CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-27403 – netfilter: nft_flow_offload: reset dst in route object after setting up flow
https://notcve.org/view.php?id=CVE-2024-27403
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: reset dst in route object after setting up flow dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flow_offload_add() fails, error path releases dst twice, leading to a refcount underflow. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netfilter: nft_flow_offload: restablece dst en el objeto de ruta después de configurar el flujo dst se transfiere al objeto de flujo, el objeto de ruta ya no es propietario. Restablezca el dst en el objeto de ruta; de lo contrario, si flow_offload_add() fallo, la ruta de error libera el dst dos veces, lo que provoca un desbordamiento insuficiente del recuento. • https://git.kernel.org/stable/c/a3c90f7a2323b331ae816d5b0633e68148e25d04 https://git.kernel.org/stable/c/4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c https://git.kernel.org/stable/c/012df10717da02367aaf92c65f9c89db206c15f4 https://git.kernel.org/stable/c/558b00a30e05753a62ecc7e05e939ca8f0241148 https://git.kernel.org/stable/c/670548c8db44d76e40e1dfc06812bca36a61e9ae https://git.kernel.org/stable/c/9e0f0430389be7696396c62f037be4bf72cf93e3 https://access.redhat.com/security/cve/CVE-2024-27403 https://bugzilla.redhat.com/show_bug.cgi?id=2281127 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2024-27402 – phonet/pep: fix racy skb_queue_empty() use
https://notcve.org/view.php?id=CVE-2024-27402
In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fix racy skb_queue_empty() use The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skb_peek() unexpectedly returning NULL or a pointer to an already dequeued socket buffer. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: phonet/pep: corrige el uso picante de skb_queue_empty() Las colas de recepción están protegidas por sus respectivos spin-lock, no por el socket lock. Esto podría provocar que skb_peek() devuelva inesperadamente NULL o un puntero a un búfer de socket ya retirado de la cola. • https://git.kernel.org/stable/c/9641458d3ec42def729fde64669abf07f3220cd5 https://git.kernel.org/stable/c/9d5523e065b568e79dfaa2ea1085a5bcf74baf78 https://git.kernel.org/stable/c/0a9f558c72c47472c38c05fcb72c70abb9104277 https://git.kernel.org/stable/c/8ef4fcc7014b9f93619851d6b78d6cc2789a4c88 https://git.kernel.org/stable/c/7d2a894d7f487dcb894df023e9d3014cf5b93fe5 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2023-52656 – io_uring: drop any code related to SCM_RIGHTS
https://notcve.org/view.php?id=CVE-2023-52656
In the Linux kernel, the following vulnerability has been resolved: io_uring: drop any code related to SCM_RIGHTS This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of it. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring: elimina cualquier código relacionado con SCM_RIGHTS. Este es un código inactivo después de que dejamos de admitir el paso de io_uring fds sobre SCM_RIGHTS, deshazte de él. • https://git.kernel.org/stable/c/cfb24022bb2c31f1f555dc6bc3cc5e2547446fb3 https://git.kernel.org/stable/c/a6771f343af90a25f3a14911634562bb5621df02 https://git.kernel.org/stable/c/d909d381c3152393421403be4b6435f17a2378b4 https://git.kernel.org/stable/c/a3812a47a32022ca76bf46ddacdd823dc2aabf8b https://git.kernel.org/stable/c/88c49d9c896143cdc0f77197c4dcf24140375e89 https://git.kernel.org/stable/c/6e5e6d274956305f1fc0340522b38f5f5be74bdb https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2024-27401 – firewire: nosy: ensure user_length is taken into account when fetching packet contents
https://notcve.org/view.php?id=CVE-2024-27401
In the Linux kernel, the following vulnerability has been resolved: firewire: nosy: ensure user_length is taken into account when fetching packet contents Ensure that packet_buffer_get respects the user_length provided. If the length of the head packet exceeds the user_length, packet_buffer_get will now return 0 to signify to the user that no data were read and a larger buffer size is required. Helps prevent user space overflows. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firewire: nosy: asegúrese de que se tenga en cuenta la longitud de usuario al recuperar el contenido del paquete. Asegúrese de que paquete_buffer_get respete la longitud de usuario proporcionada. • https://git.kernel.org/stable/c/67f34f093c0f7bf33f5b4ae64d3d695a3b978285 https://git.kernel.org/stable/c/7b8c7bd2296e95b38a6ff346242356a2e7190239 https://git.kernel.org/stable/c/cca330c59c54207567a648357835f59df9a286bb https://git.kernel.org/stable/c/79f988d3ffc1aa778fc5181bdfab312e57956c6b https://git.kernel.org/stable/c/4ee0941da10e8fdcdb34756b877efd3282594c1f https://git.kernel.org/stable/c/1fe60ee709436550f8cfbab01295936b868d5baa https://git.kernel.org/stable/c/539d51ac48bcfcfa1b3d4a85f8df92fa22c1d41c https://git.kernel.org/stable/c/38762a0763c10c24a4915feee722d7aa6 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2024-27400 – drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2
https://notcve.org/view.php?id=CVE-2024-27400
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 This reverts drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap. The basic problem here is that after the move the old location is simply not available any more. Some fixes were suggested, but essentially we should call the move notification before actually moving things because only this way we have the correct order for DMA-buf and VM move notifications as well. Also rework the statistic handling so that we don't update the eviction counter before the move. v2: add missing NULL check En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: una vez más corrige la llamada oder en amdgpu_ttm_move() v2. Esto revierte drm/amdgpu: corrige el evento ftrace amdgpu_bo_move siempre se mueve en el mismo montón. El problema básico aquí es que después de la mudanza, la antigua ubicación simplemente ya no está disponible. Se sugirieron algunas correcciones, pero esencialmente deberíamos llamar a la notificación de movimiento antes de mover cosas porque solo así tenemos el orden correcto para las notificaciones de movimiento de DMA-buf y VM también. • https://git.kernel.org/stable/c/d443fb67ca5ab04760449d21ddea66f6728e5b00 https://git.kernel.org/stable/c/e7a0ee45c653784edda5e36bae6ae3c75fd5e7a8 https://git.kernel.org/stable/c/94aeb4117343d072e3a35b9595bcbfc0058ee724 https://git.kernel.org/stable/c/77bcd4ab446fa35ad135b1c7404415ed9a129296 https://git.kernel.org/stable/c/1cd2b612474c07b17a21e27f2eed8dff75cb5057 https://git.kernel.org/stable/c/5c25b169f9a0b34ee410891a96bc9d7b9ed6f9be https://git.kernel.org/stable/c/0c7ed3ed35eec9138b88d42217b5a6b9a62bda4d https://git.kernel.org/stable/c/9a4f6e138720b6e9adf7b82a71d0292f3 •