CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47005 – PCI: endpoint: Fix NULL pointer dereference for ->get_features()
https://notcve.org/view.php?id=CVE-2021-47005
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix NULL pointer dereference for ->get_features() get_features ops of pci_epc_ops may return NULL, causing NULL pointer dereference in pci_epf_test_alloc_space function. Let us add a check for pci_epc_feature pointer in pci_epf_test_bind before we access it to avoid any such NULL pointer dereference and return -ENOTSUPP in case pci_epc_feature is not found. When the patch is not applied and EPC features is not implemented in the platform driver, we see the following dump due to kernel NULL pointer dereference. Call trace: pci_epf_test_bind+0xf4/0x388 pci_epf_bind+0x3c/0x80 pci_epc_epf_link+0xa8/0xcc configfs_symlink+0x1a4/0x48c vfs_symlink+0x104/0x184 do_symlinkat+0x80/0xd4 __arm64_sys_symlinkat+0x1c/0x24 el0_svc_common.constprop.3+0xb8/0x170 el0_svc_handler+0x70/0x88 el0_svc+0x8/0x640 Code: d2800581 b9403ab9 f9404ebb 8b394f60 (f9400400) ---[ end trace a438e3c5a24f9df0 ]--- En el kernel de Linux, se resolvió la siguiente vulnerabilidad: PCI: endpoint: corrigió la desreferencia del puntero NULL para ->get_features() las operaciones get_features de pci_epc_ops pueden devolver NULL, lo que provoca la desreferencia del puntero NULL en la función pci_epf_test_alloc_space. Agreguemos una verificación del puntero pci_epc_feature en pci_epf_test_bind antes de acceder a él para evitar dicha desreferencia del puntero NULL y devolvamos -ENOTSUPP en caso de que no se encuentre pci_epc_feature. Cuando no se aplica el parche y las funciones de EPC no se implementan en el controlador de la plataforma, vemos el siguiente volcado debido a la desreferencia del puntero NULL del kernel. Rastreo de llamadas: pci_epf_test_bind+0xf4/0x388 pci_epf_bind+0x3c/0x80 pci_epc_epf_link+0xa8/0xcc configfs_symlink+0x1a4/0x48c vfs_symlink+0x104/0x184 do_symlinkat+0x80/0xd4 __arm64_sys _symlinkat+0x1c/0x24 el0_svc_common.constprop.3+0xb8/0x170 el0_svc_handler+0x70 /0x88 el0_svc+0x8/0x640 Código: d2800581 b9403ab9 f9404ebb 8b394f60 (f9400400) ---[ final de seguimiento a438e3c5a24f9df0 ]--- • https://git.kernel.org/stable/c/2c04c5b8eef797dca99699cfb55ff42dd3c12c23 https://git.kernel.org/stable/c/bbed83d7060e07a5d309104d25a00f0a24441428 https://git.kernel.org/stable/c/679ebad058b8168f10e63876d63b0877fd2fe784 https://git.kernel.org/stable/c/0169d4f0bee44fdfef908c13ed21fcb326c38695 https://git.kernel.org/stable/c/6613bc2301ba291a1c5a90e1dc24cf3edf223c03 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47004 – f2fs: fix to avoid touching checkpointed data in get_victim()
https://notcve.org/view.php?id=CVE-2021-47004
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid touching checkpointed data in get_victim() In CP disabling mode, there are two issues when using LFS or SSR | AT_SSR mode to select victim: 1. LFS is set to find source section during GC, the victim should have no checkpointed data, since after GC, section could not be set free for reuse. Previously, we only check valid chpt blocks in current segment rather than section, fix it. 2. SSR | AT_SSR are set to find target segment for writes which can be fully filled by checkpointed and newly written blocks, we should never select such segment, otherwise it can cause panic or data corruption during allocation, potential case is described as below: a) target segment has 'n' (n < 512) ckpt valid blocks b) GC migrates 'n' valid blocks to other segment (segment is still in dirty list) c) GC migrates '512 - n' blocks to target segment (segment has 'n' cp_vblocks and '512 - n' vblocks) d) If GC selects target segment via {AT,}SSR allocator, however there is no free space in targe segment. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: corrección para evitar tocar datos con puntos de control en get_victim() En el modo de desactivación de CP, hay dos problemas al usar LFS o SSR | Modo AT_SSR para seleccionar a la víctima: 1. LFS está configurado para buscar la sección de origen durante la GC, la víctima no debe tener datos de puntos de control, ya que después de la GC, la sección no se puede liberar para su reutilización. • https://git.kernel.org/stable/c/4354994f097d068a894aa1a0860da54571df3582 https://git.kernel.org/stable/c/105155a8146ddb54c119d8318964eef3859d109d https://git.kernel.org/stable/c/1e116f87825f01a6380286472196882746b16f63 https://git.kernel.org/stable/c/211372b2571520e394b56b431a0705586013b3ff https://git.kernel.org/stable/c/61461fc921b756ae16e64243f72af2bfc2e620db •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47003 – dmaengine: idxd: Fix potential null dereference on pointer status
