UBUNTU-CVE-2022-50825

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wusb3801: fix fwnode refcount leak in wusb3801probe I got the following report while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 4, ofnodeget/ofnodeput unbalanced - destroy cset...

CVE-2022-50821

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Don't leak netobj memory when gssreadproxyverf fails...

CVE-2022-50840

In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible UAF in snictgtcreate Smatch reports a warning as follows: drivers/scsi/snic/snicdisc.c:307 snictgtcreate warn: '&tgt-list' not removed from list If deviceadd fails in snictgtcreate, tgt will be freed, but...

CVE-2023-54320 platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2()

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: pmc: Fix memory leak in amdpmcstbdebugfsopenv2 Function amdpmcstbdebugfsopenv2 may be called when the STB debug mechanism enabled. When amdpmcsendcmd fails, the 'buf' needs to be released...

CVE-2023-54319 pinctrl: at91-pio4: check return value of devm_kasprintf()

In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91-pio4: check return value of devmkasprintf devmkasprintf returns a pointer to dynamically allocated memory. Pointer could be NULL in case allocation fails. Check pointer validity. Identified with coccinelle kmerr.coc...

CVE-2023-54319

CVE-2023-54319: In the Linux kernel pinctrl/at91-pio4, code did not validate the return value of devm_kasprintf(); since devm_kasprintf() can return NULL on allocation failure, lack of a NULL check could lead to use-after-free or leaks. The vulnerability has been addressed by adding a pointer val...

CVE-2022-50885

Public technical details for CVE-2022-50885 are not provided in the supplied documents. The description summarizes fixes in Linux RDMA/rxe and mount.cifs, but no vendor/product/version specifics or remediation steps are included here. Monitor for updates.

CVE-2022-50885 RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix NULL-ptr-deref in rxeqpdocleanup when socket create failed There is a null-ptr-deref when mount.cifs over rdma: BUG: KASAN: null-ptr-deref in rxeqpdocleanup+0x2f3/0x360 rdmarxe Read of size 8 at addr 000000000000001...

CVE-2022-50885 RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix NULL-ptr-deref in rxeqpdocleanup when socket create failed There is a null-ptr-deref when mount.cifs over rdma: BUG: KASAN: null-ptr-deref in rxeqpdocleanup+0x2f3/0x360 rdmarxe Read of size 8 at addr 000000000000001...

CVE-2022-50885

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix NULL-ptr-deref in rxeqpdocleanup when socket create failed There is a null-ptr-deref when mount.cifs over rdma: BUG: KASAN: null-ptr-deref in rxeqpdocleanup+0x2f3/0x360 rdmarxe Read of size 8 at addr 000000000000001...

CVE-2023-54298 thermal: intel: quark_dts: fix error pointer dereference

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: quarkdts: fix error pointer dereference If allocsocdts fails, then we can just return. Trying to free "socdts" will lead to an Oops...

CVE-2023-54298 thermal: intel: quark_dts: fix error pointer dereference

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: quarkdts: fix error pointer dereference If allocsocdts fails, then we can just return. Trying to free "socdts" will lead to an Oops...

CVE-2022-50880 wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up for peer delete in ath10kstastate When peer delete failed in a disconnect operation, use-after-free detected by KFENCE in below log. It is because for each vdevid and address, it has only one...

CVE-2022-50875

CVE-2022-50875 — Linux kernel (overlay): The issue is a null pointer dereference in overlay code, specifically in find_dup_cset_node_entry() and find_dup_cset_prop(). If kmalloc() fails during kasprintf(), fn_1 or fn_2 may be NULL, and a subsequent strcmp() can dereference NULL. The vulnerability...

CVE-2022-50875 of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()

In the Linux kernel, the following vulnerability has been resolved: of: overlay: fix null pointer dereferencing in finddupcsetnodeentry and finddupcsetprop When kmalloc fail to allocate memory in kasprintf, fn1 or fn2 will be NULL, and strcmp will cause null pointer dereference...

CVE-2023-54277 fbdev: udlfb: Fix endpoint check

In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: Fix endpoint check The syzbot fuzzer detected a problem in the udlfb driver, caused by an endpoint not having the expected type: usb 1-1: Read EDID byte 0 failed: -71 usb 1-1: Unable to get valid EDID from...

CVE-2023-54275 wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix memory leak in ath11kpeerrxfragsetup cryptoallocshash allocates resources, which should be released by cryptofreeshash. When ath11kpeerfind fails, there has memory leak. Add missing cryptofreeshash to fix this...

CVE-2023-54266 media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()

In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: m920x: Fix a potential memory leak in m920xi2cxfer 'read' is freed when it is known to be NULL, but not when a read error occurs. Revert the logic to avoid a small leak, should a m920xread call fail...

CVE-2023-54260

CVE-2023-54260 — Linux kernel (CIFS): The vulnerability occurs when MR allocation fails during CIFS SMB direct connection handling; if the MR allocate fails and the smb direct connection info is NULL, smbd_destroy() returns early and leaks the connection info. The fix updates the shutdown path by...

CVE-2023-54260 cifs: Fix lost destroy smbd connection when MR allocate failed

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix lost destroy smbd connection when MR allocate failed If the MR allocate failed, the smb direct connection info is NULL, then smbddestroy will directly return, then the connection info will be leaked. Let's set the smb...