CVE-2024-42130

...

CVE-2024-42100 clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common

In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: common: Don't call hwtoccucommon on hw without common In order to set the rate range of a hw sunxiccuprobe calls hwtoccucommon assuming all entries in desc-ccuclks are contained in a ccucommon struct. This assumpti...

CVE-2024-42082 xdp: Remove WARN() from __xdp_reg_mem_model()

In the Linux kernel, the following vulnerability has been resolved: xdp: Remove WARN from xdpregmemmodel syzkaller reports a warning in xdpregmemmodel. The warning occurs only if memidinithashtable returns an error. It returns the error in two cases: 1. memory allocation fails; 2. rhashtableinit...

CVE-2024-42082

CVE-2024-42082 is a Linux kernel vulnerability where a syzkaller-triggered WARN was introduced in __xdp_reg_mem_model() when __mem_id_init_hash_table() failed. The issue arose only from memory allocation failure; a static const rhashtable_params prevented rhashtable_init() misconfiguration. The w...

CVE-2024-41085 cxl/mem: Fix no cxl_nvd during pmem region auto-assembling

In the Linux kernel, the following vulnerability has been resolved: cxl/mem: Fix no cxlnvd during pmem region auto-assembling When CXL subsystem is auto-assembling a pmem region during cxl endpoint port probing, always hit below calltrace. BUG: kernel NULL pointer dereference, address:...

CVE-2024-41074

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Set object to close if ondemandid 0 in copen If copen is maliciously called in the user mode, it may delete the request corresponding to the random id. And the request may have not been read yet. Note that when the...

DEBIAN-CVE-2024-41025

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix memory leak in audio daemon attach operation Audio PD daemon send the name as part of the init IOCTL call. This name needs to be copied to kernel for which memory is allocated. This memory is never freed which...

CVE-2024-41070 KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Prevent UAF in kvmspaprtceattachiommugroup Al reported a possible use-after-free UAF in kvmspaprtceattachiommugroup. It looks up stt from tablefd, but then continues to use it after doing fdput on the returne...

CVE-2024-41068 s390/sclp: Fix sclp_init() cleanup on failure

In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix sclpinit cleanup on failure If sclpinit fails it only partially cleans up: if there are multiple failing calls to sclpinit sclpstatechangeevent will be added several times to sclpreglist, which results in the...

CVE-2024-41058 cachefiles: fix slab-use-after-free in fscache_withdraw_volume()

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in fscachewithdrawvolume We got the following issue in our fault injection stress test: ================================================================== BUG: KASAN: slab-use-after-free in...

CVE-2024-41031

CVE-2024-41031 (Linux kernel) affects ARM64 builds where HPAGE_PMD_ORDER is 13 for 64KB base pages. The vulnerability arises in mm/filemap when the PMD-sized page cache cannot be supported by xarray, triggering kernel warnings and a broken path during page cache handling. The impact is described ...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a SOF kernel call to hwparamsuponresume if an active stream exists when the system hangs, resulting in a nul...

kernel: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool

In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Remove BUGON in the case of an empty event pool In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that this happens, the code asserts a BUGON, a...

PT-2024-37849 · WordPress · Social Auto Poster

Name of the Vulnerable Software and Affected Versions: Social Auto Poster plugin for WordPress versions up to, and including, 5.3.14 Description: The issue is related to Stored Cross-Site Scripting via the mapTypes parameter in the 'wpw auto poster map wordpress post type' AJAX function due to...

EulerOS 2.0 SP8 : glibc (EulerOS-SA-2024-2028)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function monstartup of the file...

EulerOS 2.0 SP8 : pam (EulerOS-SA-2024-2045)

According to the versions of the pam packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : linux-pam aka Linux PAM before 1.6.0 allows attackers to cause a denial of service blocked login process via mkfifo because the openat call for...

North Korean Hackers Update BeaverTail Malware to Target MacOS Users

Cybersecurity researchers have discovered an updated variant of a known stealer malware that attackers affiliated with the Democratic People's Republic of Korea DPRK have delivered as part of prior cyber espionage campaigns targeting job seekers. The artifact in question is an Apple macOS disk...

SUSE CVE-2024-40944

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Fix bug with call depth tracking The call to ccplatformhas triggers a fault and system crash if call depth tracking is active because the GS segment has been reset by loadsegments and GSBASE is now 0 but call depth...

CVE-2022-48825

In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Add stagwork to all the vports Call trace seen when creating NPIV ports, only 32 out of 64 show online. stag work was not initialized for vport, hence initialize the stag work. WARNING: CPU: 8 PID: 645 at...

CVE-2024-40944

A vulnerability was found in the Linux kernel's x86/kexec component, where the function call to ccplatformhas could lead to a system crash when call depth tracking is active. This issue occurs because the GS segment is reset by loadsegments, setting GSBASE to 0, while call depth tracking relies o...