CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52829 – wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps()
https://notcve.org/view.php?id=CVE-2023-52829
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps() reg_cap.phy_id is extracted from WMI event and could be an unexpected value in case some errors happen. As a result out-of-bound write may occur to soc->hal_reg_cap. Fix it by validating reg_cap.phy_id before using it. This is found during code review. Compile tested only. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: wifi: ath12k: corrige una posible escritura fuera de los límites en ath12k_wmi_ext_hal_reg_caps() reg_cap.phy_id se extrae del evento WMI y podría ser un valor inesperado en caso de que ocurran algunos errores. Como resultado, puede ocurrir una escritura fuera de los límites en soc->hal_reg_cap. • https://git.kernel.org/stable/c/dfe13eaab043130f90dd3d57c7d88577c04adc97 https://git.kernel.org/stable/c/4dd0547e8b45faf6f95373be5436b66cde326c0e https://git.kernel.org/stable/c/b302dce3d9edea5b93d1902a541684a967f3c63c •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2023-52828 – bpf: Detect IP == ksym.end as part of BPF program
https://notcve.org/view.php?id=CVE-2023-52828
In the Linux kernel, the following vulnerability has been resolved: bpf: Detect IP == ksym.end as part of BPF program Now that bpf_throw kfunc is the first such call instruction that has noreturn semantics within the verifier, this also kicks in dead code elimination in unprecedented ways. For one, any instruction following a bpf_throw call will never be marked as seen. Moreover, if a callchain ends up throwing, any instructions after the call instruction to the eventually throwing subprog in callers will also never be marked as seen. The tempting way to fix this would be to emit extra 'int3' instructions which bump the jited_len of a program, and ensure that during runtime when a program throws, we can discover its boundaries even if the call instruction to bpf_throw (or to subprogs that always throw) is emitted as the final instruction in the program. An example of such a program would be this: do_something(): ... r0 = 0 exit foo(): r1 = 0 call bpf_throw r0 = 0 exit bar(cond): if r1 != 0 goto pc+2 call do_something exit call foo r0 = 0 // Never seen by verifier exit // main(ctx): r1 = ... call bar r0 = 0 exit Here, if we do end up throwing, the stacktrace would be the following: bpf_throw foo bar main In bar, the final instruction emitted will be the call to foo, as such, the return address will be the subsequent instruction (which the JIT emits as int3 on x86). This will end up lying outside the jited_len of the program, thus, when unwinding, we will fail to discover the return address as belonging to any program and end up in a panic due to the unreliable stack unwinding of BPF programs that we never expect. To remedy this case, make bpf_prog_ksym_find treat IP == ksym.end as part of the BPF program, so that is_bpf_text_address returns true when such a case occurs, and we are able to unwind reliably when the final instruction ends up being a call instruction. • https://git.kernel.org/stable/c/6058e4829696412457729a00734969acc6fd1d18 https://git.kernel.org/stable/c/cf353904a82873e952633fcac4385c2fcd3a46e1 https://git.kernel.org/stable/c/aa42a7cb92647786719fe9608685da345883878f https://git.kernel.org/stable/c/327b92e8cb527ae097961ffd1610c720481947f5 https://git.kernel.org/stable/c/821a7e4143af115b840ec199eb179537e18af922 https://git.kernel.org/stable/c/66d9111f3517f85ef2af0337ece02683ce0faf21 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2023-52827 – wifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats()
https://notcve.org/view.php?id=CVE-2023-52827
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats() len is extracted from HTT message and could be an unexpected value in case errors happen, so add validation before using to avoid possible out-of-bound read in the following message iteration and parsing. The same issue also applies to ppdu_info->ppdu_stats.common.num_users, so validate it before using too. These are found during code review. Compile test only. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: wifi: ath12k: corrige una posible lectura fuera de los límites en ath12k_htt_pull_ppdu_stats(). len se extrae del mensaje HTT y podría ser un valor inesperado en caso de que ocurran errores, así que agregue validación antes de usarlo para evitar una posible lectura fuera de los límites en la siguiente iteración y análisis del mensaje. El mismo problema también se aplica a ppdu_info->ppdu_stats.common.num_users, así que valídelo antes de usarlo también. Estos se encuentran durante la revisión del código. Compilar prueba únicamente. • https://git.kernel.org/stable/c/79527c21a3ce04cffc35ea54f74ee087e532be57 https://git.kernel.org/stable/c/c9e44111da221246efb2e623ae1be40a5cf6542c https://git.kernel.org/stable/c/1bc44a505a229bb1dd4957e11aa594edeea3690e • CWE-125: Out-of-bounds Read •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2023-52826 – drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
https://notcve.org/view.php?id=CVE-2023-52826
In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference In tpg110_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/panel/panel-tpo-tpg110: corrige una posible desreferencia del puntero null. En tpg110_get_modes(), el valor de retorno de drm_mode_duplicate() se asigna al modo, lo que conducirá a un Desreferencia del puntero NULL en caso de fallo de drm_mode_duplicate(). Agregue una marca para evitar npd. • https://git.kernel.org/stable/c/9acc2bc00135e9ecd13a70ce1140e2673e504cdc https://git.kernel.org/stable/c/84c923d898905187ebfd4c0ef38cd1450af7e0ea https://git.kernel.org/stable/c/d0bc9ab0a161a9745273f5bf723733a8e6c57aca https://git.kernel.org/stable/c/9268bfd76bebc85ff221691b61498cc16d75451c https://git.kernel.org/stable/c/eaede6900c0961b072669d6bd97fe8f90ed1900f https://git.kernel.org/stable/c/f22def5970c423ea7f87d5247bd0ef91416b0658 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2023-52825 – drm/amdkfd: Fix a race condition of vram buffer unref in svm code
https://notcve.org/view.php?id=CVE-2023-52825
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix a race condition of vram buffer unref in svm code prange->svm_bo unref can happen in both mmu callback and a callback after migrate to system ram. Both are async call in different tasks. Sync svm_bo unref operation to avoid random "use-after-free". En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdkfd: se corrige una condición de ejecución de vram buffer unref en el código svm prange->svm_bo unref puede ocurrir tanto en la devolución de llamada mmu como en una devolución de llamada después de migrar a la memoria RAM del sistema. Ambas son llamadas asíncronas en diferentes tareas. • https://git.kernel.org/stable/c/7d43cdd22cd81a2b079e864c4321b9aba4c6af34 https://git.kernel.org/stable/c/50f35a907c4f9ed431fd3dbb8b871ef1cbb0718e https://git.kernel.org/stable/c/c772eacbd6d0845fc922af8716bb9d29ae27b8cf https://git.kernel.org/stable/c/fc0210720127cc6302e6d6f3de48f49c3fcf5659 https://git.kernel.org/stable/c/709c348261618da7ed89d6c303e2ceb9e453ba74 •