CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46748 – cachefiles: Set the max subreq size for cache writes to MAX_RW_COUNT
https://notcve.org/view.php?id=CVE-2024-46748
In the Linux kernel, the following vulnerability has been resolved: cachefiles: Set the max subreq size for cache writes to MAX_RW_COUNT Set the maximum size of a subrequest that writes to cachefiles to be MAX_RW_COUNT so that we don't overrun the maximum write we can make to the backing filesystem. • https://git.kernel.org/stable/c/cec226f9b1fd6cf55bc157873aec61b523083e96 https://git.kernel.org/stable/c/51d37982bbac3ea0ca21b2797a9cb0044272b3aa •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2024-46747 – HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
https://notcve.org/view.php?id=CVE-2024-46747
In the Linux kernel, the following vulnerability has been resolved: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it • https://git.kernel.org/stable/c/e239e44dcd419b13cf840e2a3a833204e4329714 https://git.kernel.org/stable/c/fac3cb3c6428afe2207593a183b5bc4742529dfd https://git.kernel.org/stable/c/34185de73d74fdc90e8651cfc472bfea6073a13f https://git.kernel.org/stable/c/890dde6001b651be79819ef7a3f8c71fc8f9cabf https://git.kernel.org/stable/c/e4a602a45aecd6a98b4b37482f5c9f8f67a32ddd https://git.kernel.org/stable/c/30e9ce7cd5591be639b53595c95812f1a2afdfdc https://git.kernel.org/stable/c/48b2108efa205f4579052c27fba2b22cc6ad8aa0 https://git.kernel.org/stable/c/a6e9c391d45b5865b61e569146304cff7 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-46746 – HID: amd_sfh: free driver_data after destroying hid device
https://notcve.org/view.php?id=CVE-2024-46746
In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data after destroying hid device HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? • https://git.kernel.org/stable/c/86b4f5cf91ca03c08e3822ac89476a677a780bcc https://git.kernel.org/stable/c/775125c7fe38533aaa4b20769f5b5e62cc1170a0 https://git.kernel.org/stable/c/60dc4ee0428d70bcbb41436b6729d29f1cbdfb89 https://git.kernel.org/stable/c/adb3e3c1ddb5a23b8b7122ef1913f528d728937c https://git.kernel.org/stable/c/97155021ae17b86985121b33cf8098bcde00d497 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2024-46745 – Input: uinput - reject requests with unreasonable number of slots
https://notcve.org/view.php?id=CVE-2024-46745
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request. Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts. • https://git.kernel.org/stable/c/9c6d189f0c1c59ba9a32326ec82a0b367a3cd47b https://git.kernel.org/stable/c/597ff930296c4c8fc6b6a536884d4f1a7187ec70 https://git.kernel.org/stable/c/51fa08edd80003db700bdaa099385c5900d27f4b https://git.kernel.org/stable/c/9719687398dea8a6a12a10321a54dd75eec7ab2d https://git.kernel.org/stable/c/61df76619e270a46fd427fbdeb670ad491c42de2 https://git.kernel.org/stable/c/a4858b00a1ec57043697fb935565fe267f161833 https://git.kernel.org/stable/c/d76fc0f0b18d49b7e721c9e4975ef4bffde2f3e7 https://git.kernel.org/stable/c/206f533a0a7c683982af473079c4111f4 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2024-46744 – Squashfs: sanity check symbolic link size
https://notcve.org/view.php?id=CVE-2024-46744
In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. -- V2: fix spelling mistake. • https://git.kernel.org/stable/c/f82cb7f24032ed023fc67d26ea9bf322d8431a90 https://git.kernel.org/stable/c/1b9451ba6f21478a75288ea3e3fca4be35e2a438 https://git.kernel.org/stable/c/5c8906de98d0d7ad42ff3edf2cb6cd7e0ea658c4 https://git.kernel.org/stable/c/087f25b2d36adae19951114ffcbb7106ed405ebb https://git.kernel.org/stable/c/fac5e82ab1334fc8ed6ff7183702df634bd1d93d https://git.kernel.org/stable/c/c3af7e460a526007e4bed1ce3623274a1a6afe5e https://git.kernel.org/stable/c/ef4e249971eb77ec33d74c5c3de1e2576faf6c90 https://git.kernel.org/stable/c/810ee43d9cd245d138a2733d87a24858a •