CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-26661 – drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
https://notcve.org/view.php?id=CVE-2024-26661
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to ensure the tg is not NULL. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: agregue prueba NULL para 'generador de sincronización' en 'dcn21_set_pipe()' en "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg podría ser NULL, depende de la persona que llama garantizar que el tg no sea NULL. A NULL pointer dereference flaw was found in the Linux kernel in dcn21_set_pipe(). This issue may lead to a crash. • https://git.kernel.org/stable/c/474ac4a875ca6fea3fc5183d3ad22ef7523dca53 https://git.kernel.org/stable/c/3f3c237a706580326d3b7a1b97697e5031ca4667 https://git.kernel.org/stable/c/39f24c08363af1cd945abad84e3c87fd3e3c845a https://git.kernel.org/stable/c/66951d98d9bf45ba25acf37fe0747253fafdf298 https://access.redhat.com/security/cve/CVE-2024-26661 https://bugzilla.redhat.com/show_bug.cgi?id=2272784 • CWE-476: NULL Pointer Dereference •
CVSS: 4.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-26660 – drm/amd/display: Implement bounds check for stream encoder creation in DCN301
https://notcve.org/view.php?id=CVE-2024-26660
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN301 'stream_enc_regs' array is an array of dcn10_stream_enc_registers structures. The array is initialized with four elements, corresponding to the four calls to stream_enc_regs() in the array initializer. This means that valid indices for this array are 0, 1, 2, and 3. The error message 'stream_enc_regs' 4 <= 5 below, is indicating that there is an attempt to access this array with an index of 5, which is out of bounds. This could lead to undefined behavior Here, eng_id is used as an index to access the stream_enc_regs array. If eng_id is 5, this would result in an out-of-bounds access on the stream_enc_regs array. Thus fixing Buffer overflow error in dcn301_stream_encoder_create reported by Smatch: drivers/gpu/drm/amd/amdgpu/.. • https://git.kernel.org/stable/c/3a83e4e64bb1522ddac67ffc787d1c38291e1a65 https://git.kernel.org/stable/c/42442f74314d41ddc68227047036fa3e78940054 https://git.kernel.org/stable/c/efdd665ce1a1634b8c1dad5e7f6baaef3e131d0a https://git.kernel.org/stable/c/cd9bd10c59e3c1446680514fd3097c5b00d3712d https://git.kernel.org/stable/c/a938eab9586eea31cfd129a507f552efae14d738 https://git.kernel.org/stable/c/58fca355ad37dcb5f785d9095db5f748b79c5dc2 https://access.redhat.com/security/cve/CVE-2024-26660 https://bugzilla.redhat.com/show_bug.cgi?id=2272782 • CWE-125: Out-of-bounds Read •
CVSS: 4.1EPSS: 0%CPEs: 6EXPL: 0CVE-2024-26659 – xhci: handle isoc Babble and Buffer Overrun events properly
https://notcve.org/view.php?id=CVE-2024-26659
In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids assuming that the xHC has released its ownership of a multi-TRB TD when it reports an error on one of the early TRBs. Yet the driver makes such assumption and releases the TD, allowing the remaining TRBs to be freed or overwritten by new TDs. The xHC should also report completion of the final TRB due to its IOC flag being set by us, regardless of prior errors. This event cannot be recognized if the TD has already been freed earlier, resulting in "Transfer event TRB DMA ptr not part of current TD" error message. Fix this by reusing the logic for processing isoc Transaction Errors. This also handles hosts which fail to report the final completion. Fix transfer length reporting on Babble errors. They may be caused by device malfunction, no guarantee that the buffer has been filled. