CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47108 – drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf
https://notcve.org/view.php?id=CVE-2021-47108
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf In commit 41ca9caaae0b ("drm/mediatek: hdmi: Add check for CEA modes only") a check for CEA modes was added to function mtk_hdmi_bridge_mode_valid() in order to address possible issues on MT8167; moreover, with commit c91026a938c2 ("drm/mediatek: hdmi: Add optional limit on maximal HDMI mode clock") another similar check was introduced. Unfortunately though, at the time of wri... • https://git.kernel.org/stable/c/41ca9caaae0bfc959b22dbcd59d88a7107707e17 •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47107 – NFSD: Fix READDIR buffer overflow
https://notcve.org/view.php?id=CVE-2021-47107
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix READDIR buffer overflow If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the ... • https://git.kernel.org/stable/c/7f87fc2d34d475225e78b7f5c4eabb121f4282b2 •
CVSS: 6.6EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47106 – netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
https://notcve.org/view.php?id=CVE-2021-47106
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy() We need to use list_for_each_entry_safe() iterator because we can not access @catchall after kfree_rcu() call. syzbot reported: BUG: KASAN: use-after-free in nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4486 [inline] BUG: KASAN: use-after-free in nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline] BUG: KASAN: use-after-free in nft_set_destroy+0x3fd/0x4f... • https://git.kernel.org/stable/c/aaa31047a6d25da0fa101da1ed544e1247949b40 •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47105 – ice: xsk: return xsk buffers back to pool when cleaning the ring
https://notcve.org/view.php?id=CVE-2021-47105
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: ice: xsk: return xsk buffers back to pool when cleaning the ring Currently we only NULL the xdp_buff pointer in the internal SW ring but we never give it back to the xsk buffer pool. This means that buffers can be leaked out of the buff pool and never be used again. Add missing xsk_buff_free() call to the routine that is supposed to clean the entries that are left in the ring so that these buffers in the umem can be used by other sockets. A... • https://git.kernel.org/stable/c/2d4238f5569722197612656163d824098208519c •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2021-47104 – IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
https://notcve.org/view.php?id=CVE-2021-47104
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() The wrong goto label was used for the error case and missed cleanup of the pkt allocation. Addresses-Coverity-ID: 1493352 ("Resource leak") En el kernel de Linux, se resolvió la siguiente vulnerabilidad: IB/qib: corrige la pérdida de memoria en qib_user_sdma_queue_pkts() Se utilizó la etiqueta goto incorrecta para el caso de error y se omitió la limpieza de la asignación de paquetes. Dir... • https://git.kernel.org/stable/c/bda41654b6e0c125a624ca35d6d20beb8015b5d0 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-47103 – inet: fully convert sk->sk_rx_dst to RCU rules
https://notcve.org/view.php?id=CVE-2021-47103
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearly documenting it. And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv() are not following standard RCU rules. [a] dst_release(dst); [b] sk->sk_rx_dst = NULL; They look wrong because a delete operation of RCU protected pointer is supposed to clear t... • https://git.kernel.org/stable/c/41063e9dd11956f2d285e12e4342e1d232ba0ea2 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47102 – net: marvell: prestera: fix incorrect structure access
https://notcve.org/view.php?id=CVE-2021-47102
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix incorrect structure access In line: upper = info->upper_dev; We access upper_dev field, which is related only for particular events (e.g. event == NETDEV_CHANGEUPPER). So, this line cause invalid memory access for another events, when ptr is not netdev_notifier_changeupper_info. The KASAN logs are as follows: [ 30.123165] BUG: KASAN: stack-out-of-bounds in prestera_netdev_port_event.constprop.0+0x68/0x538 [preste... • https://git.kernel.org/stable/c/3d5048cc54bd250cfbb358c37fcc011135977887 •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47101 – asix: fix uninit-value in asix_mdio_read()
https://notcve.org/view.php?id=CVE-2021-47101
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: asix: fix uninit-value in asix_mdio_read() asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be uninitialized. Fail log: BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 BUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/a... • https://git.kernel.org/stable/c/d9fe64e511144c1ee7d7555b4111f09dde9692ef • CWE-457: Use of Uninitialized Variable •
CVSS: 4.4EPSS: 0%CPEs: 5EXPL: 0CVE-2021-47100 – ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
https://notcve.org/view.php?id=CVE-2021-47100
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module Hi, When testing install and uninstall of ipmi_si.ko and ipmi_msghandler.ko, the system crashed. The log as follows: [ 141.087026] BUG: unable to handle kernel paging request at ffffffffc09b3a5a [ 141.087241] PGD 8fe4c0d067 P4D 8fe4c0d067 PUD 8fe4c0f067 PMD 103ad89067 PTE 0 [ 141.087464] Oops: 0010 [#1] SMP NOPTI [ 141.087580] CPU: 67 PID: 668 Comm: kworker/67:1 Kdump: loaded N... • https://git.kernel.org/stable/c/b2cfd8ab4add53c2070367bfee2f5b738f51698d •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2021-47099 – veth: ensure skb entering GRO are not cloned.
https://notcve.org/view.php?id=CVE-2021-47099
04 Mar 2024 — In the Linux kernel, the following vulnerability has been resolved: veth: ensure skb entering GRO are not cloned. After commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP"), if GRO is enabled on a veth device and TSO is disabled on the peer device, TCP skbs will go through the NAPI callback. If there is no XDP program attached, the veth code does not perform any share check, and shared/cloned skbs could enter the GRO engine. Ignat reported a BUG triggered later-on due to the above condition: [... • https://git.kernel.org/stable/c/d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c • CWE-20: Improper Input Validation •