git.kernel.org/stable/c/d93318f19d1e1a6d5f04f5d965eaa9055bb7c613 https://git.kernel.org/stable/c/563e609275927c0b75fbfd0d90441543aa7b5e0d https://git.kernel.org/stable/c/4907f5ad246fa9b51093ed7dfc7da9ebb • CWE-125: Out-of-bounds Read CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2024-38558 – net: openvswitch: fix overwriting ct original tuple for ICMPv6
https://notcve.org/view.php?id=CVE-2024-38558
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVS_PACKET_CMD_EXECUTE has 3 main attributes: - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format. - OVS_PACKET_ATTR_PACKET - Binary packet content. - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet. OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure with the metadata like conntrack state, input port, recirculation id, etc. Then the packet itself gets parsed to populate the rest of the keys from the packet headers. Whenever the packet parsing code starts parsing the ICMPv6 header, it first zeroes out fields in the key corresponding to Neighbor Discovery information even if it is not an ND packet. It is an 'ipv6.nd' field. However, the 'ipv6' is a union that shares the space between 'nd' and 'ct_orig' that holds the original tuple conntrack metadata parsed from the OVS_PACKET_ATTR_KEY. ND packets should not normally have conntrack state, so it's fine to share the space, but normal ICMPv6 Echo packets or maybe other types of ICMPv6 can have the state attached and it should not be overwritten. The issue results in all but the last 4 bytes of the destination address being wiped from the original conntrack tuple leading to incorrect packet matching and potentially executing wrong actions in case this packet recirculates within the datapath or goes back to userspace. ND fields should not be accessed in non-ND packets, so not clearing them should be fine. Executing memset() only for actual ND packets to avoid the issue. Initializing the whole thing before parsing is needed because ND packet may not contain all the options. The issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't affect packets entering OVS datapath from network interfaces, because in this case CT metadata is populated from skb after the packet is already parsed. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: openvswitch: corrige la sobrescritura de la tupla original de ct para ICMPv6 OVS_PACKET_CMD_EXECUTE tiene 3 atributos principales: - OVS_PACKET_ATTR_KEY - Metadatos de paquetes en formato netlink. - OVS_PACKET_ATTR_PACKET: contenido del paquete binario. - OVS_PACKET_ATTR_ACTIONS: acciones a ejecutar en el paquete. • https://git.kernel.org/stable/c/9dd7f8907c3705dc7a7a375d1c6e30b06e6daffc https://git.kernel.org/stable/c/6a51ac92bf35d34b4996d6eb67e2fe469f573b11 https://git.kernel.org/stable/c/0b532f59437f688563e9c58bdc1436fefa46e3b5 https://git.kernel.org/stable/c/5ab6aecbede080b44b8e34720ab72050bf1e6982 https://git.kernel.org/stable/c/483eb70f441e2df66ade78aa7217e6e4caadfef3 https://git.kernel.org/stable/c/9ec8b0ccadb908d92f7ee211a4eff05fd932f3f6 https://git.kernel.org/stable/c/78741b4caae1e880368cb2f5110635f3ce45ecfd https://git.kernel.org/stable/c/431e9215576d7b728f3f53a704d237a52 • CWE-665: Improper Initialization •