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xhci: maneja correctamente los eventos isoc Babble y Buffer Overrun xHCI 4.9 prohíbe explícitamente suponer que xHC ha liberado su propiedad de un TD multi-TRB cuando informa un error en uno de los primeros TRB. • https://git.kernel.org/stable/c/696e4112e5c1ee61996198f0ebb6ca3fab55166e https://git.kernel.org/stable/c/2aa7bcfdbb46241c701811bbc0d64d7884e3346c https://git.kernel.org/stable/c/2e3ec80ea7ba58bbb210e83b5a0afefee7c171d3 https://git.kernel.org/stable/c/f5e7ffa9269a448a720e21f1ed1384d118298c97 https://git.kernel.org/stable/c/418456c0ce56209610523f21734c5612ee634134 https://git.kernel.org/stable/c/7c4650ded49e5b88929ecbbb631efb8b0838e811 https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html https://access.redhat.com/security/cve/CVE-2024 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2024-26658 – bcachefs: grab s_umount only if snapshotting
https://notcve.org/view.php?id=CVE-2024-26658
In the Linux kernel, the following vulnerability has been resolved: bcachefs: grab s_umount only if snapshotting When I was testing mongodb over bcachefs with compression, there is a lockdep warning when snapshotting mongodb data volume. $ cat test.sh prog=bcachefs $prog subvolume create /mnt/data $prog subvolume create /mnt/data/snapshots while true;do $prog subvolume snapshot /mnt/data /mnt/data/snapshots/$(date +%s) sleep 1s done $ cat /etc/mongodb.conf systemLog: destination: file logAppend: true path: /mnt/data/mongod.log storage: dbPath: /mnt/data/ lockdep reports: [ 3437.452330] ====================================================== [ 3437.452750] WARNING: possible circular locking dependency detected [ 3437.453168] 6.7.0-rc7-custom+ #85 Tainted: G E [ 3437.453562] ------------------------------------------------------ [ 3437.453981] bcachefs/35533 is trying to acquire lock: [ 3437.454325] ffffa0a02b2b1418 (sb_writers#10){.+.+}-{0:0}, at: filename_create+0x62/0x190 [ 3437.454875] but task is already holding lock: [ 3437.455268] ffffa0a02b2b10e0 (&type->s_umount_key#48){.+.+}-{3:3}, at: bch2_fs_file_ioctl+0x232/0xc90 [bcachefs] [ 3437.456009] which lock already depends on the new lock. [ 3437.456553] the existing dependency chain (in reverse order) is: [ 3437.457054] -> #3 (&type->s_umount_key#48){.+.+}-{3:3}: [ 3437.457507] down_read+0x3e/0x170 [ 3437.457772] bch2_fs_file_ioctl+0x232/0xc90 [bcachefs] [ 3437.458206] __x64_sys_ioctl+0x93/0xd0 [ 3437.458498] do_syscall_64+0x42/0xf0 [ 3437.458779] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 3437.459155] -> #2 (&c->snapshot_create_lock){++++}-{3:3}: [ 3437.459615] down_read+0x3e/0x170 [ 3437.459878] bch2_truncate+0x82/0x110 [bcachefs] [ 3437.460276] bchfs_truncate+0x254/0x3c0 [bcachefs] [ 3437.460686] notify_change+0x1f1/0x4a0 [ 3437.461283] do_truncate+0x7f/0xd0 [ 3437.461555] path_openat+0xa57/0xce0 [ 3437.461836] do_filp_open+0xb4/0x160 [ 3437.462116] do_sys_openat2+0x91/0xc0 [ 3437.462402] __x64_sys_openat+0x53/0xa0 [ 3437.462701] do_syscall_64+0x42/0xf0 [ 3437.462982] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 3437.463359] -> #1 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}: [ 3437.463843] down_write+0x3b/0xc0 [ 3437.464223] bch2_write_iter+0x5b/0xcc0 [bcachefs] [ 3437.464493] vfs_write+0x21b/0x4c0 [ 3437.464653] ksys_write+0x69/0xf0 [ 3437.464839] do_syscall_64+0x42/0xf0 [ 3437.465009] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 3437.465231] -> #0 (sb_writers#10){.