CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2024-35988 – riscv: Fix TASK_SIZE on 64-bit NOMMU
https://notcve.org/view.php?id=CVE-2024-35988
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix TASK_SIZE on 64-bit NOMMU On NOMMU, userspace memory can come from anywhere in physical RAM. The current definition of TASK_SIZE is wrong if any RAM exists above 4G, causing spurious failures in the userspace access routines. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: riscv: corrige TASK_SIZE en NOMMU de 64 bits En NOMMU, la memoria del espacio de usuario puede provenir de cualquier lugar de la RAM física. La definición actual de TASK_SIZE es incorrecta si existe RAM por encima de 4G, lo que provoca fallos falsos en las rutinas de acceso al espacio de usuario. • https://git.kernel.org/stable/c/6bd33e1ece528f67646db33bf97406b747dafda0 https://git.kernel.org/stable/c/04bf2e5f95c1a52e28a7567a507f926efe31c3b6 https://git.kernel.org/stable/c/52e8a42b11078d2aad4b9ba96503d77c7299168b https://git.kernel.org/stable/c/4201b8c8f2c32af321fb50867e68ac6c1cbed4be https://git.kernel.org/stable/c/a0f0dbbb1bc49fa0de18e92c36492ff6d804cdaa https://git.kernel.org/stable/c/efdcfa554b6eb228943ef1dd4d023c606be647d2 https://git.kernel.org/stable/c/6065e736f82c817c9a597a31ee67f0ce4628e948 https://lists.debian.org/debian-lts-announce/2024/06/ •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35987 – riscv: Fix loading 64-bit NOMMU kernels past the start of RAM
https://notcve.org/view.php?id=CVE-2024-35987
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix loading 64-bit NOMMU kernels past the start of RAM commit 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") added logic to allow using RAM below the kernel load address. However, this does not work for NOMMU, where PAGE_OFFSET is fixed to the kernel load address. Since that range of memory corresponds to PFNs below ARCH_PFN_OFFSET, mm initialization runs off the beginning of mem_map and corrupts adjacent kernel memory. Fix this by restoring the previous behavior for NOMMU kernels. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: riscv: se corrigió la carga de kernels NOMMU de 64 bits después del inicio de la confirmación de RAM. 3335068f8721 ("riscv: use páginas PUD/P4D/PGD para el mapeo lineal") se agregó lógica para permitir el uso RAM debajo de la dirección de carga del kernel. Sin embargo, esto no funciona para NOMMU, donde PAGE_OFFSET está fijado a la dirección de carga del kernel. • https://git.kernel.org/stable/c/3335068f87217ea59d08f462187dc856652eea15 https://git.kernel.org/stable/c/b008e327fa570aca210f98c817757649bae56694 https://git.kernel.org/stable/c/ea6628e4e2353978af7e3b4ad4fdaab6149acf3d https://git.kernel.org/stable/c/aea702dde7e9876fb00571a2602f25130847bf0f •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-35986 – phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered
https://notcve.org/view.php?id=CVE-2024-35986
In the Linux kernel, the following vulnerability has been resolved: phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered The power_supply frame-work is not really designed for there to be long living in kernel references to power_supply devices. Specifically unregistering a power_supply while some other code has a reference to it triggers a WARN in power_supply_unregister(): WARN_ON(atomic_dec_return(&psy->use_cnt)); Folllowed by the power_supply still getting removed and the backing data freed anyway, leaving the tusb1210 charger-detect code with a dangling reference, resulting in a crash the next time tusb1210_get_online() is called. Fix this by only holding the reference in tusb1210_get_online() freeing it at the end of the function. Note this still leaves a theoretical race window, but it avoids the issue when manually rmmod-ing the charger chip driver during development. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: phy: ti: tusb1210: resolver el bloqueo del cargador-det si el cargador psy no está registrado. El marco power_supply no está realmente manipulado para que haya referencias duraderas en el kernel a los dispositivos power_supply. Específicamente, cancelar el registro de un power_supply mientras algún otro código tiene una referencia a él activa una ADVERTENCIA en power_supply_unregister(): WARN_ON(atomic_dec_return(&psy->use_cnt)); Seguido por power_supply aún se elimina y los datos de respaldo se liberan de todos modos, dejando el código de detección del cargador tusb1210 con una referencia colgante, lo que resulta en un bloqueo la próxima vez que se llama a tusb1210_get_online(). • https://git.kernel.org/stable/c/48969a5623ed918713552e2b4f9d391c89b5e838 https://git.kernel.org/stable/c/25b3498485ac281e5851700e33b97f12c9533fd8 https://git.kernel.org/stable/c/73224a5d2180066c7fe05b4656647601ba08d588 https://git.kernel.org/stable/c/9827caa5105fb16d1fae2e75c8d0e4662014b3ca https://git.kernel.org/stable/c/bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35985 – sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()
https://notcve.org/view.php?id=CVE-2024-35985
In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf() It was possible to have pick_eevdf() return NULL, which then causes a NULL-deref. This turned out to be due to entity_eligible() returning falsely negative because of a s64 multiplcation overflow. Specifically, reweight_eevdf() computes the vlag without considering the limit placed upon vlag as update_entity_lag() does, and then the scaling multiplication (remember that weight is 20bit fixed point) can overflow. This then leads to the new vruntime being weird which then causes the above entity_eligible() to go side-ways and claim nothing is eligible. Thus limit the range of vlag accordingly. All this was quite rare, but fatal when it does happen. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: sched/eevdf: evita que vlag se salga de los límites en reweight_eevdf(). Era posible que pick_eevdf() devolviera NULL, lo que luego causa un NULL-deref. • https://git.kernel.org/stable/c/14204acc09f652169baed1141c671429047b1313 https://git.kernel.org/stable/c/eab03c23c2a162085b13200d7942fc5a00b5ccc8 https://git.kernel.org/stable/c/470d347b14b0ecffa9b39cf8f644fa2351db3efb https://git.kernel.org/stable/c/06f27e6d7bf0abf54488259ef36bbf0e1fccb35c https://git.kernel.org/stable/c/1560d1f6eb6b398bddd80c16676776c0325fe5fe •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2024-35984 – i2c: smbus: fix NULL function pointer dereference
https://notcve.org/view.php?id=CVE-2024-35984
In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: fix NULL function pointer dereference Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer. [wsa: dropped the simplification in core-smbus to avoid theoretical regressions] En el kernel de Linux, se resolvió la siguiente vulnerabilidad: i2c: smbus: corrige la desreferencia del puntero de función NULL. Baruch informó de un OOPS al usar el controlador de designware como destino únicamente. Los modos de solo objetivo rompen el supuesto de que siempre hay una función de transferencia disponible. • https://git.kernel.org/stable/c/63453b59e41173241c4efe9335815f6432fa8586 https://git.kernel.org/stable/c/40f1d79f07b49c8a64a861706e5163f2db4bd95d https://git.kernel.org/stable/c/ad3c3ac7a03be3697114f781193dd3e9d97e6e23 https://git.kernel.org/stable/c/5fd72404587d7db4acb2d241fd8c387afb0a7aec https://git.kernel.org/stable/c/5a09eae9a7db597fe0c1fc91636205b4a25d2620 https://git.kernel.org/stable/c/4e75e222d397c6752b229ed72fc4644c8c36ecde https://git.kernel.org/stable/c/e3425674ff68dc521c57c6eabad0cbd20a027d85 https://git.kernel.org/stable/c/357c64ef1ef39b1e7cd91ab6bdd304d04 • CWE-476: NULL Pointer Dereference •