CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2024-55881 – KVM: x86: Play nice with protected guests in complete_hypercall_exit()
https://notcve.org/view.php?id=CVE-2024-55881
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Play nice with protected guests in complete_hypercall_exit() Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For guests with protected state, e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit mode as the vCPU state needed to detect 64-bit mode is unavailable. Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE hypercall vi... • https://git.kernel.org/stable/c/5969e2435cbd7f0ce8c28d717bfc39987ee8d8f1 •
CVSS: 9.4EPSS: %CPEs: 4EXPL: 0CVE-2024-54680 – smb: client: fix TCP timers deadlock after rmmod
https://notcve.org/view.php?id=CVE-2024-54680
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: smb: client: fix TCP timers deadlock after rmmod Commit ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") fixed a netns UAF by manually enabled socket refcounting (sk->sk_net_refcnt=1 and sock_inuse_add(net, 1)). The reason the patch worked for that bug was because we now hold references to the netns (get_net_track() gets a ref internally) and they're properly released (internally, on __sk_destruct()), but only because ... • https://git.kernel.org/stable/c/e8c71494181153a134c96da28766a57bd1eac8cb •
CVSS: 5.6EPSS: %CPEs: 2EXPL: 0CVE-2024-54455 – accel/ivpu: Fix general protection fault in ivpu_bo_list()
https://notcve.org/view.php?id=CVE-2024-54455
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix general protection fault in ivpu_bo_list() Check if ctx is not NULL before accessing its fields. • https://git.kernel.org/stable/c/37dee2a2f4330a030abc5674bcec25ccc4addbcc •
CVSS: -EPSS: %CPEs: 2EXPL: 0CVE-2024-54193 – accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()
https://notcve.org/view.php?id=CVE-2024-54193
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal() Move pm_runtime_set_active() to ivpu_pm_init() so when ivpu_ipc_send_receive_internal() is executed before ivpu_pm_enable() it already has correct runtime state, even if last resume was not successful. In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal() Move pm_runtime_set_active() to ivpu_pm_init() so when ivpu_... • https://git.kernel.org/stable/c/8ed520ff4682aaaef7d124bd9c0950092fddb9c1 •
CVSS: 7.8EPSS: %CPEs: 7EXPL: 0CVE-2024-53690 – nilfs2: prevent use of deleted inode
https://notcve.org/view.php?id=CVE-2024-53690
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent use of deleted inode syzbot reported a WARNING in nilfs_rmdir. [1] Because the inode bitmap is corrupted, an inode with an inode number that should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0", causing an inode duplication during execution. And this causes an underflow of i_nlink in rmdir operations. The inode is used twice by the same task to unmount and remove directories ".nilfs" and "file0", it trig... • https://git.kernel.org/stable/c/d25006523d0b9e49fd097b2e974e7c8c05bd7f54 •
CVSS: 5.5EPSS: %CPEs: 3EXPL: 0CVE-2024-53685 – ceph: give up on paths longer than PATH_MAX
https://notcve.org/view.php?id=CVE-2024-53685
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, effectively blocking the whole task. Most of the machine becomes unusable, making this a very simple and effective DoS vulnerability. I cannot imagine why this retry was ever implemented, but it seems rather useless and harmful to me. Let's remove it and... • https://git.kernel.org/stable/c/c47ed91156daf328601d02b58d52d9804da54108 •
CVSS: 7.1EPSS: %CPEs: 2EXPL: 0CVE-2024-52319 – mm: use aligned address in clear_gigantic_page()
https://notcve.org/view.php?id=CVE-2024-52319
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hugetlb_no_page() calls folio_zero_user() with the fault address. Where the fault address may be not aligned with the huge page size. Then, folio_zero_user() may call clear_gigantic_page() with the address, while clear_gigantic_page() requires the address to be huge page size aligned. So, this may cause memory corruption or information leak, addtional, use more obvious nami... • https://git.kernel.org/stable/c/78fefd04c123493bbf28434768fa577b2153c79b •
CVSS: 7.1EPSS: %CPEs: 2EXPL: 0CVE-2024-51729 – mm: use aligned address in copy_user_gigantic_page()
https://notcve.org/view.php?id=CVE-2024-51729
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in copy_user_gigantic_page() In current kernel, hugetlb_wp() calls copy_user_large_folio() with the fault address. Where the fault address may be not aligned with the huge page size. Then, copy_user_large_folio() may call copy_user_gigantic_page() with the address, while copy_user_gigantic_page() requires the address to be huge page size aligned. So, this may cause memory corruption or information leak, addtional, us... • https://git.kernel.org/stable/c/530dd9926dc16220d2fae0997f45cda94f5f0864 •
CVSS: 5.5EPSS: %CPEs: 2EXPL: 0CVE-2024-49573 – sched/fair: Fix NEXT_BUDDY
https://notcve.org/view.php?id=CVE-2024-49573
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXT_BUDDY Adam reports that enabling NEXT_BUDDY insta triggers a WARN in pick_next_entity(). Moving clear_buddies() up before the delayed dequeue bits ensures no ->next buddy becomes delayed. Further ensure no new ->next buddy ever starts as delayed. In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXT_BUDDY Adam reports that enabling NEXT_BUDDY insta triggers a WARN in pick_next_entity()... • https://git.kernel.org/stable/c/152e11f6df293e816a6a37c69757033cdc72667d •
CVSS: 7.8EPSS: %CPEs: 6EXPL: 0CVE-2024-49571 – net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
https://notcve.org/view.php?id=CVE-2024-49571
11 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg When receiving proposal msg in server, the field iparea_offset and the field ipv6_prefixes_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field iparea_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks iparea_offset and ipv6_prefixes_cnt before using... • https://git.kernel.org/stable/c/e7b7a64a8493d47433fd003efbe6543e3f676294 •