CVSS: 4.4EPSS: 0%CPEs: 5EXPL: 0CVE-2021-47100 – ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
https://notcve.org/view.php?id=CVE-2021-47100
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module Hi, When testing install and uninstall of ipmi_si.ko and ipmi_msghandler.ko, the system crashed. The log as follows: [ 141.087026] BUG: unable to handle kernel paging request at ffffffffc09b3a5a [ 141.087241] PGD 8fe4c0d067 P4D 8fe4c0d067 PUD 8fe4c0f067 PMD 103ad89067 PTE 0 [ 141.087464] Oops: 0010 [#1] SMP NOPTI [ 141.087580] CPU: 67 PID: 668 Comm: kworker/67:1 Kdump: loaded N... • https://git.kernel.org/stable/c/b2cfd8ab4add53c2070367bfee2f5b738f51698d •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47099 – veth: ensure skb entering GRO are not cloned.
https://notcve.org/view.php?id=CVE-2021-47099
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: veth: ensure skb entering GRO are not cloned. After commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP"), if GRO is enabled on a veth device and TSO is disabled on the peer device, TCP skbs will go through the NAPI callback. If there is no XDP program attached, the veth code does not perform any share check, and shared/cloned skbs could enter the GRO engine. Ignat reported a BUG triggered later-on due to the above condition: [... • https://git.kernel.org/stable/c/d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c • CWE-20: Improper Input Validation •
CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47098 – hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations
https://notcve.org/view.php?id=CVE-2021-47098
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations Commit b50aa49638c7 ("hwmon: (lm90) Prevent integer underflows of temperature calculations") addressed a number of underflow situations when writing temperature limits. However, it missed one situation, seen when an attempt is made to set the hysteresis value to MAX_LONG and the critical temperature limit is negative. Use clamp_val() when setting the hysteresis temp... • https://git.kernel.org/stable/c/b50aa49638c7e12abf4ecc483f4e928c5cccc1b0 • CWE-190: Integer Overflow or Wraparound •
CVSS: 6.0EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47097 – Input: elantech - fix stack out of bound access in elantech_change_report_id()
https://notcve.org/view.php?id=CVE-2021-47097
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: Input: elantech - fix stack out of bound access in elantech_change_report_id() The array param[] in elantech_change_report_id() must be at least 3 bytes, because elantech_read_reg_params() is calling ps2_command() with PSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but it's defined in the stack as an array of 2 bytes, therefore we have a potential stack out-of-bounds access here, also confirmed by KASAN: [ 6.512374] BUG:... • https://git.kernel.org/stable/c/9e4815cf178561104881e5d687ef69396aca1c8d • CWE-125: Out-of-bounds Read •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47096 – ALSA: rawmidi - fix the uninitalized user_pversion
https://notcve.org/view.php?id=CVE-2021-47096
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: ALSA: rawmidi - fix the uninitalized user_pversion The user_pversion was uninitialized for the user space file structure in the open function, because the file private structure use kmalloc for the allocation. The kernel ALSA sequencer code clears the file structure, so no additional fixes are required. BugLink: https://github.com/alsa-project/alsa-lib/issues/178 En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ALSA: rawmidi:... • https://git.kernel.org/stable/c/09d23174402da0f10e98da2c61bb5ac8e7d79fdd •
CVSS: 5.1EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47095 – ipmi: ssif: initialize ssif_info->client early
https://notcve.org/view.php?id=CVE-2021-47095
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: ipmi: ssif: initialize ssif_info->client early During probe ssif_info->client is dereferenced in error path. However, it is set when some of the error checking has already been done. This causes following kernel crash if an error path is taken: [ 30.645593][ T674] ipmi_ssif 0-000e: ipmi_ssif: Not probing, Interface already present [ 30.657616][ T674] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088 ... [ ... • https://git.kernel.org/stable/c/c4436c9149c5d2bc0c49ab57ec85c75ea1c4d61c •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47094 – KVM: x86/mmu: Don't advance iterator after restart due to yielding
https://notcve.org/view.php?id=CVE-2021-47094
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Don't advance iterator after restart due to yielding After dropping mmu_lock in the TDP MMU, restart the iterator during tdp_iter_next() and do not advance the iterator. Advancing the iterator results in skipping the top-level SPTE and all its children, which is fatal if any of the skipped SPTEs were not visited before yielding. When zapping all SPTEs, i.e. when min_level == root_level, restarting the iter and then invoking td... • https://git.kernel.org/stable/c/faaf05b00aecdb347ffd1d763d024394ec0329f8 •
CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47093 – platform/x86: intel_pmc_core: fix memleak on registration failure
https://notcve.org/view.php?id=CVE-2021-47093
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel_pmc_core: fix memleak on registration failure In case device registration fails during module initialisation, the platform device structure needs to be freed using platform_device_put() to properly free all resources (e.g. the device name). En el kernel de Linux, se resolvió la siguiente vulnerabilidad: plataforma/x86: intel_pmc_core: corrige memleak en falla de registro En caso de que el registro del dispositivo falle d... • https://git.kernel.org/stable/c/938835aa903ae19ad62805134f79bbcf20fc3bea •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47092 – KVM: VMX: Always clear vmx->fail on emulation_required
https://notcve.org/view.php?id=CVE-2021-47092
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Always clear vmx->fail on emulation_required Revert a relatively recent change that set vmx->fail if the vCPU is in L2 and emulation_required is true, as that behavior is completely bogus. Setting vmx->fail and synthesizing a VM-Exit is contradictory and wrong: (a) it's impossible to have both a VM-Fail and VM-Exit (b) vmcs.EXIT_REASON is not modified on VM-Fail (c) emulation_required refers to guest state and guest state checks a... • https://git.kernel.org/stable/c/c8607e4a086fae05efe5bffb47c5199c65e7216e •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-47091 – mac80211: fix locking in ieee80211_start_ap error path
https://notcve.org/view.php?id=CVE-2021-47091
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: mac80211: fix locking in ieee80211_start_ap error path We need to hold the local->mtx to release the channel context, as even encoded by the lockdep_assert_held() there. Fix it. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: mac80211: corrige el bloqueo en la ruta de error ieee80211_start_ap Necesitamos mantener local->mtx para liberar el contexto del canal, incluso codificado por lockdep_assert_held() allí. Arreglalo. I... • https://git.kernel.org/stable/c/295b02c4be74bebf988593b8322369513fcecf68 •