CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2022-48987 – media: v4l2-dv-timings.c: fix too strict blanking sanity checks
https://notcve.org/view.php?id=CVE-2022-48987
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-dv-timings.c: fix too strict blanking sanity checks Sanity checks were added to verify the v4l2_bt_timings blanking fields in order to avoid integer overflows when userspace passes weird values. But that assumed that userspace would correctly fill in the front porch, backporch and sync values, but sometimes all you know is the total blanking, which is then assigned to just one of these fields. And that can fail with these checks. So instead set a maximum for the total horizontal and vertical blanking and check that each field remains below that. That is still sufficient to avoid integer overflows, but it also allows for more flexibility in how userspace fills in these fields. • https://git.kernel.org/stable/c/15ded23db134da975b49ea99770de0346c193b24 https://git.kernel.org/stable/c/3d43b2b8a3cdadd6cef9ac8ef5d156b6214a01c8 https://git.kernel.org/stable/c/9cf9211635b68e8e0c8cb88d43ca7dc83e4632aa https://git.kernel.org/stable/c/b4a3a01762ae072c7f6ff2ff53b5019761288346 https://git.kernel.org/stable/c/683015ae163481457a16fad2317af66360dc4762 https://git.kernel.org/stable/c/491c0959f01d87bcbd5a1498bc70e0a3382c65a8 https://git.kernel.org/stable/c/dc7276c3f6ca008be1faf531f84b49906c9bcf7f https://git.kernel.org/stable/c/0d73b49c4037199472b29574ae21c21ae •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2022-48986 – mm/gup: fix gup_pud_range() for dax
https://notcve.org/view.php?id=CVE-2022-48986
In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix gup_pud_range() for dax For dax pud, pud_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 ("mm/gup: fix gup_pmd_range() for dax") fixed devmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as well. This fixes the below kernel panic: general protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP < snip > Call Trace: <TASK> get_user_pages_fast+0x1f/0x40 iov_iter_get_pages+0xc6/0x3b0 ? mempool_alloc+0x5d/0x170 bio_iov_iter_get_pages+0x82/0x4e0 ? • https://git.kernel.org/stable/c/414fd080d125408cb15d04ff4907e1dd8145c8c7 https://git.kernel.org/stable/c/c133d8eb894cb280f331608c6f1962ba9fbfe6b0 https://git.kernel.org/stable/c/538162d21ac877b060dc057c89f13718f5caffc5 https://git.kernel.org/stable/c/8b1a7762e0dac5db42a003009fdcb425f10baa07 https://git.kernel.org/stable/c/04edfa3dc06ecfc6133a33bc7271298782dee875 https://git.kernel.org/stable/c/f1cf856123ceb766c49967ec79b841030fa1741f https://git.kernel.org/stable/c/3ac29732a2ffa64c7de13a072b0f2848b9c11037 https://git.kernel.org/stable/c/e06d13c36ded750c72521b600293befeb •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-48982 – Bluetooth: Fix crash when replugging CSR fake controllers
https://notcve.org/view.php?id=CVE-2022-48982
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix crash when replugging CSR fake controllers It seems fake CSR 5.0 clones can cause the suspend notifier to be registered twice causing the following kernel panic: [ 71.986122] Call Trace: [ 71.986124] <TASK> [ 71.986125] blocking_notifier_chain_register+0x33/0x60 [ 71.986130] hci_register_dev+0x316/0x3d0 [bluetooth 99b5497ea3d09708fa1366c1dc03288bf3cca8da] [ 71.986154] btusb_probe+0x979/0xd85 [btusb e1e0605a4f4c01984a4b9c8ac58c3666ae287477] [ 71.986159] ? __pm_runtime_set_status+0x1a9/0x300 [ 71.986162] ? ktime_get_mono_fast_ns+0x3e/0x90 [ 71.986167] usb_probe_interface+0xe3/0x2b0 [ 71.986171] really_probe+0xdb/0x380 [ 71.986174] ? pm_runtime_barrier+0x54/0x90 [ 71.986177] __driver_probe_device+0x78/0x170 [ 71.986180] driver_probe_device+0x1f/0x90 [ 71.986183] __device_attach_driver+0x89/0x110 [ 71.986186] ? driver_allows_async_probing+0x70/0x70 [ 71.986189] bus_for_each_drv+0x8c/0xe0 [ 71.986192] __device_attach+0xb2/0x1e0 [ 71.986195] bus_probe_device+0x92/0xb0 [ 71.986198] device_add+0x422/0x9a0 [ 71.986201] ? • https://git.kernel.org/stable/c/549b46f8130effccf168293270bb3b1d5da529cc https://git.kernel.org/stable/c/a49894a5ac3656f1a4f0f6b110460060e8026bf8 https://git.kernel.org/stable/c/dc8fa6570deadb70c3fb74d7cd8ce38849feaed0 https://git.kernel.org/stable/c/b5ca338751ad4783ec8d37b5d99c3e37b7813e59 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2022-48981 – drm/shmem-helper: Remove errant put in error path
https://notcve.org/view.php?id=CVE-2022-48981
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free. • https://git.kernel.org/stable/c/2194a63a818db71065ebe09c8104f5f021ca4e7b https://git.kernel.org/stable/c/585a07b820059462e0c93b76c7de2cd946b26b40 https://git.kernel.org/stable/c/6a4da05acd062ae7774b6b19cef2b7d922902d36 https://git.kernel.org/stable/c/83e3da8bb92fcfa7a1d232cf55f9e6c49bb84942 https://git.kernel.org/stable/c/586847b98e20ab02212ca5c1fc46680384e68a28 https://git.kernel.org/stable/c/24013314be6ee4ee456114a671e9fa3461323de8 •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2022-48979 – drm/amd/display: fix array index out of bound error in DCN32 DML
https://notcve.org/view.php?id=CVE-2022-48979
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix array index out of bound error in DCN32 DML [Why&How] LinkCapacitySupport array is indexed with the number of voltage states and not the number of max DPPs. Fix the error by changing the array declaration to use the correct (larger) array size of total number of voltage states. • https://git.kernel.org/stable/c/3d8a298b2e83b98042e6ec726e934f535b23e6aa https://git.kernel.org/stable/c/aeffc8fb2174f017a10df114bc312f899904dc68 •