CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2024-47752 – media: mediatek: vcodec: Fix H264 stateless decoder smatch warning
https://notcve.org/view.php?id=CVE-2024-47752
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix H264 stateless decoder smatch warning Fix a smatch static checker warning on vdec_h264_req_if.c. Which leads to a kernel crash when fb is NULL. • https://git.kernel.org/stable/c/06fa5f757dc5a5687e1cdd13097c3265735f60bf https://git.kernel.org/stable/c/c6b9f971b43980de8893610f606d751131fb5d86 https://git.kernel.org/stable/c/18181b0c1c5bd43846e5e0ae3d61a4a1adceab03 https://git.kernel.org/stable/c/790d1848fac5ac3b1c474f66162598ab07a20c21 https://git.kernel.org/stable/c/7878d3a385efab560dce793b595447867fb163f2 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-47751 – PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
https://notcve.org/view.php?id=CVE-2024-47751
In the Linux kernel, the following vulnerability has been resolved: PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port() Within kirin_pcie_parse_port(), the pcie->num_slots is compared to pcie->gpio_id_reset size (MAX_PCI_SLOTS) which is correct and would lead to an overflow. Thus, fix condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and move pcie->num_slots increment below the if-statement to avoid out-of-bounds array access. Found by Linux Verification Center (linuxtesting.org) with SVACE. [kwilczynski: commit log] • https://git.kernel.org/stable/c/b22dbbb24571c052364f476381dbac110bdca4d5 https://git.kernel.org/stable/c/a5f795f9412854df28e66679c5e6b68b0b79c229 https://git.kernel.org/stable/c/95248d7497bcbfe7deed4805469c6ff6ddd7f9d1 https://git.kernel.org/stable/c/6dcc5b49d6607a741a14122bf3105f3ac50d259e https://git.kernel.org/stable/c/aeb0335971806e15ac91e838ca471936c8e7efd5 https://git.kernel.org/stable/c/c500a86693a126c9393e602741e348f80f1b0fc5 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-47750 – RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
https://notcve.org/view.php?id=CVE-2024-47750
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08 Currently rsv_qp is freed before ib_unregister_device() is called on HIP08. During the time interval, users can still dereg MR and rsv_qp will be used in this process, leading to a UAF. Move the release of rsv_qp after calling ib_unregister_device() to fix it. • https://git.kernel.org/stable/c/70f92521584f1d1e8268311ee84413307b0fdea8 https://git.kernel.org/stable/c/2ccf1c75d39949d8ea043d04a2e92d7100ea723d https://git.kernel.org/stable/c/d2d9c5127122745da6e887f451dd248cfeffca33 https://git.kernel.org/stable/c/dac2723d8bfa9cf5333f477741e6e5fa1ed34645 https://git.kernel.org/stable/c/60595923371c2ebe7faf82536c47eb0c967e3425 https://git.kernel.org/stable/c/fd8489294dd2beefb70f12ec4f6132aeec61a4d0 •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2024-47749 – RDMA/cxgb4: Added NULL check for lookup_atid
https://notcve.org/view.php?id=CVE-2024-47749
In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Added NULL check for lookup_atid The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the `act_establish()` and `act_open_rpl()` functions. Add a NULL check to prevent null pointer dereferencing. Found by Linux Verification Center (linuxtesting.org) with SVACE. • https://git.kernel.org/stable/c/cfdda9d764362ab77b11a410bb928400e6520d57 https://git.kernel.org/stable/c/b12e25d91c7f97958341538c7dc63ee49d01548f https://git.kernel.org/stable/c/4e1fe68d695af367506ea3c794c5969630f21697 https://git.kernel.org/stable/c/dd598ac57dcae796cb58551074660c39b43fb155 https://git.kernel.org/stable/c/b11318dc8a1ec565300bb1a9073095af817cc508 https://git.kernel.org/stable/c/39cb9f39913566ec5865581135f3e8123ad1aee1 https://git.kernel.org/stable/c/0d50ae281a1712b9b2ca72830a96b8f11882358d https://git.kernel.org/stable/c/54aaa3ed40972511e423b604324b88142 •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2024-47748 – vhost_vdpa: assign irq bypass producer token correctly
https://notcve.org/view.php?id=CVE-2024-47748
In the Linux kernel, the following vulnerability has been resolved: vhost_vdpa: assign irq bypass producer token correctly We used to call irq_bypass_unregister_producer() in vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the token pointer is still valid or not. Actually, we use the eventfd_ctx as the token so the life cycle of the token should be bound to the VHOST_SET_VRING_CALL instead of vhost_vdpa_setup_vq_irq() which could be called by set_status(). Fixing this by setting up irq bypass producer's token when handling VHOST_SET_VRING_CALL and un-registering the producer before calling vhost_vring_ioctl() to prevent a possible use after free as eventfd could have been released in vhost_vring_ioctl(). And such registering and unregistering will only be done if DRIVER_OK is set. • https://git.kernel.org/stable/c/2cf1ba9a4d15cb78b96ea97f727b93382c3f9a60 https://git.kernel.org/stable/c/0c170b1e918b9afac25e2bbd01eaa2bfc0ece8c0 https://git.kernel.org/stable/c/927a2580208e0f9b0b47b08f1c802b7233a7ba3c https://git.kernel.org/stable/c/ec5f1b54ceb23475049ada6e7a43452cf4df88d1 https://git.kernel.org/stable/c/ca64edd7ae93402af2596a952e0d94d545e2b9c0 https://git.kernel.org/stable/c/fae9b1776f53aab93ab345bdbf653b991aed717d https://git.kernel.org/stable/c/7cf2fb51175cafe01df8c43fa15a06194a59c6e2 https://git.kernel.org/stable/c/02e9e9366fefe461719da5d173385b668 •