+.+}-{0:0}: [ 3437.465471] __lock_acquire+0x1455/0x21b0 [ 3437.465656] lock_acquire+0xc6/0x2b0 [ 3437.465822] mnt_want_write+0x46/0x1a0 [ 3437.465996] filename_create+0x62/0x190 [ 3437.466175] user_path_create+0x2d/0x50 [ 3437.466352] bch2_fs_file_ioctl+0x2ec/0xc90 [bcachefs] [ 3437.466617] __x64_sys_ioctl+0x93/0xd0 [ 3437.466791] do_syscall_64+0x42/0xf0 [ 3437.466957] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 3437.467180] other info that might help us debug this: [ 3437.469670] 2 locks held by bcachefs/35533: other info that might help us debug this: [ 3437.467507] Chain exists of: sb_writers#10 --> &c->snapshot_create_lock --> &type->s_umount_key#48 [ 3437.467979] Possible unsafe locking scenario: [ 3437.468223] CPU0 CPU1 [ 3437.468405] ---- ---- [ 3437.468585] rlock(&type->s_umount_key#48); [ 3437.468758] lock(&c->snapshot_create_lock); [ 3437.469030] lock(&type->s_umount_key#48); [ 3437.469291] rlock(sb_writers#10); [ 3437.469434] *** DEADLOCK *** [ 3437.469 ---truncated--- En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bcachefs: toma s_umount solo si se toma una instantánea Cuando estaba probando mongodb sobre bcachefs con compresión, hay una advertencia de lockdep al tomar una instantánea del volumen de datos de mongodb. $ cat test.sh prog=bcachefs $prog subvolumen crear /mnt/data $prog subvolumen crear /mnt/data/snapshots mientras es verdadero;do $prog subvolumen snapshot /mnt/data /mnt/data/snapshots/$(fecha +% s) dormir 1 hecho $ cat /etc/mongodb.conf systemLog: destino: archivo logAppend: verdadera ruta: /mnt/data/mongod.log almacenamiento: dbPath: /mnt/data/ lockdep informes: [3437.452330] ==== ==================================================== [ 3437.452750] ADVERTENCIA: posible dependencia de bloqueo circular detectada [ 3437.453168] 6.7.0-rc7-custom+ #85 Contaminado: GE [ 3437.453562] ---------------------- -------------------------------- [ 3437.453981] bcachefs/35533 está intentando adquirir el bloqueo: [ 3437.454325] ffffa0a02b2b1418 (sb_writers #10){.+.+}-{0:0}, en: filename_create+0x62/0x190 [ 3437.454875] pero la tarea ya mantiene el bloqueo: [ 3437.455268] ffffa0a02b2b10e0 (&type->s_umount_key#48){.+.+ }-{3:3}, en: bch2_fs_file_ioctl+0x232/0xc90 [bcachefs] [ 3437.456009] cuyo bloqueo ya depende del nuevo bloqueo. [ 3437.456553] la cadena de dependencia existente (en orden inverso) es: [ 3437.457054] -> #3 (&type->s_umount_key#48){.+.