Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2023-52594	wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug handling code after the check. Make the function return if that is the case. Found by a modified version of syzkaller. UBSAN: array-index-out-of-bounds in htc_drv_txrx.c index 13 is out of range for type '__wmi_event_txstatus [12]' Call Trace: ath9k_htc_txstatus ath9k_wmi_event_tasklet tasklet_action_common __do_softirq irq_exit_rxu sysvec_apic_timer_interrupt EPSS Score: 0.04% Source: CVE December 20th, 2024 (6 months ago)
CVE-2023-52593	wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() Description: In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() Since 'ieee80211_beacon_get()' can return NULL, 'wfx_set_mfp_ap()' should check the return value before examining skb data. So convert the latter to return an appropriate error code and propagate it to return from 'wfx_start_ap()' as well. Compile tested only. EPSS Score: 0.04% Source: CVE December 20th, 2024 (6 months ago)
CVE-2023-52591	reiserfs: Avoid touching renamed directory if parent does not change Description: In the Linux kernel, the following vulnerability has been resolved: reiserfs: Avoid touching renamed directory if parent does not change The VFS will not be locking moved directory if its parent does not change. Change reiserfs rename code to avoid touching renamed directory if its parent does not change as without locking that can corrupt the filesystem. EPSS Score: 0.05% Source: CVE December 20th, 2024 (6 months ago)
CVE-2023-52590	ocfs2: Avoid touching renamed directory if parent does not change Description: In the Linux kernel, the following vulnerability has been resolved: ocfs2: Avoid touching renamed directory if parent does not change The VFS will not be locking moved directory if its parent does not change. Change ocfs2 rename code to avoid touching renamed directory if its parent does not change as without locking that can corrupt the filesystem. EPSS Score: 0.04% Source: CVE December 20th, 2024 (6 months ago)
CVE-2023-52589	media: rkisp1: Fix IRQ disable race issue Description: In the Linux kernel, the following vulnerability has been resolved: media: rkisp1: Fix IRQ disable race issue In rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks the interrupts and then apparently assumes that the interrupt handler won't be running, and proceeds in the stop procedure. This is not the case, as the interrupt handler can already be running, which would lead to the ISP being disabled while the interrupt handler handling a captured frame. This brings up two issues: 1) the ISP could be powered off while the interrupt handler is still running and accessing registers, leading to board lockup, and 2) the interrupt handler code and the code that disables the streaming might do things that conflict. It is not clear to me if 2) causes a real issue, but 1) can be seen with a suitable delay (or printk in my case) in the interrupt handler, leading to board lockup. EPSS Score: 0.05% Source: CVE December 20th, 2024 (6 months ago)
CVE-2023-52588	f2fs: fix to tag gcing flag on page during block migration Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to tag gcing flag on page during block migration It needs to add missing gcing flag on page during block migration, in order to garantee migrated data be persisted during checkpoint, otherwise out-of-order persistency between data and node may cause data corruption after SPOR. Similar issue was fixed by commit 2d1fe8a86bf5 ("f2fs: fix to tag gcing flag on page during file defragment"). EPSS Score: 0.05% Source: CVE December 20th, 2024 (6 months ago)
CVE-2023-52587	IB/ipoib: Fix mcast list locking Description: In the Linux kernel, the following vulnerability has been resolved: IB/ipoib: Fix mcast list locking Releasing the `priv->lock` while iterating the `priv->multicast_list` in `ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to remove the items while in the middle of iteration. If the mcast is removed while the lock was dropped, the for loop spins forever resulting in a hard lockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel): Task A (kworker/u72:2 below) \| Task B (kworker/u72:0 below) -----------------------------------+----------------------------------- ipoib_mcast_join_task(work) \| ipoib_ib_dev_flush_light(work) spin_lock_irq(&priv->lock) \| __ipoib_ib_dev_flush(priv, ...) list_for_each_entry(mcast, \| ipoib_mcast_dev_flush(dev = priv->dev) &priv->multicast_list, list) \| ipoib_mcast_join(dev, mcast) \| spin_unlock_irq(&priv->lock) \| \| spin_lock_irqsave(&priv->lock, flags) \| list_for_each_entry_safe(mcast, tmcast, \| &priv->multicast_list, list) \| list_del(&mcast->list); \| list_add_tail(&mcast->list, &remove_list) \| spin_unlock_irqrestore(&priv->lock, flags) spin_lock_irq(&priv->lock) \| ... EPSS Score: 0.04% Source: CVE December 20th, 2024 (6 months ago)
CVE-2023-52586	drm/msm/dpu: Add mutex lock in control vblank irq Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add mutex lock in control vblank irq Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Patchwork: https://patchwork.freedesktop.org/patch/571854/ EPSS Score: 0.04% Source: CVE December 20th, 2024 (6 months ago)
CVE-2023-52585	drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() Return invalid error code -EINVAL for invalid block id. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1183 amdgpu_ras_query_error_status_helper() error: we previously assumed 'info' could be null (see line 1176) EPSS Score: 0.04% Source: CVE December 20th, 2024 (6 months ago)
CVE-2023-52584	spmi: mediatek: Fix UAF on device remove Description: In the Linux kernel, the following vulnerability has been resolved: spmi: mediatek: Fix UAF on device remove The pmif driver data that contains the clocks is allocated along with spmi_controller. On device remove, spmi_controller will be freed first, and then devres , including the clocks, will be cleanup. This leads to UAF because putting the clocks will access the clocks in the pmif driver data, which is already freed along with spmi_controller. This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and building the kernel with KASAN. Fix the UAF issue by using unmanaged clk_bulk_get() and putting the clocks before freeing spmi_controller. EPSS Score: 0.05% Source: CVE December 20th, 2024 (6 months ago)