CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-38568 – drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
https://notcve.org/view.php?id=CVE-2024-38568
In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group The perf tool allows users to create event groups through following cmd [1], but the driver does not check whether the array index is out of bounds when writing data to the event_group array. If the number of events in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the memory write overflow of event_group array occurs. Add array index check to fix the possible array out of bounds violation, and return directly when write new events are written to array bounds. There are 9 different events in an event_group. [1] perf stat -e '{pmu/event1/, ... ,pmu/event9/} En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drivers/perf: hisi: hns3: corrige el acceso fuera de los límites cuando el grupo de eventos es válido. La herramienta perf permite a los usuarios crear grupos de eventos mediante el siguiente cmd [1], pero el controlador no comprueba si el índice de la matriz está fuera de los límites al escribir datos en la matriz event_group. Si el número de eventos en un event_group es mayor que HNS3_PMU_MAX_HW_EVENTS, se produce un desbordamiento de escritura en la memoria de la matriz event_group. • https://git.kernel.org/stable/c/66637ab137b44914356a9dc7a9b3f8ebcf0b0695 https://git.kernel.org/stable/c/3669baf308308385a2ab391324abdde5682af5aa https://git.kernel.org/stable/c/be1fa711e59c874d049f592aef1d4685bdd22bdf https://git.kernel.org/stable/c/b5120d322763c15c978bc47beb3b6dff45624304 https://git.kernel.org/stable/c/aa2d3d678895c8eedd003f1473f87d3f06fe6ec7 https://git.kernel.org/stable/c/81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2024-38567 – wifi: carl9170: add a proper sanity check for endpoints
https://notcve.org/view.php?id=CVE-2024-38567
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: add a proper sanity check for endpoints Syzkaller reports [1] hitting a warning which is caused by presence of a wrong endpoint type at the URB sumbitting stage. While there was a check for a specific 4th endpoint, since it can switch types between bulk and interrupt, other endpoints are trusted implicitly. Similar warning is triggered in a couple of other syzbot issues [2]. Fix the issue by doing a comprehensive check of all endpoints taking into account difference between high- and full-speed configuration. [1] Syzkaller report: ... WARNING: CPU: 0 PID: 4721 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace: <TASK> carl9170_usb_send_rx_irq_urb+0x273/0x340 drivers/net/wireless/ath/carl9170/usb.c:504 carl9170_usb_init_device drivers/net/wireless/ath/carl9170/usb.c:939 [inline] carl9170_usb_firmware_finish drivers/net/wireless/ath/carl9170/usb.c:999 [inline] carl9170_usb_firmware_step2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028 request_firmware_work_func+0x130/0x240 drivers/base/firmware_loader/main.c:1107 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 </TASK> [2] Related syzkaller crashes: En el kernel de Linux, se resolvió la siguiente vulnerabilidad: wifi: carl9170: agregue una verificación de integridad adecuada para los endpoints Syzkaller informa [1] que aparece una advertencia causada por la presencia de un tipo de endpoint incorrecto en la etapa de envío de URB. Si bien hubo una verificación para un cuarto endpoint específico, dado que puede cambiar de tipo entre masivo e interrupción, se confía implícitamente en otros endpoints. Se activa una advertencia similar en un par de otros problemas de syzbot [2]. Solucione el problema realizando una verificación exhaustiva de todos los endpoints teniendo en cuenta la diferencia entre la configuración de alta y máxima velocidad. [1] Informe de Syzkaller: ... • https://git.kernel.org/stable/c/a84fab3cbfdc427e7d366f1cc844f27b2084c26c https://git.kernel.org/stable/c/eb0f2fc3ff5806cc572cd9055ce7c52a01e97645 https://git.kernel.org/stable/c/ac3ed46a8741d464bc70ebdf7433c1d786cf329d https://git.kernel.org/stable/c/8650725bb0a48b206d5a8ddad3a7488f9a5985b7 https://git.kernel.org/stable/c/6a9892bf24c906b4d6b587f8759ca38bff672582 https://git.kernel.org/stable/c/265c3cda471c26e0f25d0c755da94e1eb15d7a0c https://git.kernel.org/stable/c/62eb07923f3693d55b0c2d9a5a4f1ad72cb6b8fd https://git.kernel.org/stable/c/03ddc74bdfd71b84a55c9f2185d8787f2 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2024-38566 – bpf: Fix verifier assumptions about socket->sk
https://notcve.org/view.php?id=CVE-2024-38566
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix verifier assumptions about socket->sk The verifier assumes that 'sk' field in 'struct socket' is valid and non-NULL when 'socket' pointer itself is trusted and non-NULL. That may not be the case when socket was just created and passed to LSM socket_accept hook. Fix this verifier assumption and adjust tests. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bpf: corrige las suposiciones del verificador sobre socket->sk. El verificador asume que el campo 'sk' en 'struct socket' es válido y no NULL cuando el puntero 'socket' en sí es confiable y no NULL. Puede que ese no sea el caso cuando el socket se acaba de crear y se pasó al gancho LSM socket_accept. Corrija esta suposición del verificador y ajuste las pruebas. • https://git.kernel.org/stable/c/6fcd486b3a0a628c41f12b3a7329a18a2c74b351 https://git.kernel.org/stable/c/39f8a29330f433000e716eefc4b9abda05b71a82 https://git.kernel.org/stable/c/6f5ae91172a93abac9720ba94edf3ec8f4d7f24f https://git.kernel.org/stable/c/c58ccdd2483a1d990748cdaf94206b5d5986a001 https://git.kernel.org/stable/c/0db63c0b86e981a1e97d2596d64ceceba1a5470e •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2024-38565 – wifi: ar5523: enable proper endpoint verification