https://notcve.org/view.php?id=CVE-2021-47003
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix potential null dereference on pointer status There are calls to idxd_cmd_exec that pass a null status pointer however a recent commit has added an assignment to *status that can end up with a null pointer dereference. The function expects a null status pointer sometimes as there is a later assignment to *status where status is first null checked. Fix the issue by null checking status before making the assignment. Addresses-Coverity: ("Explicit null dereferenced") En el kernel de Linux, se resolvió la siguiente vulnerabilidad: dmaengine: idxd: corrige una posible desreferencia nula en el estado del puntero. Hay llamadas a idxd_cmd_exec que pasan un puntero de estado nulo, sin embargo, una confirmación reciente agregó una asignación a *status que puede terminar con una desreferencia de puntero nulo. La función espera un puntero de estado nulo a veces, ya que hay una asignación posterior a *status donde el estado se verifica por primera vez como nulo. • https://git.kernel.org/stable/c/40e3b5c128645d2ddad12310c7be98758cafb2b0 https://git.kernel.org/stable/c/89e3becd8f821e507052e012d2559dcda59f538e https://git.kernel.org/stable/c/5756f757c72501ef1a16f5f63f940623044180e9 https://git.kernel.org/stable/c/2280b4cc29d8cdd2be3d1b2d1ea4f958e2131c97 https://git.kernel.org/stable/c/7bc402f843e7817a4a808e7b9ab0bcd7ffd55bfa https://git.kernel.org/stable/c/28ac8e03c43dfc6a703aa420d18222540b801120 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47002 – SUNRPC: Fix null pointer dereference in svc_rqst_free()
https://notcve.org/view.php?id=CVE-2021-47002
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null pointer dereference in svc_rqst_free() When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). Fix it by adding a null check. Addresses-Coverity: ("Dereference after null check") En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: SUNRPC: corrige la desreferencia del puntero nulo en svc_rqst_free() Cuando alloc_pages_node() devuelve nulo en svc_rqst_alloc(), el puntero nulo rq_scratch_page será desreferenciado al llamar a put_page() en svc_rqst_free(). Solucionarlo agregando una marca nula. Direcciones-Cobertura: ("Desreferencia después de verificación nula") • https://git.kernel.org/stable/c/79e4e0d489c8e72b9efa388e504a036eec1550c6 https://git.kernel.org/stable/c/5191955d6fc65e6d4efe8f4f10a6028298f57281 https://git.kernel.org/stable/c/3de81c1e84bf84803308da3272a829a7655c5336 https://git.kernel.org/stable/c/1e10f58f1c9a6b667b045513c7a4e6111c24fe7c https://git.kernel.org/stable/c/c664aaec9aee544538a78ba4893a44bc73a6d742 https://git.kernel.org/stable/c/b9f83ffaa0c096b4c832a43964fe6bff3acffe10 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2021-47001 – xprtrdma: Fix cwnd update ordering
https://notcve.org/view.php?id=CVE-2021-47001
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix cwnd update ordering After a reconnect, the reply handler is opening the cwnd (and thus enabling more RPC Calls to be sent) /before/ rpcrdma_post_recvs() can post enough Receive WRs to receive their replies. This causes an RNR and the new connection is lost immediately. The race is most clearly exposed when KASAN and disconnect injection are enabled. This slows down rpcrdma_rep_create() enough to allow the send side to post a bunch of RPC Calls before the Receive completion handler can invoke ib_post_recv(). En el kernel de Linux, se resolvió la siguiente vulnerabilidad: xprtrdma: corrige el orden de actualización de cwnd Después de una reconexión, el controlador de respuesta abre cwnd (y así permite que se envíen más llamadas RPC) /antes/ rpcrdma_post_recvs() puede publicar suficiente recepción WR para recibir sus respuestas. Esto provoca un RNR y la nueva conexión se pierde inmediatamente. • https://git.kernel.org/stable/c/2ae50ad68cd79224198b525f7bd645c9da98b6ff https://git.kernel.org/stable/c/3791c5982ba1eebf2900ee7ca7b9a89619c26d54 https://git.kernel.org/stable/c/eddae8be7944096419c2ae29477a45f767d0fcd4 https://git.kernel.org/stable/c/8834ecb5df22b7ff3c9b0deba7726579bb613f95 https://git.kernel.org/stable/c/19b5fa9489b5706bc878c3a522a7f771079e2fa0 https://git.kernel.org/stable/c/35d8b10a25884050bb3b0149b62c3818ec59f77c •