+}-{3:3}: [ 3437.457507] down_read+0x3e/0x170 [ 3437.457772] bch2_fs_file_ioctl+0x232/0xc90 [bcachefs] [ 3437.458206] __x64_sys_ioctl+0x93/0xd0 [ 3437.458498] do_syscall_64+0x42/0xf0 [ 3437.458 779] Entry_SYSCALL_64_after_hwframe+0x6e/0x76 [3437.459155] -> #2 (&c->snapshot_create_lock){+ +++}-{3:3}: [ 3437.459615] down_read+0x3e/0x170 [ 3437.459878] bch2_truncate+0x82/0x110 [bcachefs] [ 3437.460276] bchfs_truncate+0x254/0x3c0 [bcachefs] [ 3437.4 60686] notificar_cambio+0x1f1/0x4a0 [ 3437.461283] do_truncate+0x7f/0xd0 [ 3437.461555] path_openat+0xa57/0xce0 [ 3437.461836] do_filp_open+0xb4/0x160 [ 3437.462116] do_sys_openat2+0x91/0xc0 [ 34 37.462402] __x64_sys_openat+0x53/0xa0 [ 3437.462701] do_syscall_64+0x42/0xf0 [ 3437.462982] Entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 3437.463359] -> #1 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}: [ 3437.463843] down_write+0x3b/0xc0 [ 3437.464223] bch2_write_it e+0x5b /0xcc0 [bcachefs] [ 3437.464493] vfs_write+0x21b/0x4c0 [ 3437.464653] ksys_write+0x69/0xf0 [ 3437.464839] do_syscall_64+0x42/0xf0 [ 3437.465009] entrada_SYSCALL _64_after_hwframe+0x6e/0x76 [ 3437.465231] -> #0 (sb_writers#10){ .+.+}-{0:0}: [ 3437.465471] __lock_acquire+0x1455/0x21b0 [ 3437.465656] lock_acquire+0xc6/0x2b0 [ 3437.465822] mnt_want_write+0x46/0x1a0 [ 3437.465996] nombre de archivo _create+0x62/0x190 [ 3437.466175] ruta_usuario_create+0x2d /0x50 [ 3437.466352] bch2_fs_file_ioctl+0x2ec/0xc90 [bcachefs] [ 3437.466617] __x64_sys_ioctl+0x93/0xd0 [ 3437.466791] do_syscall_64+0x42/0xf0 [ 3437 .466957] Entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 3437.467180] otra información que podría ayudarnos a depurar esto: [ 3437.469670] 2 bloqueos mantenidos por bcachefs/35533: otra información que podría ayudarnos a depurar esto: [3437.467507] Existe cadena de: sb_writers#10 --> &c->snapshot_create_lock --> &type->s_umount_key#48 [3437.467979] Posiblemente inseguro escenario de bloqueo: [3437.468223] CPU0 CPU1 [3437.468405] ---- ---- [3437.468585] rlock(&type->s_umount_key#48); [ 3437.468758] bloqueo(&c->snapshot_create_lock); [ 3437.469030] bloqueo(&type->s_umount_key#48); [3437.469291] rlock(sb_writers#10); [ 3437.469434] *** INTERBLOQUEO *** [ 3437.469 ---truncado--- • https://git.kernel.org/stable/c/5b41d3fd04c6757b9c2a60a0c5b2609cae9999df https://git.kernel.org/stable/c/2acc59dd88d27ad69b66ded80df16c042b04eeec •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-52631 – fs/ntfs3: Fix an NULL dereference bug
https://notcve.org/view.php?id=CVE-2023-52631
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_load_attr_list(). The "size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow on a 64bit systems but on 32bit systems the "+ 1023" can overflow and the result is zero. This means that the kmalloc will succeed by returning the ZERO_SIZE_PTR and then the memcpy() will crash with an Oops on the next line. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: fs/ntfs3: corrige un error de desreferencia NULL El problema aquí es cuando se llama desde ntfs_load_attr_list(). El "tamaño" proviene de le32_to_cpu(attr->res.data_size), por lo que no puede desbordarse en sistemas de 64 bits, pero en sistemas de 32 bits el "+ 1023" puede desbordarse y el resultado es cero. • https://git.kernel.org/stable/c/be71b5cba2e6485e8959da7a9f9a44461a1bb074 https://git.kernel.org/stable/c/ae4acad41b0f93f1c26cc0fc9135bb79d8282d0b https://git.kernel.org/stable/c/ec1bedd797588fe38fc11cba26d77bb1d9b194c6 https://git.kernel.org/stable/c/fb7bcd1722bc9bc55160378f5f99c01198fd14a7 https://git.kernel.org/stable/c/686820fe141ea0220fc6fdfc7e5694f915cf64b2 https://git.kernel.org/stable/c/b2dd7b953c25ffd5912dda17e980e7168bebcf6c • CWE-476: NULL Pointer Dereference •