CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52744 – RDMA/irdma: Fix potential NULL-ptr-dereference
https://notcve.org/view.php?id=CVE-2023-52744
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix potential NULL-ptr-dereference in_dev_get() can return NULL which will cause a failure once idev is dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a check for NULL value in idev beforehand. Found by Linux Verification Center (linuxtesting.org) with SVACE. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: RDMA/irdma: se corrige una posible referencia NULL-ptr-dereference in_dev_get() que puede devolver NULL, lo que provocará una falla una vez que se elimine la referencia a idev en in_dev_for_each_ifa_rtnl(). ... Encontrado por el Centro de verificación de Linux (linuxtesting.org) con SVACE. • https://git.kernel.org/stable/c/146b9756f14c04894226fb97e2f102f217139c27 https://git.kernel.org/stable/c/8f5fe1cd8e6a97f94840b55f59ed08cbc397086f https://git.kernel.org/stable/c/360682fe7df262d94fae54f737c487bec0f9190d https://git.kernel.org/stable/c/5d9745cead1f121974322b94ceadfb4d1e67960e •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2023-52743 – ice: Do not use WQ_MEM_RECLAIM flag for workqueue
https://notcve.org/view.php?id=CVE-2023-52743
In the Linux kernel, the following vulnerability has been resolved: ice: Do not use WQ_MEM_RECLAIM flag for workqueue When both ice and the irdma driver are loaded, a warning in check_flush_dependency is being triggered. ... up_write+0x5c/0x90 [ +0.000005] irdma_remove+0x36/0x90 [irdma] [ +0.000062] auxiliary_bus_remove+0x32/0x50 [ +0.000007] device_r ---truncated--- En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: no utilice el indicador WQ_MEM_RECLAIM para la cola de trabajo. • https://git.kernel.org/stable/c/940b61af02f497fcd911b9e2d75c6b8cf76b92fd https://git.kernel.org/stable/c/87a5e3fc8416106e290c448fc8a6dd50ab24c634 https://git.kernel.org/stable/c/1ad4112c9fcf0bc08222b2b1614fba52ffd12255 https://git.kernel.org/stable/c/ca834a017851c50464c25a85f3cb2daefff7bede https://git.kernel.org/stable/c/df59e05401450973c8c7e96fd74b49e24442dc1f https://git.kernel.org/stable/c/4d159f7884f78b1aacb99b4fc37d1e3cb1194e39 •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2023-52742 – net: USB: Fix wrong-direction WARNING in plusb.c
https://notcve.org/view.php?id=CVE-2023-52742
In the Linux kernel, the following vulnerability has been resolved: net: USB: Fix wrong-direction WARNING in plusb.c The syzbot fuzzer detected a bug in the plusb network driver: A zero-length control-OUT transfer was treated as a read instead of a write. ... En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net: USB: corrija la dirección incorrecta ADVERTENCIA en plusb.c. • https://git.kernel.org/stable/c/090ffa9d0e904e1ed0f86c84dcf20684a8ac1a5a https://git.kernel.org/stable/c/f0ad46ef772438c0596df370450d8bdc8a12dbfb https://git.kernel.org/stable/c/6f69307f625904feed189008381fd83bd1a35b63 https://git.kernel.org/stable/c/43379fcacea2dcee35d02efc9c8fe97807a503c9 https://git.kernel.org/stable/c/1be271c52bf3554edcb8d124d1f8c7f777ee5727 https://git.kernel.org/stable/c/25141fb4119112f4ebf8f00cf52014abbc8020b1 https://git.kernel.org/stable/c/0d2cf3fae701646061e295815bb7588d2f3671cc https://git.kernel.org/stable/c/811d581194f7412eda97acc03d17fc778 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52741 – cifs: Fix use-after-free in rdata->read_into_pages()
https://notcve.org/view.php?id=CVE-2023-52741
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata->read_into_pages() When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0 Call Trace: <TASK> dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpages_fill_pages+0x14c/0x7e0 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 </TASK> Allocated by task 2535: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 cifs_readdata_direct_alloc+0x2c/0x110 cifs_readdata_alloc+0x2d/0x60 cifs_readahead+0x393/0xfe0 read_pages+0x12f/0x470 page_cache_ra_unbounded+0x1b1/0x240 filemap_get_pages+0x1c8/0x9a0 filemap_read+0x1c0/0x540 cifs_strict_readv+0x21b/0x240 vfs_read+0x395/0x4b0 ksys_read+0xb8/0x150 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 79: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 __kmem_cache_free+0x7a/0x1a0 cifs_readdata_release+0x49/0x60 process_one_work+0x46c/0x760 worker_thread+0x2a4/0x6f0 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 Last potentially related work creation: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 insert_work+0x2b/0x130 __queue_work+0x1fe/0x660 queue_work_on+0x4b/0x60 smb2_readv_callback+0x396/0x800 cifs_abort_connection+0x474/0x6a0 cifs_reconnect+0x5cb/0xa50 cifs_readv_from_socket.cold+0x22/0x6c cifs_read_page_from_socket+0xc1/0x100 readpages_fill_pages.cold+0x2f/0x46 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 The following function calls will cause UAF of the rdata pointer. readpages_fill_pages cifs_read_page_from_socket cifs_readv_from_socket cifs_reconnect __cifs_reconnect cifs_abort_connection mid->callback() --> smb2_readv_callback queue_work(&rdata->work) # if the worker completes first, # the rdata is freed cifs_readv_complete kref_put cifs_readdata_release kfree(rdata) return rdata->... En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cifs: corrige el use after free en rdata->read_into_pages(). • https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0 https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9 https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211 •
CVSS: 4.1EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52740 – powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch
https://notcve.org/view.php?id=CVE-2023-52740
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch The RFI and STF security mitigation options can flip the interrupt_exit_not_reentrant static branch condition concurrently with the interrupt exit code which tests that branch. Interrupt exit tests this condition to set MSR[EE|RI] for exit, then again in the case a soft-masked interrupt is found pending, to recover the MSR so the interrupt can be replayed before attempting to exit again. ... En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/64s/interrupt: corrige la ejecución de salida de interrupción con un interruptor de mitigación de seguridad. • https://git.kernel.org/stable/c/13799748b957bc5659f97c036224b0f4b42172e2 https://git.kernel.org/stable/c/86f7e423933608d536015a0f2eb9e0338c1227e0 https://git.kernel.org/stable/c/6f097c24815e67909a1fcc2c605586d02babd673 https://git.kernel.org/stable/c/2ea31e2e62bbc4d11c411eeb36f1b02841dbcab1 https://access.redhat.com/security/cve/CVE-2023-52740 https://bugzilla.redhat.com/show_bug.cgi?id=2282741 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •