CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-53207 – Bluetooth: MGMT: Fix possible deadlocks
https://notcve.org/view.php?id=CVE-2024-53207
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible deadlocks This fixes possible deadlocks like the following caused by hci_cmd_sync_dequeue causing the destroy function to run: INFO: task kworker/u19:0:143 blocked for more than 120 seconds. Tainted: G W O 6.8.0-2024-03-19-intel-next-iLS-24ww14 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u19:0 state:D stack:0 pid:143 tgid:143 ppid:2 flags:0x00004000 Workqueue: hci0 hci_cmd_sync_work [bluetooth] Call Trace: <TASK> __schedule+0x374/0xaf0 schedule+0x3c/0xf0 schedule_preempt_disabled+0x1c/0x30 __mutex_lock.constprop.0+0x3ef/0x7a0 __mutex_lock_slowpath+0x13/0x20 mutex_lock+0x3c/0x50 mgmt_set_connectable_complete+0xa4/0x150 [bluetooth] ? kfree+0x211/0x2a0 hci_cmd_sync_dequeue+0xae/0x130 [bluetooth] ? __pfx_cmd_complete_rsp+0x10/0x10 [bluetooth] cmd_complete_rsp+0x26/0x80 [bluetooth] mgmt_pending_foreach+0x4d/0x70 [bluetooth] __mgmt_power_off+0x8d/0x180 [bluetooth] ? _raw_spin_unlock_irq+0x23/0x40 hci_dev_close_sync+0x445/0x5b0 [bluetooth] hci_set_powered_sync+0x149/0x250 [bluetooth] set_powered_sync+0x24/0x60 [bluetooth] hci_cmd_sync_work+0x90/0x150 [bluetooth] process_one_work+0x13e/0x300 worker_thread+0x2f7/0x420 ? __pfx_worker_thread+0x10/0x10 kthread+0x107/0x140 ? • https://git.kernel.org/stable/c/4883296505aa7e4863c6869b689afb6005633b23 https://git.kernel.org/stable/c/8c3f7943a29145d8a2d8e24893762f7673323eae https://git.kernel.org/stable/c/f53e1c9c726d83092167f2226f32bd3b73f26c21 https://git.kernel.org/stable/c/0cc47233af35fb5f10b5e6a027cb4ccd480caf9a https://git.kernel.org/stable/c/5703fb1d85f653e35b327b14de4db7da239e4fd9 https://git.kernel.org/stable/c/6a25ce9b4af6dc26ee2b9c32d6bd37620bf9739e https://git.kernel.org/stable/c/cac34e44281f1f1bd842adbbcfe3ef9ff0905111 https://git.kernel.org/stable/c/a66dfaf18fd61bb75ef8cee83db46b2aa •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2024-53206 – tcp: Fix use-after-free of nreq in reqsk_timer_handler().
https://notcve.org/view.php?id=CVE-2024-53206
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix use-after-free of nreq in reqsk_timer_handler(). The cited commit replaced inet_csk_reqsk_queue_drop_and_put() with __inet_csk_reqsk_queue_drop() and reqsk_put() in reqsk_timer_handler(). Then, oreq should be passed to reqsk_put() instead of req; otherwise use-after-free of nreq could happen when reqsk is migrated but the retry attempt failed (e.g. due to timeout). Let's pass oreq to reqsk_put(). • https://git.kernel.org/stable/c/8459d61fbf24967839a70235165673148c7c7f17 https://git.kernel.org/stable/c/5071beb59ee416e8ab456ac8647a4dabcda823b1 https://git.kernel.org/stable/c/997ae8da14f1639ce6fb66a063dab54031cd61b3 https://git.kernel.org/stable/c/51e34db64f4e43c7b055ccf881b7f3e0c31bb26d https://git.kernel.org/stable/c/e8c526f2bdf1845bedaf6a478816a3d06fa78b8f https://git.kernel.org/stable/c/2dcc86fefe09ac853158afd96b60d544af115dc5 https://git.kernel.org/stable/c/9a3c1ad93e6fba67b3a637cfa95a57a6685e4908 https://git.kernel.org/stable/c/65ed89cad1f57034c256b016e89e8c0a4 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-53205 – phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe
https://notcve.org/view.php?id=CVE-2024-53205
In the Linux kernel, the following vulnerability has been resolved: phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe In rtk_usb2phy_probe() devm_kzalloc() may return NULL but this returned value is not checked. • https://git.kernel.org/stable/c/134e6d25f6bd06071e5aac0a7eefcea6f7713955 https://git.kernel.org/stable/c/0b398b6b6c94315fd2ce3658e3cee96539dbd7b7 https://git.kernel.org/stable/c/fb83c9a08324e37f321ffb400809aa4310387d65 https://git.kernel.org/stable/c/04e3e9188291a183b27306ddb833722c0d083d6a •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-53204 – phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe
https://notcve.org/view.php?id=CVE-2024-53204
In the Linux kernel, the following vulnerability has been resolved: phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe In rtk_usb3phy_probe() devm_kzalloc() may return NULL but this returned value is not checked. • https://git.kernel.org/stable/c/adda6e82a7de7d6d478f6c8ef127f0ac51c510a1 https://git.kernel.org/stable/c/48d52d3168749e10c1c37cd4ceccd18625851741 https://git.kernel.org/stable/c/776f13ad1f88485206f1dca5ef138553106950e5 https://git.kernel.org/stable/c/bf373d2919d98f3d1fe1b19a0304f72fe74386d9 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-53203 – usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
https://notcve.org/view.php?id=CVE-2024-53203
In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() The "command" variable can be controlled by the user via debugfs. The worry is that if con_index is zero then "&uc->ucsi->connector[con_index - 1]" would be an array underflow. • https://git.kernel.org/stable/c/170a6726d0e266f2c8f306e3d61715c32f4ee41e https://git.kernel.org/stable/c/ef92cd55289a282910575c5b9d87f646f2d39b38 https://git.kernel.org/stable/c/56971710cd541f2f05160a84b3183477d34a1be9 https://git.kernel.org/stable/c/e56aac6e5a25630645607b6856d4b2a17b2311a5 •