CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-27417 – ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
https://notcve.org/view.php?id=CVE-2024-27417
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_getaddr() returns -EINVAL with an elevated "struct net" refcount. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ipv6: soluciona una posible fuga de "struct net" en inet6_rtm_getaddr() Parece que si el espacio de usuario proporciona un valor IFA_TARGET_NETNSID correcto pero no los atributos IFA_ADDRESS e IFA_LOCAL, inet6_rtm_getaddr() devuelve -EINVAL con un recuento elevado de "estructura neta". • https://git.kernel.org/stable/c/6ecf4c37eb3e89b0832c9616089a5cdca3747da7 https://git.kernel.org/stable/c/9d4ffb5b9d879a75e4f7460e8b10e756b4dfb132 https://git.kernel.org/stable/c/810fa7d5e5202fcfb22720304b755f1bdfd4c174 https://git.kernel.org/stable/c/8a54834c03c30e549c33d5da0975f3e1454ec906 https://git.kernel.org/stable/c/1b0998fdd85776775d975d0024bca227597e836a https://git.kernel.org/stable/c/44112bc5c74e64f28f5a9127dc34066c7a09bd0f https://git.kernel.org/stable/c/33a1b6bfef6def2068c8703403759024ce17053e https://git.kernel.org/stable/c/10bfd453da64a057bcfd1a49fb6b271c4 •
CVSS: -EPSS: 0%CPEs: 10EXPL: 0CVE-2024-27416 – Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
https://notcve.org/view.php?id=CVE-2024-27416
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST If we received HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote does support SSP since otherwise this event shouldn't be generated. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Bluetooth: hci_event: Corrige el manejo de HCI_EV_IO_CAPA_REQUEST Si recibimos HCI_EV_IO_CAPA_REQUEST mientras HCI_OP_READ_REMOTE_EXT_FEATURES aún no se ha respondido, supongamos que el control remoto admite SSP ya que, de lo contrario, este evento no debería generarse. • https://git.kernel.org/stable/c/ccb8618c972f941ebc6b2b9db491025b3369efcb https://git.kernel.org/stable/c/1769ac55dbf3114d5bf79f11bd5dca80ee263f9c https://git.kernel.org/stable/c/40a33a129d99639921ce00d274cca44ba282f1ac https://git.kernel.org/stable/c/1ef071526848cc3109ade63268854cd7c20ece0c https://git.kernel.org/stable/c/25e5d2883002e235f3378b8592aad14aeeef898c https://git.kernel.org/stable/c/c7f59461f5a78994613afc112cdd73688aef9076 https://git.kernel.org/stable/c/2c7f9fda663a1b31a61744ffc456bdb89c4efc7f https://git.kernel.org/stable/c/746dbb0fc6392eca23de27f8aa9d13979 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-27415 – netfilter: bridge: confirm multicast packets before passing them up the stack
https://notcve.org/view.php?id=CVE-2024-27415
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: confirm multicast packets before passing them up the stack conntrack nf_confirm logic cannot handle cloned skbs referencing the same nf_conn entry, which will happen for multicast (broadcast) frames on bridges. Example: macvlan0 | br0 / \ ethX ethY ethX (or Y) receives a L2 multicast or broadcast packet containing an IP packet, flow is not yet in conntrack table. 1. skb passes through bridge and fake-ip (br_netfilter)Prerouting. -> skb->_nfct now references a unconfirmed entry 2. skb is broad/mcast packet. bridge now passes clones out on each bridge interface. 3. skb gets passed up the stack. 4. In macvlan case, macvlan driver retains clone(s) of the mcast skb and schedules a work queue to send them out on the lower devices. The clone skb->_nfct is not a copy, it is the same entry as the original skb. The macvlan rx handler then returns RX_HANDLER_PASS. 5. Normal conntrack hooks (in NF_INET_LOCAL_IN) confirm the orig skb. The Macvlan broadcast worker and normal confirm path will race. This race will not happen if step 2 already confirmed a clone. In that case later steps perform skb_clone() with skb->_nfct already confirmed (in hash table). • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 https://git.kernel.org/stable/c/7c3f28599652acf431a2211168de4a583f30b6d5 https://git.kernel.org/stable/c/2b1414d5e94e477edff1d2c79030f1d742625ea0 https://git.kernel.org/stable/c/80cd0487f630b5382734997c3e5e3003a77db315 https://git.kernel.org/stable/c/cb734975b0ffa688ff6cc0eed463865bf07b6c01 https://git.kernel.org/stable/c/62e7151ae3eb465e0ab52a20c941ff33bb6332e9 https://access.redhat.com/security/cve/CVE-2024-27415 https://bugzilla.redhat.com/show_bug.cgi?id=2281101 •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2024-27413 – efi/capsule-loader: fix incorrect allocation size
