CVSS: -EPSS: 0%CPEs: 10EXPL: 0CVE-2023-52515 – RDMA/srp: Do not call scsi_done() from srp_abort()
https://notcve.org/view.php?id=CVE-2023-52515
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned. • https://git.kernel.org/stable/c/d8536670916a685df116b5c2cb256573fd25e4e3 https://git.kernel.org/stable/c/738589592a04180e39b6fb5fe8205d85b7dc69f6 https://git.kernel.org/stable/c/0575df129e2eb4a801beae0e6e041787480f42b9 https://git.kernel.org/stable/c/22fb582405002812d8fb89d0ed1264e97d3d25ad https://git.kernel.org/stable/c/39d6594c457c4728794cb4c3c7be53f93f1ef3ae https://git.kernel.org/stable/c/b3f3b814add77a464911df0080d812b18f61ff38 https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42c •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52511 – spi: sun6i: reduce DMA RX transfer width to single byte
https://notcve.org/view.php?id=CVE-2023-52511
In the Linux kernel, the following vulnerability has been resolved: spi: sun6i: reduce DMA RX transfer width to single byte Through empirical testing it has been determined that sometimes RX SPI transfers with DMA enabled return corrupted data. This is down to single or even multiple bytes lost during DMA transfer from SPI peripheral to memory. It seems the RX FIFO within the SPI peripheral can become confused when performing bus read accesses wider than a single byte to it during an active SPI transfer. This patch reduces the width of individual DMA read accesses to the RX FIFO to a single byte to mitigate that issue. • https://git.kernel.org/stable/c/ff05ed4ae214011464a0156f05cac1b0b46b5fbc https://git.kernel.org/stable/c/e15bb292b24630ee832bfc7fd616bd72c7682bbb https://git.kernel.org/stable/c/b3c21c9c7289692f4019f163c3b06d8bdf78b355 https://git.kernel.org/stable/c/171f8a49f212e87a8b04087568e1b3d132e36a18 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2023-52509 – ravb: Fix use-after-free issue in ravb_tx_timeout_work()
https://notcve.org/view.php?id=CVE-2023-52509
In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // free priv ravb_tx_timeout_work() // use priv unregister_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is also called. So that .ndo_tx_timeout() will not be called after phy_stop(). • https://git.kernel.org/stable/c/c156633f1353264634135dea86ffcae74f2122fc https://git.kernel.org/stable/c/65d34cfd4e347054eb4193bc95d9da7eaa72dee5 https://git.kernel.org/stable/c/db9aafa19547833240f58c2998aed7baf414dc82 https://git.kernel.org/stable/c/616761cf9df9af838c0a1a1232a69322a9eb67e6 https://git.kernel.org/stable/c/6f6fa8061f756aedb93af12a8a5d3cf659127965 https://git.kernel.org/stable/c/105abd68ad8f781985113aee2e92e0702b133705 https://git.kernel.org/stable/c/3971442870713de527684398416970cf025b4f89 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52508 – nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()
https://notcve.org/view.php?id=CVE-2023-52508
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() The nvme_fc_fcp_op structure describing an AEN operation is initialized with a null request structure pointer. An FC LLDD may make a call to nvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation. Add validation of the request structure pointer before dereference. • https://git.kernel.org/stable/c/be90c9e29dd59b7d19a73297a1590ff3ec1d22ea https://git.kernel.org/stable/c/dd46b3ac7322baf3772b33b29726e94f98289db7 https://git.kernel.org/stable/c/8ae5b3a685dc59a8cf7ccfe0e850999ba9727a3c • CWE-476: NULL Pointer Dereference •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2023-52507 – nfc: nci: assert requested protocol is valid
https://notcve.org/view.php?id=CVE-2023-52507
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: assert requested protocol is valid The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. • https://git.kernel.org/stable/c/6a2968aaf50c7a22fced77a5e24aa636281efca8 https://git.kernel.org/stable/c/2c231a247a1d1628e41fa1eefd1a5307c41c5f53 https://git.kernel.org/stable/c/a686f84101680b8442181a8846fbd3c934653729 https://git.kernel.org/stable/c/95733ea130e35ef9ec5949a5908dde3feaba92cb https://git.kernel.org/stable/c/a424807d860ba816aaafc3064b46b456361c0802 https://git.kernel.org/stable/c/25dd54b95abfdca423b65a4ee620a774777d8213 https://git.kernel.org/stable/c/853dda54ba59ea70d5580a298b7ede4707826848 https://git.kernel.org/stable/c/6584eba7688dcf999542778b07f63828c •