CVSS: 5.6EPSS: %CPEs: 2EXPL: 0CVE-2024-57793 – virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
https://notcve.org/view.php?id=CVE-2024-57793
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. Leak the decrypted memory when set_memory_decrypted... • https://git.kernel.org/stable/c/f4738f56d1dc62aaba69b33702a5ab098f1b8c63 •
CVSS: 5.5EPSS: %CPEs: 6EXPL: 0CVE-2024-57792 – power: supply: gpio-charger: Fix set charge current limits
https://notcve.org/view.php?id=CVE-2024-57792
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: power: supply: gpio-charger: Fix set charge current limits Fix set charge current limits for devices which allow to set the lowest charge current limit to be greater zero. If requested charge current limit is below lowest limit, the index equals current_limit_map_size which leads to accessing memory beyond allocated memory. In the Linux kernel, the following vulnerability has been resolved: power: supply: gpio-charger: Fix set charge curren... • https://git.kernel.org/stable/c/be2919d8355e4651386ad2fb61ddb6efe4533b1b •
CVSS: 5.5EPSS: %CPEs: 6EXPL: 0CVE-2024-57791 – net/smc: check return value of sock_recvmsg when draining clc data
https://notcve.org/view.php?id=CVE-2024-57791
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: net/smc: check return value of sock_recvmsg when draining clc data When receiving clc msg, the field length in smc_clc_msg_hdr indicates the length of msg should be received from network and the value should not be fully trusted as it is from the network. Once the value of length exceeds the value of buflen in function smc_clc_wait_msg it may run into deadloop when trying to drain the remaining data exceeding buflen. This patch checks the r... • https://git.kernel.org/stable/c/fb4f79264c0fc6fd5a68ffe3e31bfff97311e1f1 •
CVSS: 6.8EPSS: %CPEs: 3EXPL: 0CVE-2024-56372 – net: tun: fix tun_napi_alloc_frags()
https://notcve.org/view.php?id=CVE-2024-56372
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: net: tun: fix tun_napi_alloc_frags() syzbot reported the following crash [1] Issue came with the blamed commit. Instead of going through all the iov components, we keep using the first one and end up with a malformed skb. [1] kernel BUG at net/core/skbuff.c:2849 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 6230 Comm: syz-executor132 Not tainted 6.13.0-rc1-syzkaller-00407-g96b6fcc0ee41 #0 Hardware name: Google G... • https://git.kernel.org/stable/c/de4f5fed3f231a8ff4790bf52975f847b95b85ea •
CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2024-56369 – drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
https://notcve.org/view.php?id=CVE-2024-56369
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() drm_mode_vrefresh() is trying to avoid divide by zero by checking whether htotal or vtotal are zero. But we may still end up with a div-by-zero of vtotal*htotal*... In the Linux kernel, the following vulnerability has been resolved: drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() drm_mode_vrefresh() is trying to avoid divide by zero by checking whether htotal or vto... • https://git.kernel.org/stable/c/e7c7b48a0fc5ed83baae400a1b15e33978c25d7f •
CVSS: 7.2EPSS: %CPEs: 2EXPL: 0CVE-2024-56368 – ring-buffer: Fix overflow in __rb_map_vma
https://notcve.org/view.php?id=CVE-2024-56368
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix overflow in __rb_map_vma An overflow occurred when performing the following calculation: nr_pages = ((nr_subbufs + 1) << subbuf_order) - pgoff; Add a check before the calculation to avoid this problem. syzbot reported this as a slab-out-of-bounds in __rb_map_vma: BUG: KASAN: slab-out-of-bounds in __rb_map_vma+0x9ab/0xae0 kernel/trace/ring_buffer.c:7058 Read of size 8 at addr ffff8880767dd2b8 by task syz-executor187/5836 CPU... • https://git.kernel.org/stable/c/117c39200d9d760cbd5944bb89efb7b9c51965aa •
CVSS: 4.7EPSS: %CPEs: 7EXPL: 0CVE-2024-55916 – Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
https://notcve.org/view.php?id=CVE-2024-55916
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet If the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is fully initialized, we can hit the panic below: hv_utils: Registering HyperV Utility Driver hv_vmbus: registering driver hv_utils ... BUG: kernel NULL pointer dereference, address: 0000000000000000 CPU: 44 UID: 0 PID: 2552 Comm: hv_kvp_daemon Tainted: G E 6.11.0-rc3+ #1 RIP: 0010:hv_pkt_iter_first+0x1... • https://git.kernel.org/stable/c/e0fa3e5e7df61eb2c339c9f0067c202c0cdeec2c •
CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2024-55881 – KVM: x86: Play nice with protected guests in complete_hypercall_exit()
https://notcve.org/view.php?id=CVE-2024-55881
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Play nice with protected guests in complete_hypercall_exit() Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For guests with protected state, e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit mode as the vCPU state needed to detect 64-bit mode is unavailable. Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE hypercall vi... • https://git.kernel.org/stable/c/5969e2435cbd7f0ce8c28d717bfc39987ee8d8f1 •
CVSS: 9.4EPSS: %CPEs: 4EXPL: 0CVE-2024-54680 – smb: client: fix TCP timers deadlock after rmmod
https://notcve.org/view.php?id=CVE-2024-54680
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: smb: client: fix TCP timers deadlock after rmmod Commit ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") fixed a netns UAF by manually enabled socket refcounting (sk->sk_net_refcnt=1 and sock_inuse_add(net, 1)). The reason the patch worked for that bug was because we now hold references to the netns (get_net_track() gets a ref internally) and they're properly released (internally, on __sk_destruct()), but only because ... • https://git.kernel.org/stable/c/e8c71494181153a134c96da28766a57bd1eac8cb •
CVSS: 5.6EPSS: %CPEs: 2EXPL: 0CVE-2024-54455 – accel/ivpu: Fix general protection fault in ivpu_bo_list()
https://notcve.org/view.php?id=CVE-2024-54455
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix general protection fault in ivpu_bo_list() Check if ctx is not NULL before accessing its fields. • https://git.kernel.org/stable/c/37dee2a2f4330a030abc5674bcec25ccc4addbcc •