CVE-2024-47671

The CVE-2024-47671 entry concerns a Linux kernel vulnerability in USBimp: usbtiusmb? The provided connected documents confirm a kernel-infoleak in USB: usbtmc, with the root cause described as a need to clear the data structure before filling fields in usbtmc_write. The fix/workaround is to preve...

CVE-2024-47671 USB: usbtmc: prevent kernel-usb-infoleak

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: prevent kernel-usb-infoleak The syzbot reported a kernel-usb-infoleak in usbtmcwrite, we need to clear the structure before filling fields...

CVE-2024-46828

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: fix bulk flow accounting logic for host fairness In schcake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is used as the round-robin weight when...

CVE-2024-46828

CVE-2024-46828 affects the Linux kernel schedulers, specifically the cake qdisc’s host-fairness logic. A hash-collision interaction could trigger an unintended decrement of per-host bulk-flow counters when a flow’s state changes, and when host fairness is enabled this could wrap a per-host counte...

CVE-2024-46783

CVE-2024-46783 : Linux kernel vulnerability in tcp_bpf_sendmsg() where corking in psock->cork could cause the last flushing to send a sk_msg larger than the current message, making ‘copied’ negative in tcp_bpf_send_verdict() and triggering a kernel BUG (net/socket.c:733). Connected Astra Linux...

CVE-2024-46754

CVE-2024-46754 pertains to the Linux kernel BPF subsystem. The issue arises in the lwt_seg6local_prog_ops related to BPF_PROG_TYPE_LWT_SEG6LOCAL, where BPF test execution via bpf_test_run could occur without entering input_action_end_bpf() first. The root cause is tied to the seg6 local test path...

CVE-2024-46754 bpf: Remove tst_run from lwt_seg6local_prog_ops.

In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tstrun from lwtseg6localprogops. The syzbot reported that the lwtseg6 related BPF ops can be invoked via bpftestrun without without entering inputactionendbpf first. Martin KaFai Lau said that self test for...

CVE-2024-46688 erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails

In the Linux kernel, the following vulnerability has been resolved: erofs: fix out-of-bound access when zerofsgbufgrowsize partially fails If zerofsgbufgrowsize partially fails on a global buffer due to memory allocation failure or fault injection as reported by syzbot 1, new pages need to be fre...

CVE-2024-44987

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold rcureadlock. A similar issue has been fixed in commit a688caa34beb "ipv...

CVE-2024-45008

In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at inputmtinitslots, for numslots is supplied from userspace using ioctlUIDEVCREATE. Since nobody knows possible max slots, this patch chose 1024...

CVE-2024-44952

In the Linux kernel, the following vulnerability has been resolved: driver core: Fix ueventshow vs driver detach race ueventshow wants to de-reference dev-driver-name. There is no clean way for a device attribute to de-reference dev-driver unless that attribute is defined via struct...

CVE-2024-45008

In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at inputmtinitslots, for numslots is supplied from userspace using ioctlUIDEVCREATE. Since nobody knows possible max slots, this patch chose 1024...

CVE-2024-44987

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold rcureadlock. A similar issue has been fixed in commit a688caa34beb "ipv...

CVE-2024-45008 Input: MT - limit max slots

In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at inputmtinitslots, for numslots is supplied from userspace using ioctlUIDEVCREATE. Since nobody knows possible max slots, this patch chose 1024...

CVE-2024-45008 Input: MT - limit max slots

In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at inputmtinitslots, for numslots is supplied from userspace using ioctlUIDEVCREATE. Since nobody knows possible max slots, this patch chose 1024...

CVE-2024-45008

In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at inputmtinitslots, for numslots is supplied from userspace using ioctlUIDEVCREATE. Since nobody knows possible max slots, this patch chose 1024...

CVE-2024-44999 gtp: pull network headers in gtp_dev_xmit()

In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtpdevxmit syzbot/KMSAN reported use of uninit-value in getdevxmit 1 We must make sure the IPv4 or Ipv6 header is pulled in skb-head before accessing fields in them. Use pskbinetmaypull to fix this...

CVE-2024-44999 gtp: pull network headers in gtp_dev_xmit()

In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtpdevxmit syzbot/KMSAN reported use of uninit-value in getdevxmit 1 We must make sure the IPv4 or Ipv6 header is pulled in skb-head before accessing fields in them. Use pskbinetmaypull to fix this...

CVE-2024-44999

CVE-2024-44999 refers to a Linux kernel issue in gtp: pull network headers in gtp_dev_xmit() where syzbot/KMSAN detected uninitialized usage in get_dev_xmit(). The problem required ensuring IPv4/IPv6 headers are pulled into skb->head before accessing their fields. The fix implemented is to use...

CVE-2024-44987 ipv6: prevent UAF in ip6_send_skb()

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold rcureadlock. A similar issue has been fixed in commit a688caa34beb "ipv...