CVSS: 4.4EPSS: 0%CPEs: 8EXPL: 0CVE-2024-26810 – vfio/pci: Lock external INTx masking ops
https://notcve.org/view.php?id=CVE-2024-26810
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outside of the core interrupt code. In particular, irq_type is updated holding igate, therefore testing is_intx() requires holding igate. For example clearing DisINTx from config space can otherwise race changes of the interrupt configuration. This aligns interfaces which may trigger the INTx eventfd into two camps, one side serialized by igate and the other only enabled while INTx is configured. A subsequent patch introduces synchronization for the latter flows. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: vfio/pci: bloquear operaciones de enmascaramiento INTx externas Las operaciones de enmascaramiento a través de cambios en el espacio de configuración a DisINTx pueden acelerar los cambios de configuración de INTx a través de ioctl. • https://git.kernel.org/stable/c/89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 https://git.kernel.org/stable/c/1e71b6449d55179170efc8dee8664510bb813b42 https://git.kernel.org/stable/c/3dd9be6cb55e0f47544e7cdda486413f7134e3b3 https://git.kernel.org/stable/c/ec73e079729258a05452356cf6d098bf1504d5a6 https://git.kernel.org/stable/c/3fe0ac10bd117df847c93408a9d428a453cd60e5 https://git.kernel.org/stable/c/04a4a017b9ffd7b0f427b8c376688d14cb614651 https://git.kernel.org/stable/c/6fe478d855b20ac1eb5da724afe16af5a2aaaa40 https://git.kernel.org/stable/c/03505e3344b0576fd619416793a31eae9 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2024-26809 – netfilter: nft_set_pipapo: release elements in clone only from destroy path
https://notcve.org/view.php?id=CVE-2024-26809
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: release elements in clone only from destroy path Clone already always provides a current view of the lookup table, use it to destroy the set, otherwise it is possible to destroy elements twice. This fix requires: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol") which came after: 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path"). En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_set_pipapo: libera elementos en el clon solo desde la ruta de destrucción. El clon ya siempre proporciona una vista actual de la tabla de búsqueda, úsala para destruir el conjunto; de lo contrario, es posible destruir elementos. dos veces. Esta solución requiere: 212ed75dc5fb ("netfilter: nf_tables: integrar pipapo en el protocolo de confirmación") que vino después: 9827a0e6e23b ("netfilter: nft_set_pipapo: liberar elementos en clon desde la ruta de cancelación"). • https://git.kernel.org/stable/c/4a6430b99f67842617c7208ca55a411e903ba03a https://git.kernel.org/stable/c/5ccecafc728b0df48263d5ac198220bcd79830bc https://git.kernel.org/stable/c/9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e https://git.kernel.org/stable/c/d2b18d110685ce46ca1633b8ec586c685e243a51 https://git.kernel.org/stable/c/b36b83297ff4910dfc8705402c8abffd4bbf8144 https://git.kernel.org/stable/c/362508506bf545e9ce18c72a2c48dcbfb891ab9c https://git.kernel.org/stable/c/5ad233dc731ab64cdc47b84a5c1f78fff6c024af https://git.kernel.org/stable/c/ff90050771412b91e928093ccd8736ae6 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-26808 – netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
https://notcve.org/view.php?id=CVE-2024-26808
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER event is reported, otherwise a stale reference to netdevice remains in the hook list. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netfilter: nft_chain_filter: maneja NETDEV_UNREGISTER para la cadena base inet/ingress Elimine netdevice de la cadena base inet/ingress en caso de que se informe el evento NETDEV_UNREGISTER; de lo contrario, permanecerá una referencia obsoleta a netdevice en la lista de enlaces. A vulnerability was found in the Linux kernel's netfilter subsystem, related to the nft_chain_filter feature. This issue occurs when a NETDEV_UNREGISTER event is reported, which can leave a stale reference to a network device in the ingress basechain. If this issue is not addressed, this stale reference could result in lingering issues with network device handling. • https://git.kernel.org/stable/c/60a3815da702fd9e4759945f26cce5c47d3967ad https://git.kernel.org/stable/c/9489e214ea8f2a90345516016aa51f2db3a8cc2f https://git.kernel.org/stable/c/70f17b48c86622217a58d5099d29242fc9adac58 https://git.kernel.org/stable/c/af149a46890e8285d1618bd68b8d159bdb87fdb3 https://git.kernel.org/stable/c/e5888acbf1a3d8d021990ce6c6061fd5b2bb21b4 https://git.kernel.org/stable/c/36a0a80f32209238469deb481967d777a3d539ee https://git.kernel.org/stable/c/01acb2e8666a6529697141a6017edbf206921913 https://lists.debian.org/debian-lts-announce/2024/06/ • CWE-416: Use After Free •
CVSS: -EPSS: 0%CPEs: 10EXPL: 0CVE-2024-26807 – spi: cadence-qspi: fix pointer reference in runtime PM hooks
https://notcve.org/view.php?id=CVE-2024-26807
