CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2023-52679 – of: Fix double free in of_parse_phandle_with_args_map
https://notcve.org/view.php?id=CVE-2023-52679
In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in of_parse_phandle_with_args_map In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the inner loop. This assumes that the value of "new" is NULL on the first iteration of the inner loop. Make sure that this is true in all iterations of the outer loop by setting "new" to NULL after its value is assigned to "cur". Extend the unittest to detect the double free and add an additional test case that actually triggers this path. En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: of: Solucionado double free en of_parse_phandle_with_args_map En of_parse_phandle_with_args_map() el bucle interno que itera por las entradas del mapa llama a of_node_put(new) para liberar la referencia adquirida por la iteración anterior del bucle interno . Esto supone que el valor de "nuevo" es NULL en la primera iteración del bucle interno. Asegúrese de que esto sea cierto en todas las iteraciones del bucle externo estableciendo "nuevo" en NULL después de que su valor se asigne a "cur". • https://git.kernel.org/stable/c/bd6f2fd5a1d52198468c5cdc3c2472362dff5aaa https://git.kernel.org/stable/c/26b4d702c44f9e5cf3c5c001ae619a4a001889db https://git.kernel.org/stable/c/a0a061151a6200c13149dbcdb6c065203c8425d2 https://git.kernel.org/stable/c/d5f490343c77e6708b6c4aa7dbbfbcbb9546adea https://git.kernel.org/stable/c/4541004084527ce9e95a818ebbc4e6b293ffca21 https://git.kernel.org/stable/c/b9d760dae5b10e73369b769073525acd7b3be2bd https://git.kernel.org/stable/c/b64d09a4e8596f76d27f4b4a90a1cf6baf6a82f8 https://git.kernel.org/stable/c/cafa992134124e785609a406da4ff2b54 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52678 – drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c
https://notcve.org/view.php?id=CVE-2023-52678
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c Before using list_first_entry, make sure to check that list is not empty, if list is empty return -ENODATA. Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1347 kfd_create_indirect_link_prop() warn: can 'gpu_link' even be NULL? drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1428 kfd_add_peer_prop() warn: can 'iolink1' even be NULL? drivers/gpu/drm/amd/amdgpu/.. • https://git.kernel.org/stable/c/0f28cca87e9afc22280c44d378d2a6e249933977 https://git.kernel.org/stable/c/4525525cb7161d08f95d0e47025323dd10214313 https://git.kernel.org/stable/c/5024cce888e11e5688f77df81db9e14828495d64 https://git.kernel.org/stable/c/4ac4e023ed7ab1c7c67d2d12b7b6198fcd099e5c https://git.kernel.org/stable/c/499839eca34ad62d43025ec0b46b80e77065f6d8 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2023-52677 – riscv: Check if the code to patch lies in the exit section
https://notcve.org/view.php?id=CVE-2023-52677
In the Linux kernel, the following vulnerability has been resolved: riscv: Check if the code to patch lies in the exit section Otherwise we fall through to vmalloc_to_page() which panics since the address does not lie in the vmalloc region. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: compruebe si el código a parchear se encuentra en la sección de salida. De lo contrario, caeremos en vmalloc_to_page(), lo que entra en pánico ya que la dirección no se encuentra en la región vmalloc. • https://git.kernel.org/stable/c/043cb41a85de1c0e944da61ad7a264960e22c865 https://git.kernel.org/stable/c/938f70d14618ec72e10d6fcf8a546134136d7c13 https://git.kernel.org/stable/c/890cfe5337e0aaf03ece1429db04d23c88da72e7 https://git.kernel.org/stable/c/8db56df4a954b774bdc68917046a685a9fa2e4bc https://git.kernel.org/stable/c/1d7a03052846f34d624d0ab41a879adf5e85c85f https://git.kernel.org/stable/c/420370f3ae3d3b883813fd3051a38805160b2b9f •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52676 – bpf: Guard stack limits against 32bit overflow
https://notcve.org/view.php?id=CVE-2023-52676
In the Linux kernel, the following vulnerability has been resolved: bpf: Guard stack limits against 32bit overflow This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498 [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904 En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Proteger los límites de la pila contra el desbordamiento de 32 bits. • https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2 https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6 https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760 https://access.redhat.com/security/cve/CVE-2023-52676 https://bugzilla.redhat.com/show_bug.cgi?id=2281332 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2023-52675 – powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
https://notcve.org/view.php?id=CVE-2023-52675
In the Linux kernel, the following vulnerability has been resolved: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: powerpc/imc-pmu: agregue una verificación de puntero null en update_events_in_group() kasprintf() devuelve un puntero a la memoria asignada dinámicamente que puede ser NULL en caso de fallo. • https://git.kernel.org/stable/c/885dcd709ba9120b9935415b8b0f9d1b94e5826b https://git.kernel.org/stable/c/75fc599bcdcb1de093c9ced2e3cccc832f3787f3 https://git.kernel.org/stable/c/1e80aa25d186a7aa212df5acd8c75f55ac8dae34 https://git.kernel.org/stable/c/5a669f3511d273c8c1ab1c1d268fbcdf53fc7a05 https://git.kernel.org/stable/c/f105c263009839d80fad6998324a4e1b3511cba0 https://git.kernel.org/stable/c/a2da3f9b1a1019c887ee1d164475a8fcdb0a3fec https://git.kernel.org/stable/c/024352f7928b28f53609660663329d8c0f4ad032 https://git.kernel.org/stable/c/c7d828e12b326ea50fb80c369d7aa8751 •