https://notcve.org/view.php?id=CVE-2024-38565
In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: enable proper endpoint verification Syzkaller reports [1] hitting a warning about an endpoint in use not having an expected type to it. Fix the issue by checking for the existence of all proper endpoints with their according types intact. Sadly, this patch has not been tested on real hardware. [1] Syzkaller report: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 3643 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace: <TASK> ar5523_cmd+0x41b/0x780 drivers/net/wireless/ath/ar5523/ar5523.c:275 ar5523_cmd_read drivers/net/wireless/ath/ar5523/ar5523.c:302 [inline] ar5523_host_available drivers/net/wireless/ath/ar5523/ar5523.c:1376 [inline] ar5523_probe+0x14b0/0x1d10 drivers/net/wireless/ath/ar5523/ar5523.c:1655 usb_probe_interface+0x30f/0x7f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xb90 drivers/base/dd.c:639 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427 __device_attach+0x1e4/0x530 drivers/base/dd.c:1008 bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487 device_add+0xbd9/0x1e90 drivers/base/core.c:3517 usb_set_configuration+0x101d/0x1900 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0xbe/0x100 drivers/usb/core/generic.c:238 usb_probe_device+0xd8/0x2c0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xb90 drivers/base/dd.c:639 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427 __device_attach+0x1e4/0x530 drivers/base/dd.c:1008 bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487 device_add+0xbd9/0x1e90 drivers/base/core.c:3517 usb_new_device.cold+0x685/0x10ad drivers/usb/core/hub.c:2573 hub_port_connect drivers/usb/core/hub.c:5353 [inline] hub_port_connect_change drivers/usb/core/hub.c:5497 [inline] port_event drivers/usb/core/hub.c:5653 [inline] hub_event+0x26cb/0x45d0 drivers/usb/core/hub.c:5735 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> En el kernel de Linux, se resolvió la siguiente vulnerabilidad: wifi: ar5523: habilite la verificación adecuada del endpoint Syzkaller informa [1] que aparece una advertencia sobre un endpoint en uso que no tiene el tipo esperado. Solucione el problema verificando la existencia de todos los endpoints adecuados con sus tipos correspondientes intactos. Lamentablemente, este parche no se ha probado en hardware real. [1] Informe Syzkaller: ------------[ cortar aquí ]------------ usb 1-1: BOGUS urb xfer, tubería 3 != tipo 1 ADVERTENCIA : CPU: 0 PID: 3643 en drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... • https://git.kernel.org/stable/c/b7d572e1871df06a96a1c9591c71c5494ff6b624 https://git.kernel.org/stable/c/79ddf5f2020fd593d50f1363bb5131283d74f78f https://git.kernel.org/stable/c/68a5a00c5d38978a3f8460c6f182f7beec8688ff https://git.kernel.org/stable/c/ee25389df80138907bc9dcdf4a2be2067cde9a81 https://git.kernel.org/stable/c/b4c24de37a6bb383394a6fef2b85a6db41d426f5 https://git.kernel.org/stable/c/34f7ebff1b9699e0b89fa58b693bc098c2f5ec72 https://git.kernel.org/stable/c/b33a81e4ecfb022b028cae37d1c1ce28ac1b359d https://git.kernel.org/stable/c/beeed260b92af158592f5e8d2dab65dae •
CVSS: 4.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-38564 – bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
https://notcve.org/view.php?id=CVE-2024-38564
In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses bpf_prog_get and relies on bpf_prog_attach_check_attach_type to properly verify prog_type <> attach_type association. Add missing attach_type enforcement for the link_create case. Otherwise, it's currently possible to attach cgroup_skb prog types to other cgroup hooks. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bpf: agregue la aplicación del tipo de archivo adjunto BPF_PROG_TYPE_CGROUP_SKB en BPF_LINK_CREATE bpf_prog_attach usa adjunto_type_to_prog_type para aplicar el tipo de archivo adjunto adecuado para BPF_PROG_TYPE_CGROUP_SKB. link_create usa bpf_prog_get y se basa en bpf_prog_attach_check_attach_type para verificar correctamente la asociación prog_type <> adjunto_tipo. Agregue la aplicación de adjunto_tipo faltante para el caso link_create. De lo contrario, actualmente es posible adjuntar tipos de programa cgroup_skb a otros enlaces de cgroup. • https://git.kernel.org/stable/c/4a1e7c0c63e02daad751842b7880f9bbcdfb6e89 https://git.kernel.org/stable/c/6675c541f540a29487a802d3135280b69b9f568d https://git.kernel.org/stable/c/67929e973f5a347f05fef064fea4ae79e7cdb5fd https://git.kernel.org/stable/c/b34bbc76651065a5eafad8ddff1eb8d1f8473172 https://git.kernel.org/stable/c/543576ec15b17c0c93301ac8297333c7b6e84ac7 https://access.redhat.com/security/cve/CVE-2024-38564 https://bugzilla.redhat.com/show_bug.cgi?id=2293429 • CWE-665: Improper Initialization •