In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations start with: struct cqspi_st *cqspi = dev_get_drvdata(dev); struct spi_controller *host = dev_get_drvdata(dev); This obviously cannot be correct, unless "struct cqspi_st" is the first member of " struct spi_controller", or the other way around, but it is not the case. "struct spi_controller" is allocated by devm_spi_alloc_host(), which allocates an extra amount of memory for private data, used to store "struct cqspi_st". The ->probe() function of the cadence-quadspi driver then sets the device drvdata to store the address of the "struct cqspi_st" structure. Therefore: struct cqspi_st *cqspi = dev_get_drvdata(dev); is correct, but: struct spi_controller *host = dev_get_drvdata(dev); is not, as it makes "host" point not to a "struct spi_controller" but to the same "struct cqspi_st" structure as above. This obviously leads to bad things (memory corruption, kernel crashes) directly during ->probe(), as ->probe() enables the device using PM runtime, leading the ->runtime_resume() hook being called, which in turns calls spi_controller_resume() with the wrong pointer. This has at least been reported [0] to cause a kernel crash, but the exact behavior will depend on the memory contents. [0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/ This issue potentially affects all platforms that are currently using the cadence-quadspi driver. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: cadence-qspi: corrige la referencia del puntero en los ganchos PM en tiempo de ejecución dev_get_drvdata() se utiliza para adquirir el puntero a cqspi y el controlador SPI. Ninguno de los dos integra al otro; Esto conduce a la corrupción de la memoria. • https://git.kernel.org/stable/c/2087e85bb66ee3652dafe732bb9b9b896229eafc https://git.kernel.org/stable/c/e3f9fc9a4f1499cc9e1bad4482d377494e367b3d https://git.kernel.org/stable/c/6716203844bc8489af5e5564f0fa31e0c094a7ff https://git.kernel.org/stable/c/b24f1ecc8fe2ceefc14af02edb1744c246d87bf7 https://git.kernel.org/stable/c/d453f25faf681799d636fe9d6899ad91c45aa11e https://git.kernel.org/stable/c/79acf7fb856eade9c3d0cf00fd34a04bf5c43a1c https://git.kernel.org/stable/c/18cb554e9da81bc4eca653c17a0d65e8b5835c09 https://git.kernel.org/stable/c/1368dbc0a432acf9fc0dcb23bfe52d32c •
CVSS: -EPSS: 0%CPEs: 13EXPL: 0CVE-2024-26805 – netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
https://notcve.org/view.php?id=CVE-2024-26805
In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data size is specified as `len` and passed to skb_put_data(). This `len` is based on `skb->end` that is not data offset but buffer offset. The `skb->end` contains data and tailroom. Since the tailroom is not initialized when the new `skb` created, KMSAN detects uninitialized memory area when copying the data. This patch resolved this issue by correct the len from `skb->end` to `skb->len`, which is the actual data offset. BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 copy_to_iter include/linux/uio.h:197 [inline] simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg net/socket.c:1066 [inline] sock_read_iter+0x467/0x580 net/socket.c:1136 call_read_iter include/linux/fs.h:2014 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x8f6/0xe00 fs/read_write.c:470 ksys_read+0x20f/0x4c0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x93/0xd0 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was stored to memory at: skb_put_data include/linux/skbuff.h:2622 [inline] netlink_to_full_skb net/netlink/af_netlink.c:181 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline] __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325 netlink_deliver_tap net/netlink/af_netlink.c:338 [inline] netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: free_pages_prepare mm/page_alloc.c:1087 [inline] free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347 free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533 release_pages+0x23d3/0x2410 mm/swap.c:1042 free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316 tlb_batch_pages ---truncated--- En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netlink: Fix kernel-infoleak-after-free en __skb_datagram_iter syzbot informó el siguiente problema de acceso al valor uninit [1]: netlink_to_full_skb() crea un nuevo `skb` y coloca el ` skb->data` pasó como primer argumento de netlink_to_full_skb() al nuevo `skb`. • https://git.kernel.org/stable/c/1853c949646005b5959c483becde86608f548f24 https://git.kernel.org/stable/c/92994a5f49d0a81c8643452d5c0a6e8b31d85a61 https://git.kernel.org/stable/c/85aec6328f3346b0718211faad564a3ffa64f60e https://git.kernel.org/stable/c/d38200098e3203ba30ba06ed3f345ec6ca75234c https://git.kernel.org/stable/c/65d48c630ff80a19c39751a4a6d3315f4c3c0280 https://git.kernel.org/stable/c/62f43b58d2b2c4f0200b9ca2b997f4c484f0272f https://git.kernel.org/stable/c/ec343a55b687a452f5e87f3b52bf9f155864df65 https://git.kernel.org/stable/c/9ae51361da43270f4ba0eb924427a07e8 •