CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-35907 – mlxbf_gige: call request_irq() after NAPI initialized
https://notcve.org/view.php?id=CVE-2024-35907
In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: call request_irq() after NAPI initialized The mlxbf_gige driver encounters a NULL pointer exception in mlxbf_gige_open() when kdump is enabled. ... The ---truncated--- En el kernel de Linux, se resolvió la siguiente vulnerabilidad: mlxbf_gige: llame a request_irq() después de inicializar NAPI. • https://git.kernel.org/stable/c/f92e1869d74e1acc6551256eb084a1c14a054e19 https://git.kernel.org/stable/c/a583117668ddb86e98f2e11c7caa3db0e6df52a3 https://git.kernel.org/stable/c/24444af5ddf729376b90db0f135fa19973cb5dab https://git.kernel.org/stable/c/867a2f598af6a645c865d1101b58c5e070c6dd9e https://git.kernel.org/stable/c/8feb1652afe9c5d019059a55c90f70690dce0f52 https://git.kernel.org/stable/c/f7442a634ac06b953fc1f7418f307b25acd4cfbc https://access.redhat.com/security/cve/CVE-2024-35907 https://bugzilla.redhat.com/show_bug.cgi?id=2281647 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-35905 – bpf: Protect against int overflow for stack access size
https://notcve.org/view.php?id=CVE-2024-35905
In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. ... En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Protección contra desbordamiento int para el tamaño de acceso a la pila. ... A flaw was found in the Linux kernel. • https://git.kernel.org/stable/c/afea95d319ccb4ad2060dece9ac5e2e364dec543 https://git.kernel.org/stable/c/02962684258eb53f414a8a59854767be526e6abb https://git.kernel.org/stable/c/b1d4d54d32ce6342f5faffe71bae736540ce7cb5 https://git.kernel.org/stable/c/08b91babccbb168353f8d43fea0ed28a4cad568c https://git.kernel.org/stable/c/a833a17aeac73b33f79433d7cee68d5cafd71e4f https://git.kernel.org/stable/c/1858b8a331937f3976d8482cd5f6e1f945294ad3 https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35904 – selinux: avoid dereference of garbage after mount failure
https://notcve.org/view.php?id=CVE-2024-35904
In the Linux kernel, the following vulnerability has been resolved: selinux: avoid dereference of garbage after mount failure In case kern_mount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer. While on it drop the never read static variable selinuxfs_mount. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: selinux: evita la desreferenciación de basura después de un error de montaje En caso de que kern_mount() falle y devuelva un puntero de error en la rama de error en lugar de continuar y desreferenciar el puntero de error. • https://git.kernel.org/stable/c/0619f0f5e36f12e100ef294f5980cfe7c93ff23e https://git.kernel.org/stable/c/477ed6789eb9f3f4d3568bb977f90c863c12724e https://git.kernel.org/stable/c/68784a5d01b8868ff85a7926676b6729715fff3c https://git.kernel.org/stable/c/37801a36b4d68892ce807264f784d818f8d0d39b http://www.openwall.com/lists/oss-security/2024/05/30/1 http://www.openwall.com/lists/oss-security/2024/05/30/2 https://access.redhat.com/security/cve/CVE-2024-35904 https://bugzilla.redhat.com/show_bug.cgi?id=2281655 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-35903 – x86/bpf: Fix IP after emitting call depth accounting
https://notcve.org/view.php?id=CVE-2024-35903
In the Linux kernel, the following vulnerability has been resolved: x86/bpf: Fix IP after emitting call depth accounting Adjust the IP passed to `emit_patch` so it calculates the correct offset for the CALL instruction if `x86_call_depth_emit_accounting` emits code. Otherwise we will skip some instructions and most likely crash. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: x86/bpf: corrige la IP después de emitir la contabilidad de profundidad de llamadas. • https://git.kernel.org/stable/c/b2e9dfe54be4d023124d588d6f03d16a9c0d2507 https://git.kernel.org/stable/c/3f9d57c771656bfd651e22edcfdb5f60e62542d4 https://git.kernel.org/stable/c/81166178cf0a0062a22b1b3b5368183d39577028 https://git.kernel.org/stable/c/9d98aa088386aee3db1b7b60b800c0fde0654a4a •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2024-35902 – net/rds: fix possible cp null dereference
https://notcve.org/view.php?id=CVE-2024-35902
In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cp->cp_conn would produce null dereference [Simon Horman adds:] Analysis: * cp is a parameter of __rds_rdma_map and is not reassigned. * The following call-sites pass a NULL cp argument to __rds_rdma_map() - rds_get_mr() - rds_get_mr_for_dest * Prior to the code above, the following assumes that cp may be NULL (which is indicative, but could itself be unnecessary) trans_private = rs->rs_transport->get_mr( sg, nents, rs, &mr->r_key, cp ? ... ODP_ZEROBASED : ODP_NOT_NEEDED); * The code modified by this patch is guarded by IS_ERR(trans_private), where trans_private is assigned as per the previous point in this analysis. The only implementation of get_mr that I could locate is rds_ib_get_mr() which can return an ERR_PTR if the conn (4th) argument is NULL. * ret is set to PTR_ERR(trans_private). rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL. Thus ret may be -ENODEV in which case the code in question will execute. Conclusion: * cp may be NULL at the point where this patch adds a check; this patch does seem to address a possible bug En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/rds: corrige la posible desreferencia nula de cp cp podría ser nulo, llamar a cp->cp_conn produciría una desreferencia nula [Simon Horman agrega:] Análisis: * cp es un parámetro de __rds_rdma_map y no es reasignado. * Los siguientes sitios de llamadas pasan un argumento cp NULL a __rds_rdma_map() - rds_get_mr() - rds_get_mr_for_dest * Antes del código anterior, lo siguiente supone que cp puede ser NULL (lo cual es indicativo, pero podría ser innecesario) trans_private = rs ->rs_transport->get_mr( sg, nents, rs, &mr->r_key, cp ? • https://git.kernel.org/stable/c/786854141057751bc08eb26f1b02e97c1631c8f4 https://git.kernel.org/stable/c/997efea2bf3a4adb96c306b9ad6a91442237bf5b https://git.kernel.org/stable/c/9dfc15a10dfd44f8ff7f27488651cb5be6af83c2 https://git.kernel.org/stable/c/b562ebe21ed9adcf42242797dd6cb75beef12bf0 https://git.kernel.org/stable/c/998fd719e6d6468b930ac0c44552ea9ff8b07b80 https://git.kernel.org/stable/c/2b505d05280739ce31d5708da840f42df827cb85 https://git.kernel.org/stable/c/c055fc00c07be1f0df7375ab0036cebd1106ed38 https://git.kernel.org/stable/c/907761307469adecb02461a14120e9a18 •