CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-56772 – kunit: string-stream: Fix a UAF bug in kunit_init_suite()
https://notcve.org/view.php?id=CVE-2024-56772
08 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: kunit: string-stream: Fix a UAF bug in kunit_init_suite() In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the kunit_suite_for_each_test_case() loop, the "suite->log = stream" has assigned before, and the error path only free the suite->log's stream memory but not set it to NULL, so the later string_stream_clear() of suite->log in kunit_init_suite() will cause below UAF bug. Set stream pointer to NULL after free to fix it.... • https://git.kernel.org/stable/c/a3fdf784780ccb0008d630e8722d1389c49c7499 •
CVSS: 2.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-56771 – mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
https://notcve.org/view.php?id=CVE-2024-56771
08 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information These four chips: * W25N512GW * W25N01GW * W25N01JW * W25N02JW all require a single bit of ECC strength and thus feature an on-die Hamming-like ECC engine. There is no point in filling a ->get_status() callback for them because the main ECC status bytes are located in standard places, and retrieving the number of bitflips in case of corrected chunk is both useless and uns... • https://git.kernel.org/stable/c/6a804fb72de56d6a99b799f565ae45f2cec7cd55 •
CVSS: 10.0EPSS: 0%CPEs: 7EXPL: 0CVE-2024-56770 – net/sched: netem: account for backlog updates from child qdisc
https://notcve.org/view.php?id=CVE-2024-56770
08 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its children holds. In case of netem, 'qlen' only accounts for the packets in its internal tfifo. When netem is used with a child qdisc, the child qdisc can use 'qdisc_tree_reduce_backlog' to inform its parent, netem, about created or dropped SKBs. This function u... • https://git.kernel.org/stable/c/50612537e9ab29693122fab20fc1eed235054ffe •
CVSS: 7.2EPSS: 0%CPEs: 7EXPL: 0CVE-2024-56769 – media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
https://notcve.org/view.php?id=CVE-2024-56769
06 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg Syzbot reports [1] an uninitialized value issue found by KMSAN in dib3000_read_reg(). Local u8 rb[2] is used in i2c_transfer() as a read buffer; in case that call fails, the buffer may end up with some undefined values. Since no elaborate error handling is expected in dib3000_write_reg(), simply zero out rb buffer to mitigate the problem. [1] Syzkaller report dvb-usb: bu... • https://git.kernel.org/stable/c/74340b0a8bc60b400c7e5fe4950303aa6f914d16 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-56767 – dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
https://notcve.org/view.php?id=CVE-2024-56767
06 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset_create_desc may return NULL, which will lead to a null pointer dereference. For example, the len input is error, or the atchan->free_descs_list is empty and memory is exhausted. Therefore, add check to avoid this. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: at_xdmac: evitar null_prt_deref en at_xdmac_prep_dma_memset El... • https://git.kernel.org/stable/c/b206d9a23ac71cb905f5fb6e0cd813406f89b678 •
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 0CVE-2024-56766 – mtd: rawnand: fix double free in atmel_pmecc_create_user()
https://notcve.org/view.php?id=CVE-2024-56766
06 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmel_pmecc_create_user() The "user" pointer was converted from being allocated with kzalloc() to being allocated by devm_kzalloc(). Calling kfree(user) will lead to a double free. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mtd: rawnand: se corrige una liberación doble en atmel_pmecc_create_user(). El puntero "usuario" pasó de estar asignado con kzalloc() a estar asignado por devm_kza... • https://git.kernel.org/stable/c/22fbbc37edb840fd420fadf670366be9bf028426 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-56765 – powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
https://notcve.org/view.php?id=CVE-2024-56765
06 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct The mapping VMA address is saved in VAS window struct when the paste address is mapped. This VMA address is used during migration to unmap the paste address if the window is active. The paste address mapping will be removed when the window is closed or with the munmap(). But the VMA address in the VAS window is not updated with munmap() which is causing invalid access during mig... • https://git.kernel.org/stable/c/37e6764895ef7431f45ff603a548549d409993d2 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-56764 – ublk: detach gendisk from ublk device if add_disk() fails
https://notcve.org/view.php?id=CVE-2024-56764
06 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: ublk: detach gendisk from ublk device if add_disk() fails Inside ublk_abort_requests(), gendisk is grabbed for aborting all inflight requests. And ublk_abort_requests() is called when exiting the uring context or handling timeout. If add_disk() fails, the gendisk may have been freed when calling ublk_abort_requests(), so use-after-free can be caused when getting disk's reference in ublk_abort_requests(). Fixes the bug by detaching gendisk f... • https://git.kernel.org/stable/c/bd23f6c2c2d00518e2f27f2d25cef795de9bee56 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-56763 – tracing: Prevent bad count for tracing_cpumask_write
https://notcve.org/view.php?id=CVE-2024-56763
06 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing: Evitar recuento incorrecto para tracing_cpumask_write Si se proporciona un recuento alto, se activará una advertencia en bitmap_parse_user. También verifique que esté a cero. In the Linux kernel, the following vul... • https://git.kernel.org/stable/c/9e01c1b74c9531e301c900edaa92a99fcb7738f2 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-56761 – x86/fred: Clear WFE in missing-ENDBRANCH #CPs
https://notcve.org/view.php?id=CVE-2024-56761
06 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH #CPs An indirect branch instruction sets the CPU indirect branch tracker (IBT) into WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted across the instruction boundary. When the decoder finds an inappropriate instruction while WFE is set ENDBR, the CPU raises a #CP fault. For the "kernel IBT no ENDBR" selftest where #CPs are deliberately triggered, the WFE state of the interrupted context needs to ... • https://git.kernel.org/stable/c/a5f6c2ace9974adf92ce65dacca8126d90adabfe •