CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2023-52470 – drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
https://notcve.org/view.php?id=CVE-2023-52470
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() check the alloc_workqueue return value in radeon_crtc_init() to avoid null-ptr-deref. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/radeon: verifique el valor de retorno de alloc_workqueue en radeon_crtc_init() verifique el valor de retorno de alloc_workqueue en radeon_crtc_init() para evitar null-ptr-deref. A NULL pointer dereference flaw was found in alloc_workqueue in the Linux Kernel. Check the alloc_workqueue return value in radeon_crtc_init() to avoid null-ptr-deref. • https://git.kernel.org/stable/c/fa7f517cb26eb1a1a1f0baffcced39f6c3ec3337 https://git.kernel.org/stable/c/21b1645660717d6126dd4866c850fcc5c4703a41 https://git.kernel.org/stable/c/5d12c5d75f7c78b83a738025947651ec5c95b4d4 https://git.kernel.org/stable/c/57ca7984806d79b38af528de88fd803babf27feb https://git.kernel.org/stable/c/14bbfaa5df273b26cde6707f6e655585700e6fe1 https://git.kernel.org/stable/c/c4ff55408187f2595066967047363ca84e76db85 https://git.kernel.org/stable/c/0b813a6a0087451cb702b6eb841f10856f49d088 https://git.kernel.org/stable/c/fb2d8bc9b5e55848b8a7c3c028e2ee8d4 • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2023-52469 – drivers/amd/pm: fix a use-after-free in kv_parse_power_table
https://notcve.org/view.php?id=CVE-2023-52469
In the Linux kernel, the following vulnerability has been resolved: drivers/amd/pm: fix a use-after-free in kv_parse_power_table When ps allocated by kzalloc equals to NULL, kv_parse_power_table frees adev->pm.dpm.ps that allocated before. However, after the control flow goes through the following call chains: kv_parse_power_table |-> kv_dpm_init |-> kv_dpm_sw_init |-> kv_dpm_fini The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its first free in kv_parse_power_table and causes a use-after-free bug. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drivers/amd/pm: corrige un use-after-free en kv_parse_power_table Cuando ps asignado por kzalloc es igual a NULL, kv_parse_power_table libera adev->pm.dpm.ps que se asignó antes. Sin embargo, después de que el flujo de control pasa por las siguientes cadenas de llamadas: kv_parse_power_table |-> kv_dpm_init |-> kv_dpm_sw_init |-> kv_dpm_fini El adev->pm.dpm.ps se usa en el bucle for de kv_dpm_fini después de su primera liberación en kv_parse_power_table y provoca un error de use-after-free. A use-after-free flaw was found in kv_parse_power_table in drivers/amd/pm in the Linux kernel. • https://git.kernel.org/stable/c/a2e73f56fa6282481927ec43aa9362c03c2e2104 https://git.kernel.org/stable/c/8a27d9d9fc9b5564b8904c3a77a7dea482bfa34e https://git.kernel.org/stable/c/8b55b06e737feb2a645b0293ea27e38418876d63 https://git.kernel.org/stable/c/520e213a0b97b64735a13950e9371e0a5d7a5dc3 https://git.kernel.org/stable/c/b6dcba02ee178282e0d28684d241e0b8462dea6a https://git.kernel.org/stable/c/35fa2394d26e919f63600ce631e6aefc95ec2706 https://git.kernel.org/stable/c/95084632a65d5c0d682a83b55935560bdcd2a1e3 https://git.kernel.org/stable/c/3426f059eacc33ecc676b0d66539297e1 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52468 – class: fix use-after-free in class_register()
https://notcve.org/view.php?id=CVE-2023-52468
In the Linux kernel, the following vulnerability has been resolved: class: fix use-after-free in class_register() The lock_class_key is still registered and can be found in lock_keys_hash hlist after subsys_private is freed in error handler path.A task who iterate over the lock_keys_hash later may cause use-after-free.So fix that up and unregister the lock_class_key before kfree(cp). On our platform, a driver fails to kset_register because of creating duplicate filename '/class/xxx'.With Kasan enabled, it prints a invalid-access bug report. KASAN bug report: BUG: KASAN: invalid-access in lockdep_register_key+0x19c/0x1bc Write of size 8 at addr 15ffff808b8c0368 by task modprobe/252 Pointer tag: [15], memory tag: [fe] CPU: 7 PID: 252 Comm: modprobe Tainted: G W 6.6.0-mainline-maybe-dirty #1 Call trace: dump_backtrace+0x1b0/0x1e4 show_stack+0x2c/0x40 dump_stack_lvl+0xac/0xe0 print_report+0x18c/0x4d8 kasan_report+0xe8/0x148 __hwasan_store8_noabort+0x88/0x98 lockdep_register_key+0x19c/0x1bc class_register+0x94/0x1ec init_module+0xbc/0xf48 [rfkill] do_one_initcall+0x17c/0x72c do_init_module+0x19c/0x3f8 ... Memory state around the buggy address: ffffff808b8c0100: 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a ffffff808b8c0200: 8a 8a 8a 8a 8a 8a 8a 8a fe fe fe fe fe fe fe fe >ffffff808b8c0300: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ ffffff808b8c0400: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 As CONFIG_KASAN_GENERIC is not set, Kasan reports invalid-access not use-after-free here.In this case, modprobe is manipulating the corrupted lock_keys_hash hlish where lock_class_key is already freed before. It's worth noting that this only can happen if lockdep is enabled, which is not true for normal system. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clase: corrige use-after-free en class_register() Lock_class_key todavía está registrada y se puede encontrar en lock_keys_hash hlist después de que subsys_private se libere en la ruta del controlador de errores. Una tarea que itera sobre Lock_keys_hash más tarde puede causar use-after-free. Así que solucione eso y cancele el registro de lock_class_key antes de kfree (cp). En nuestra plataforma, un controlador no logra kset_register debido a que crea un nombre de archivo duplicado '/class/xxx'. • https://git.kernel.org/stable/c/dcfbb67e48a2becfce7990386e985b9c45098ee5 https://git.kernel.org/stable/c/b57196a5ec5e4c0ffecde8348b085b778c7dce04 https://git.kernel.org/stable/c/0f1486dafca3398c4c46b9f6e6452fa27e73b559 https://git.kernel.org/stable/c/93ec4a3b76404bce01bd5c9032bef5df6feb1d62 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-52467 – mfd: syscon: Fix null pointer dereference in of_syscon_register()
https://notcve.org/view.php?id=CVE-2023-52467
In the Linux kernel, the following vulnerability has been resolved: mfd: syscon: Fix null pointer dereference in of_syscon_register() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: mfd: syscon: corrige la desreferencia del puntero nulo en of_syscon_register() kasprintf() devuelve un puntero a la memoria asignada dinámicamente que puede ser NULL en caso de falla. A vulnerability was found in the Linux kernel, where A NULL pointer dereference flaw may occur in _syscon_register(). In this issue, kasprintf() returns a pointer to dynamically allocated memory, which can be NULL upon failure. • https://git.kernel.org/stable/c/e15d7f2b81d2e7d93115d46fa931b366c1cdebc2 https://git.kernel.org/stable/c/927626a2073887ee30ba00633260d4d203f8e875 https://git.kernel.org/stable/c/c3e3a2144bf50877551138ffce9f7aa6ddfe385b https://git.kernel.org/stable/c/527e8c5f3d00299822612c495d5adf1f8f43c001 https://git.kernel.org/stable/c/3ef1130deee98997275904d9bfc37af75e1e906c https://git.kernel.org/stable/c/7f2c410ac470959b88e03dadd94b7a0b71df7973 https://git.kernel.org/stable/c/41673c66b3d0c09915698fec5c13b24336f18dd1 https://lists.debian.org/debian-lts-announce/2024/06/ • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52465 – power: supply: Fix null pointer dereference in smb2_probe
https://notcve.org/view.php?id=CVE-2023-52465
In the Linux kernel, the following vulnerability has been resolved: power: supply: Fix null pointer dereference in smb2_probe devm_kasprintf and devm_kzalloc return a pointer to dynamically allocated memory which can be NULL upon failure. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: power: Supply: se corrigió la desreferencia del puntero nulo en smb2_probe, devm_kasprintf y devm_kzalloc devuelven un puntero a la memoria asignada dinámicamente que puede ser NULL en caso de falla. • https://git.kernel.org/stable/c/8648aeb5d7b70e13264ff5f444f22081d37d4670 https://git.kernel.org/stable/c/e2717302fbc20f148bcda362facee0444b949a3a https://git.kernel.org/stable/c/bd3d2ec447ede9da822addf3960a5f4275e3ae76 https://git.kernel.org/stable/c/88f04bc3e737155e13caddf0ba8ed19db87f0212 • CWE-476: NULL Pointer Dereference •