CVE-2024-43867

The CVE refers to a Linux kernel issue in the DRM Nouveau path: a refcount underflow in nouveau_bo_ref() when nouveau_bo has not been initialized (backing ttm_bo). The vulnerability arises in the unwind path of drm_gem_object_init(); instead of calling nouveau_bo_ref(), code now manually cleans u...

CVE-2024-43865 s390/fpu: Re-add exception handling in load_fpu_state()

In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Re-add exception handling in loadfpustate With the recent rewrite of the fpu code exception handling for the lfpc instruction within loadfpustate was erroneously removed. Add it again to prevent that loading invalid...

CVE-2024-43862

CVE-2024-43862 affects the Linux kernel’s net: wan: fsl_qmc_hdlc component. The root cause is using a spinlock (carrier_lock) to protect carrier detection while framer_get_status() may take a mutex, creating a potential deadlock. The issue is addressed by converting carrier_lock from a spinlock t...

CVE-2024-43862 net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex

In the Linux kernel, the following vulnerability has been resolved: net: wan: fslqmchdlc: Convert carrierlock spinlock to a mutex The carrierlock spinlock protects the carrier detection. While it is held, framergetstatus is called which in turn takes a mutex. This is not correct and can lead to a...

Advisory ROSA-SA-2024-2470

software: systemd 249 WASP: ROSA-CHROME packageevrstring: systemd-249-1.gitfab79a.21 CVE-ID: CVE-2022-3821 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: An off-by-one error problem was discovered in Systemd in the formattimespan function time-util.c. An attacker could provide specific values for time...

Advisory ROSA-SA-2024-2469

software: pcs 0.10.7 WASP: ROSA-CHROME packageevrstring: pcs-0.10.7-5 CVE-ID: CVE-2022-1049 BDU-ID: 2022-05543 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the corosync/pacemaker PCS program configuration utility is related to flaws in the authentication procedure. Exploitation of the vulnerabili...

CVE-2024-42275

In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix error code in drmclientbuffervmaplocal This function accidentally returns zero/success on the failure path. It leads to locking issues and an uninitialized mapcopy in the caller...

CVE-2024-43379

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

CVE-2024-42303

In the Linux kernel, the following vulnerability has been resolved: media: imx-pxp: Fix ERRPTR dereference in pxpprobe devmregmapinitmmio can fail, add a check and bail out in case of error...

CVE-2024-42302

A use-after-free flaw was found in concurrent DPC and hot-removal in the Linux kernel. This issue may result in a crash...

CVE-2024-42298

A vulnerability was found in the devmkasprintf function in the Linux kernel's fslqmcaudio driver. This function can return a NULL pointer if memory allocation fails, but the original code did not check for this possibility. This oversight could lead to dereferencing a NULL pointer, potentially...

CVE-2024-42294

In the Linux kernel, the following vulnerability has been resolved: block: fix deadlock between sdremove & sdrelease Our test report the following hung task: 2538.459400 INFO: task "kworker/0:0":7 blocked for more than 188 seconds. 2538.459427 Call trace: 2538.459430 switchto+0x174/0x338...

CVE-2024-42287

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Complete command early within lock A crash was observed while performing NPIV and FW reset, BUG: kernel NULL pointer dereference, address: 000000000000001c PF: supervisor read access in kernel mode PF:...

CVE-2024-42286

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: validate nvmelocalport correctly The driver load failed with error message, qla2xxx 0000:04:00.0-ffff:0: registerlocalport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer...

CVE-2024-43379 TruffleHog has a Blind SSRF in some Detectors

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

CVE-2024-43379 TruffleHog has a Blind SSRF in some Detectors

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, t...

CVE-2024-42310

A null pointer dereference flaw was found in cdvintellvdsgetmodes in the Linux kernel. This issue may lead to a crash...

CVE-2024-43824

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Make use of cached 'epcfeatures' in pciepftestcoreinit Instead of getting the epcfeatures from pciepcgetfeatures API, use the cached pciepftest::epcfeatures value to avoid the NULL check. Since the NU...

CVE-2024-43822

In the Linux kernel, the following vulnerability has been resolved: ASoc: PCM6240: Return directly after a failed devmkzalloc in pcmdevicei2cprobe The value “-ENOMEM” was assigned to the local variable “ret” in one if branch after a devmkzalloc call failed at the beginning. This error code will...

CVE-2024-42322

In the Linux kernel, the following vulnerability has been resolved: ipvs: properly dereference pe in ipvsaddservice Use pe directly to resolve sparse warning: net/netfilter/ipvs/ipvsctl.c:1471:27: warning: dereference of noderef expression...