https://notcve.org/view.php?id=CVE-2024-27413
In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); | ^ Use the correct type instead here. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: efi/capsule-loader: corrige el tamaño de asignación incorrecto gcc-14 advierte que la asignación con sizeof(void) en arquitecturas de 32 bits no es suficiente para phys_addr_t: drivers de 64 bits /firmware/efi/capsule-loader.c: En función 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: asignación de tamaño '4' insuficiente para el tipo 'phys_addr_t' {alias ' long long unsigned int'} con tamaño '8' [-Werror=alloc-size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); | ^ Utilice el tipo correcto aquí. • https://git.kernel.org/stable/c/f24c4d478013d82bd1b943df566fff3561d52864 https://git.kernel.org/stable/c/95a362c9a6892085f714eb6e31eea6a0e3aa93bf https://git.kernel.org/stable/c/00cf21ac526011a29fc708f8912da446fac19f7b https://git.kernel.org/stable/c/950d4d74d311a18baed6878dbfba8180d7e5dddd https://git.kernel.org/stable/c/537e3f49dbe88881a6f0752beaa596942d9efd64 https://git.kernel.org/stable/c/4b73473c050a612fb4317831371073eda07c3050 https://git.kernel.org/stable/c/ddc547dd05a46720866c32022300f7376c40119f https://git.kernel.org/stable/c/11aabd7487857b8e7d768fefb092f66df •
CVSS: -EPSS: 0%CPEs: 10EXPL: 0CVE-2024-27412 – power: supply: bq27xxx-i2c: Do not free non existing IRQ
https://notcve.org/view.php?id=CVE-2024-27412
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do not free non existing IRQ The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxx_battery_i2c_probe() already has an if (client->irq) check wrapping the request_threaded_irq(). But bq27xxx_battery_i2c_remove() unconditionally calls free_irq(client->irq) leading to: [ 190.310742] ------------[ cut here ]------------ [ 190.310843] Trying to free already-free IRQ 0 [ 190.310861] WARNING: CPU: 2 PID: 1304 at kernel/irq/manage.c:1893 free_irq+0x1b8/0x310 Followed by a backtrace when unbinding the driver. Add an if (client->irq) to bq27xxx_battery_i2c_remove() mirroring probe() to fix this. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: alimentación: suministro: bq27xxx-i2c: no liberar IRQ no existente Es posible que el cliente bq27xxx i2c no tenga una IRQ, en cuyo caso client->irq será 0. bq27xxx_battery_i2c_probe( ) ya tiene una verificación if (cliente->irq) que envuelve request_threaded_irq(). Pero bq27xxx_battery_i2c_remove() llama incondicionalmente a free_irq(cliente->irq) lo que lleva a: [190.310742] ------------[ cortar aquí ]------------ [ 190.310843] Intentando liberar IRQ 0 [190.310861] que ya está libre ADVERTENCIA: CPU: 2 PID: 1304 en kernel/irq/manage.c:1893 free_irq+0x1b8/0x310 Seguido de un seguimiento al desvincular el controlador. Agregue un if (cliente->irq) a bq27xxx_battery_i2c_remove() mirroring probe() para solucionar este problema. • https://git.kernel.org/stable/c/76d2ed844def0cb8704d766924b07b2a918b3e30 https://git.kernel.org/stable/c/dafe9136be7b7fc30f1f3ca410c15b7cc65bee44 https://git.kernel.org/stable/c/1da9a4b55a6688e3a30c16d0cf2e7c6a90a684fb https://git.kernel.org/stable/c/e01820a94aea99296e500f54b3f36a2985061045 https://git.kernel.org/stable/c/e65fee45687fa2109e03056a696dc7d68a151296 https://git.kernel.org/stable/c/444ff00734f3878cd54ddd1ed5e2e6dbea9326d5 https://git.kernel.org/stable/c/ca4a2ddd2e69ca82ca5992d4c49649b2cbac3b74 https://git.kernel.org/stable/c/28960625adaaf3fa3d83c8d3596661d25 •