CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46837 – drm/panthor: Restrict high priorities on group_create
https://notcve.org/view.php?id=CVE-2024-46837
27 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Restrict high priorities on group_create We were allowing any users to create a high priority group without any permission checks. As a result, this was allowing possible denial of service. We now only allow the DRM master or users with the CAP_SYS_NICE capability to set higher priorities than PANTHOR_GROUP_PRIORITY_MEDIUM. As the sole user of that uAPI lives in Mesa and hardcode a value of MEDIUM [1], this should be safe to do... • https://git.kernel.org/stable/c/de85488138247d034eb3241840424a54d660926b •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-46836 – usb: gadget: aspeed_udc: validate endpoint index for ast udc
https://notcve.org/view.php?id=CVE-2024-46836
27 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed_udc: validate endpoint index for ast udc We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed_udc: validate endpoint index for ast udc We should verify the bound of the array to assure that host may not manipulate the index to point past endpoi... • https://git.kernel.org/stable/c/31bd4fab49c0adc6228848357c1b1df9395858af •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-46835 – drm/amdgpu: Fix smatch static checker warning
https://notcve.org/view.php?id=CVE-2024-46835
27 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix smatch static checker warning adev->gfx.imu.funcs could be NULL Ubuntu Security Notice 7156-1 - Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the sy... • https://git.kernel.org/stable/c/d40c2c3dd0395fe7fdc19bd96551e87251426d66 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46834 – ethtool: fail closed if we can't get max channel used in indirection tables
https://notcve.org/view.php?id=CVE-2024-46834
27 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with active RSS contexts") proves that allowing indirection table to contain channels with out of bounds IDs may lead to crashes. Currently the max channel check in the core gets skipped if driver can't fetch the indirection table or when we can't allocate memory. Both of those conditions should be ext... • https://git.kernel.org/stable/c/101737d8b88dbd4be6010bac398fe810f1950036 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46833 – net: hns3: void array out of bound when loop tnl_num
https://notcve.org/view.php?id=CVE-2024-46833
27 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: net: hns3: void array out of bound when loop tnl_num When query reg inf of SSU, it loops tnl_num times. However, tnl_num comes from hardware and the length of array is a fixed value. To void array out of bound, make sure the loop time is not greater than the length of array In the Linux kernel, the following vulnerability has been resolved: net: hns3: void array out of bound when loop tnl_num When query reg inf of SSU, it loops tnl_num time... • https://git.kernel.org/stable/c/c33a9806dc806bcb4a31dc71fb06979219181ad4 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-46832 – MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
https://notcve.org/view.php?id=CVE-2024-46832
27 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed This avoids warning: [ 0.118053] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 Caused by get_c0_compare_int on secondary CPU. We also skipped saving IRQ number to struct clock_event_device *cd as it's never used by clockevent core, as per comments it's only meant for "non CPU local devices". In the Linux kernel, the following vulnerabi... • https://git.kernel.org/stable/c/d3ff0f98a52f0aafe35aa314d1c442f4318be3db •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-46831 – net: microchip: vcap: Fix use-after-free error in kunit test
https://notcve.org/view.php?id=CVE-2024-46831
27 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: Fix use-after-free error in kunit test This is a clear use-after-free error. We remove it, and rely on checking the return code of vcap_del_rule. In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: Fix use-after-free error in kunit test This is a clear use-after-free error. We remove it, and rely on checking the return code of vcap_del_rule. Ubuntu Security Notice 7156-1 - Chenyuan... • https://git.kernel.org/stable/c/c956b9b318d9036701c471dd458f9ed31defc629 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-46830 – KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
https://notcve.org/view.php?id=CVE-2024-46830
27 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX reads guest memory. Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN via sync_regs(), which already holds SRCU. I.e. trying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would caus... • https://git.kernel.org/stable/c/f7e570780efc5cec9b2ed1e0472a7da14e864fdb •
CVSS: 5.5EPSS: 0%CPEs: 14EXPL: 0CVE-2024-46829 – rtmutex: Drop rt_mutex::wait_lock before scheduling
https://notcve.org/view.php?id=CVE-2024-46829
27 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case it emits a warning and goes into an endless scheduling loop with the lock held, which triggers the 'scheduling in atomic' warning. Unlock rt_mutex::wait_lock in the dead lock case before issuing the warning and dropping into the schedule for ever loop.... • https://git.kernel.org/stable/c/3d5c9340d1949733eb37616abd15db36aef9a57c •
CVSS: 7.2EPSS: 0%CPEs: 7EXPL: 0CVE-2024-46828 – sched: sch_cake: fix bulk flow accounting logic for host fairness
https://notcve.org/view.php?id=CVE-2024-46828
27 Sep 2024 — In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: fix bulk flow accounting logic for host fairness In sch_cake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is used as the round-robin weight when iterating through flows. The count of active bulk flows is updated whenever a flow changes state. This has a peculiar interaction with the hash collision handling: when a hash collision occurs (after the set-associativ... • https://git.kernel.org/stable/c/712639929912c5eefb09facccb48d55b3f72c9f8 •