CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35860 – bpf: support deferring bpf_link dealloc to after RCU grace period
https://notcve.org/view.php?id=CVE-2024-35860
In the Linux kernel, the following vulnerability has been resolved: bpf: support deferring bpf_link dealloc to after RCU grace period BPF link for some program types is passed as a "context" which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and multi-uprobes, link is used to fetch BPF cookie values. Because of this runtime dependency, when bpf_link refcnt drops to zero there could still be active BPF programs running accessing link data. This patch adds generic support to defer bpf_link dealloc callback to after RCU GP, if requested. This is done by exposing two different deallocation callbacks, one synchronous and one deferred. If deferred one is provided, bpf_link_free() will schedule dealloc_deferred() callback to happen after RCU GP. BPF is using two flavors of RCU: "classic" non-sleepable one and RCU tasks trace one. The latter is used when sleepable BPF programs are used. bpf_link_free() accommodates that by checking underlying BPF program's sleepable flag, and goes either through normal RCU GP only for non-sleepable, or through RCU tasks trace GP *and* then normal RCU GP (taking into account rcu_trace_implies_rcu_gp() optimization), if BPF program is sleepable. We use this for multi-kprobe and multi-uprobe links, which dereference link during program run. • https://git.kernel.org/stable/c/0dcac272540613d41c05e89679e4ddb978b612f1 https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97 https://git.kernel.org/stable/c/5d8d447777564b35f67000e7838e7ccb64d525c8 https://git.kernel.org/stable/c/1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-35859 – block: fix module reference leakage from bdev_open_by_dev error path
https://notcve.org/view.php?id=CVE-2024-35859
In the Linux kernel, the following vulnerability has been resolved: block: fix module reference leakage from bdev_open_by_dev error path At the time bdev_may_open() is called, module reference is grabbed already, hence module reference should be released if bdev_may_open() failed. This problem is found by code review. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bloquear: reparar la fuga de referencia del módulo de la ruta de error bdev_open_by_dev. En el momento en que se llama a bdev_may_open(), la referencia del módulo ya está tomada, por lo tanto, la referencia del módulo debe liberarse si bdev_may_open() fallo. Este problema se encuentra mediante la revisión del código. • https://git.kernel.org/stable/c/ed5cc702d311c14b653323d76062b0294effa66e https://git.kernel.org/stable/c/0e9327c67410b129bf85e5c3a5aaea518328636f https://git.kernel.org/stable/c/9617cd6f24b294552a817f80f5225431ef67b540 https://access.redhat.com/security/cve/CVE-2024-35859 https://bugzilla.redhat.com/show_bug.cgi?id=2281243 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35858 – net: bcmasp: fix memory leak when bringing down interface
https://notcve.org/view.php?id=CVE-2024-35858
In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix memory leak when bringing down interface When bringing down the TX rings we flush the rings but forget to reclaimed the flushed packets. This leads to a memory leak since we do not free the dma mapped buffers. This also leads to tx control block corruption when bringing down the interface for power management. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: bcmasp: corrige la pérdida de memoria al desactivar la interfaz. Al desactivar los anillos TX, los limpiamos pero nos olvidamos de recuperar los paquetes eliminados. • https://git.kernel.org/stable/c/490cb412007de593e07c1d3e2b1ec4233886707c https://git.kernel.org/stable/c/09040baf8779ad880e0e0d0ea10e57aa929ef3ab https://git.kernel.org/stable/c/2389ad1990163d29cba5480d693b4c2e31cc545c https://git.kernel.org/stable/c/9f898fc2c31fbf0ac5ecd289f528a716464cb005 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-35857 – icmp: prevent possible NULL dereferences from icmp_build_probe()
https://notcve.org/view.php?id=CVE-2024-35857
In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() First problem is a double call to __in_dev_get_rcu(), because the second one could return NULL. if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list) Second problem is a read from dev->ip6_ptr with no NULL check: if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list)) Use the correct RCU API to fix these. v2: add missing include <net/addrconf.h> En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: icmp: evita posibles desreferencias a NULL por parte de icmp_build_probe(). El primer problema es una doble llamada a __in_dev_get_rcu(), porque la segunda podría devolver NULL. if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list) El segundo problema es una lectura de dev->ip6_ptr sin verificación NULL: if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list)) Use el correcto API de RCU para solucionarlos. v2: agregar falta incluir • https://git.kernel.org/stable/c/d329ea5bd8845f0b196bf41b18b6173340d6e0e4 https://git.kernel.org/stable/c/23b7ee4a8d559bf38eac7ce5bb2f6ebf76f9c401 https://git.kernel.org/stable/c/599c9ad5e1d43f5c12d869f5fd406ba5d8c55270 https://git.kernel.org/stable/c/d68dc711d84fdcf698e5d45308c3ddeede586350 https://git.kernel.org/stable/c/3e2979bf080c40da4f7c93aff8575ab8bc62b767 https://git.kernel.org/stable/c/c58e88d49097bd12dfcfef4f075b43f5d5830941 https://access.redhat.com/security/cve/CVE-2024-35857 https://bugzilla.redhat.com/show_bug.cgi?id=2281247 • CWE-476: NULL Pointer Dereference •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35856 – Bluetooth: btusb: mediatek: Fix double free of skb in coredump
https://notcve.org/view.php?id=CVE-2024-35856
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Fix double free of skb in coredump hci_devcd_append() would free the skb on error so the caller don't have to free it again otherwise it would cause the double free of skb. Reported-by : Dan Carpenter <dan.carpenter@linaro.org> En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: btusb: mediatek: Corrección double free de skb en coredump hci_devcd_append() liberaría el skb en caso de error para que la persona que llama no tenga que liberarlo nuevamente, de lo contrario causaría el doble libre de skb. Reportado por: Dan Carpenter • https://git.kernel.org/stable/c/0b70151328781a89c89e4cf3fae21fc0e98d869e https://git.kernel.org/stable/c/80dfef128cb9f1b1ef67c0fe8c8deb4ea7ad30c1 https://git.kernel.org/stable/c/e20093c741d8da9f6390dd45d75b779861547035 https://git.kernel.org/stable/c/18bdb386a1a30e7a3d7732a98e45e69cf6b5710d •