CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-48942 – hwmon: Handle failure to register sensor with thermal zone correctly
https://notcve.org/view.php?id=CVE-2022-48942
22 Aug 2024 — In the Linux kernel, the following vulnerability has been resolved: hwmon: Handle failure to register sensor with thermal zone correctly If an attempt is made to a sensor with a thermal zone and it fails, the call to devm_thermal_zone_of_sensor_register() may return -ENODEV. This may result in crashes similar to the following. Unable to handle kernel NULL pointer dereference at virtual address 00000000000003cd ... Internal error: Oops: 96000021 [#1] PREEMPT SMP ... pstate: 60400009 (nZCv daif +PAN -UAO -TCO... • https://git.kernel.org/stable/c/1597b374af22266266e1e20612208c4b11359ad4 • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-48925 – RDMA/cma: Do not change route.addr.src_addr outside state checks
https://notcve.org/view.php?id=CVE-2022-48925
22 Aug 2024 — In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.src_addr outside state checks If the state is not idle then resolve_prepare_src() should immediately fail and no change to global state should happen. However, it unconditionally overwrites the src_addr trying to build a temporary any address. For instance if the state is already RDMA_CM_LISTEN then this will corrupt the src_addr and would cause the test in cma_cancel_operation(): if (cma_any_addr(cma_src_... • https://git.kernel.org/stable/c/732d41c545bb359cbb8c94698bdc1f8bcf82279c •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2022-48924 – thermal: int340x: fix memory leak in int3400_notify()
https://notcve.org/view.php?id=CVE-2022-48924
22 Aug 2024 — In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: fix memory leak in int3400_notify() It is easy to hit the below memory leaks in my TigerLake platform: unreferenced object 0xffff927c8b91dbc0 (size 32): comm "kworker/0:2", pid 112, jiffies 4294893323 (age 83.604s) hex dump (first 32 bytes): 4e 41 4d 45 3d 49 4e 54 33 34 30 30 20 54 68 65 NAME=INT3400 The 72 6d 61 6c 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 rmal.kkkkkkkkkk. backtrace: [
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-48923 – btrfs: prevent copying too big compressed lzo segment
https://notcve.org/view.php?id=CVE-2022-48923
22 Aug 2024 — In the Linux kernel, the following vulnerability has been resolved: btrfs: prevent copying too big compressed lzo segment Compressed length can be corrupted to be a lot larger than memory we have allocated for buffer. This will cause memcpy in copy_compressed_segment to write outside of allocated memory. This mostly results in stuck read syscall but sometimes when using btrfs send can get #GP kernel: general protection fault, probably for non-canonical address 0x841551d5c1000: 0000 [#1] PREEMPT SMP NOPTI ke... • https://git.kernel.org/stable/c/8df508b7a44cd8110c726057cd28e8f8116885eb •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-48922 – riscv: fix oops caused by irqsoff latency tracer
https://notcve.org/view.php?id=CVE-2022-48922
22 Aug 2024 — In the Linux kernel, the following vulnerability has been resolved: riscv: fix oops caused by irqsoff latency tracer The trace_hardirqs_{on,off}() require the caller to setup frame pointer properly. This because these two functions use macro 'CALLER_ADDR1' (aka. __builtin_return_address(1)) to acquire caller info. If the $fp is used for other purpose, the code generated this macro (as below) could trigger memory access fault. 0xffffffff8011510e <+80>: ld a1,-16(s0) 0xffffffff80115112 <+84>: ld s2,-8(a1) # <... • https://git.kernel.org/stable/c/3c46979829824da5af8766d89fa877976bdae884 •
CVSS: 4.7EPSS: 0%CPEs: 5EXPL: 0CVE-2022-48921 – sched/fair: Fix fault in reweight_entity
https://notcve.org/view.php?id=CVE-2022-48921
22 Aug 2024 — In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix fault in reweight_entity Syzbot found a GPF in reweight_entity. This has been bisected to commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") There is a race between sched_post_fork() and setpriority(PRIO_PGRP) within a thread group that causes a null-ptr-deref in reweight_entity() in CFS. The scenario is that the main process spawns number of new threads, which then call setpriority(PRI... • https://git.kernel.org/stable/c/c85c6fadbef0a3eab41540ea628fa8fe8928c820 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-48920 – btrfs: get rid of warning on transaction commit when using flushoncommit
https://notcve.org/view.php?id=CVE-2022-48920
22 Aug 2024 — In the Linux kernel, the following vulnerability has been resolved: btrfs: get rid of warning on transaction commit when using flushoncommit When using the flushoncommit mount option, during almost every transaction commit we trigger a warning from __writeback_inodes_sb_nr(): $ cat fs/fs-writeback.c: (...) static void __writeback_inodes_sb_nr(struct super_block *sb, ... { (...) WARN_ON(!rwsem_is_locked(&sb->s_umount)); (...) } (...) The trace produced in dmesg looks like the following: [947.473890] WARNING:... • https://git.kernel.org/stable/c/850a77c999b81dd2724efd2684068d6f90db8c16 •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2022-48919 – cifs: fix double free race when mount fails in cifs_get_root()
https://notcve.org/view.php?id=CVE-2022-48919
22 Aug 2024 — In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifs_get_root() When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_free() which will free the context. In this situation we should not proceed to enter the out: section in cifs_smb3_do_mount() and free the same resources a second time. [Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60 [T... • https://git.kernel.org/stable/c/da834d6c1147c7519a9e55b510a03b7055104749 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2022-48917 – ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min
https://notcve.org/view.php?id=CVE-2022-48917
22 Aug 2024 — In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min While the $val/$val2 values passed in from userspace are always >= 0 integers, the limits of the control can be signed integers and the $min can be non-zero and less than zero. To correctly validate $val/$val2 against platform_max, add the $min offset to val first. In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Shift tested values in snd_soc_put_vo... • https://git.kernel.org/stable/c/40f598698129b5ceaf31012f9501b775c7b6e57d •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-48915 – thermal: core: Fix TZ_GET_TRIP NULL pointer dereference
https://notcve.org/view.php?id=CVE-2022-48915
22 Aug 2024 — In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference Do not call get_trip_hyst() from thermal_genl_cmd_tz_get_trip() if the thermal zone does not define one. In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference Do not call get_trip_hyst() from thermal_genl_cmd_tz_get_trip() if the thermal zone does not define one. • https://git.kernel.org/stable/c/1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00 • CWE-476: NULL Pointer Dereference •