CVSS: 7.8EPSS: %CPEs: 3EXPL: 0CVE-2024-49568 – net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
https://notcve.org/view.php?id=CVE-2024-49568
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field v2_ext_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt before using th... • https://git.kernel.org/stable/c/8c3dca341aea885249e08856c4380300b75d2cf5 •
CVSS: 7.8EPSS: %CPEs: 5EXPL: 0CVE-2024-47408 – net/smc: check smcd_v2_ext_offset when receiving proposal msg
https://notcve.org/view.php?id=CVE-2024-47408
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: net/smc: check smcd_v2_ext_offset when receiving proposal msg When receiving proposal msg in server, the field smcd_v2_ext_offset in proposal msg is from the remote client and can not be fully trusted. Once the value of smcd_v2_ext_offset exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the value of smcd_v2_ext_offset before using it. In the Linux kernel, the following vulnerability... • https://git.kernel.org/stable/c/5c21c4ccafe85906db809de3af391fd434df8a27 •
CVSS: 5.5EPSS: %CPEs: 3EXPL: 0CVE-2024-54683 – netfilter: IDLETIMER: Fix for possible ABBA deadlock
https://notcve.org/view.php?id=CVE-2024-54683
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: netfilter: IDLETIMER: Fix for possible ABBA deadlock Deletion of the last rule referencing a given idletimer may happen at the same time as a read of its file in sysfs: | ====================================================== | WARNING: possible circular locking dependency detected | 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted | ------------------------------------------------------ | iptables/3303 is trying to acquire lock: | fff... • https://git.kernel.org/stable/c/0902b469bd25065aa0688c3cee6f11744c817e7c •
CVSS: 5.5EPSS: %CPEs: 3EXPL: 0CVE-2024-53687 – riscv: Fix IPIs usage in kfence_protect_page()
https://notcve.org/view.php?id=CVE-2024-53687
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: riscv: Fix IPIs usage in kfence_protect_page() flush_tlb_kernel_range() may use IPIs to flush the TLBs of all the cores, which triggers the following warning when the irqs are disabled: [ 3.455330] WARNING: CPU: 1 PID: 0 at kernel/smp.c:815 smp_call_function_many_cond+0x452/0x520 [ 3.456647] Modules linked in: [ 3.457218] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7-00010-g91d3de7240b8 #1 [ 3.457416] Hardware name: QEMU QEMU ... • https://git.kernel.org/stable/c/47513f243b452a5e21180dcf3d6ac1c57e1781a6 •
CVSS: 7.1EPSS: %CPEs: 7EXPL: 0CVE-2024-53680 – ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
https://notcve.org/view.php?id=CVE-2024-53680
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() Under certain kernel configurations when building with Clang/LLVM, the compiler does not generate a return or jump as the terminator instruction for ip_vs_protocol_init(), triggering the following objtool warning during build time: vmlinux.o: warning: objtool: ip_vs_protocol_init() falls through to next function __initstub__kmod_ip_vs_rr__935_123_ip_vs_rr_init6() At run... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 5.5EPSS: %CPEs: 7EXPL: 0CVE-2024-52332 – igb: Fix potential invalid memory access in igb_init_module()
https://notcve.org/view.php?id=CVE-2024-52332
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: igb: Fix potential invalid memory access in igb_init_module() The pci_register_driver() can fail and when this happened, the dca_notifier needs to be unregistered, otherwise the dca_notifier can be called when igb fails to install, resulting to invalid memory access. In the Linux kernel, the following vulnerability has been resolved: igb: Fix potential invalid memory access in igb_init_module() The pci_register_driver() can fail and when th... • https://git.kernel.org/stable/c/bbd98fe48a43464b4a044bc4cbeefad284d6aa80 •
CVSS: 5.5EPSS: %CPEs: 7EXPL: 0CVE-2024-50051 – spi: mpc52xx: Add cancel_work_sync before module remove
https://notcve.org/view.php?id=CVE-2024-50051
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Add cancel_work_sync before module remove If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work will be used. The sequence of operations that may lead to a UAF bug. Fix it by ensuring that the work is canceled before proceeding with the cleanup in mpc52xx_spi_remove. In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx... • https://git.kernel.org/stable/c/ca632f556697d45d67ed5cada7cedf3ddfe0db4b •
CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2024-49569 – nvme-rdma: unquiesce admin_q before destroy it
https://notcve.org/view.php?id=CVE-2024-49569
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: unquiesce admin_q before destroy it Kernel will hang on destroy admin_q while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15 #1 [ff61d23de260fc08] schedule at ffffffff8323c014 #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1 #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a #4 [ff61d23de260... • https://git.kernel.org/stable/c/958dc1d32c80566f58d18f05ef1f05bd32d172c1 •
CVSS: 7.2EPSS: %CPEs: 9EXPL: 0CVE-2024-48881 – bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
https://notcve.org/view.php?id=CVE-2024-48881
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations") leads a NULL pointer deference in cache_set_flush(). 1721 if (!IS_ERR_OR_NULL(c->root)) 1722 list_add(&c->root->list, &c->btree_cache); >From the above code in cache_set_flush(), if previous registration code fails before allocating c->root, it is possible c->root is NULL as what it is initialized... • https://git.kernel.org/stable/c/0729029e647234fa1a94376b6edffec5c2cd75f6 •
CVSS: 5.5EPSS: %CPEs: 3EXPL: 0CVE-2024-48875 – btrfs: don't take dev_replace rwsem on task already holding it
https://notcve.org/view.php?id=CVE-2024-48875
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: btrfs: don't take dev_replace rwsem on task already holding it Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of the RAID stripe-tree, we get the following splat from lockdep: BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started ============================================ WARNING: possible recursive locking detected 6.11.0-rc3-btrfs-for-next #599 Not tainted -----------------------------... • https://git.kernel.org/stable/c/a5bc4e030f50fdbb1fbc69acc1e0c5f57c79d044 •