CVE-2024-38587 speakup: Fix sizeof() vs ARRAY_SIZE() bug

In the Linux kernel, the following vulnerability has been resolved: speakup: Fix sizeof vs ARRAYSIZE bug The "buf" pointer is an array of u16 values. This code should be using ARRAYSIZE which is 256 instead of sizeof which is 512, otherwise it can the still got out of bounds...

CVE-2024-38585

CVE-2024-38585 — Linux kernel memory corruption in realloc . The issue arises in tools/nolibc/stdlib where realloc() could copy beyond the allocated region because memcpy() used heap->len instead of the input user_p_len. The vulnerability was resolved by passing user_p_len to memcpy() to preve...

CVE-2024-38585 tools/nolibc/stdlib: fix memory error in realloc()

In the Linux kernel, the following vulnerability has been resolved: tools/nolibc/stdlib: fix memory error in realloc Pass userplen to memcpy instead of heap-len to prevent realloc from copying an extra sizeofheap bytes from beyond the allocated region...

CVE-2024-38581

CVE-2024-38581 : Linux kernel vulnerability affecting the AMDGPU MES path. The issue is a use-after-free in drm/amdgpu/mes triggered by the ramdom use-after-free caused by the fence fallback timer. The fix deletes the fence fallback timer to resolve the issue, and this change moved to amdgpu_mes....

CVE-2024-38579 crypto: bcm - Fix pointer arithmetic

In the Linux kernel, the following vulnerability has been resolved: crypto: bcm - Fix pointer arithmetic In spu2dumpomd value of ptr is increased by ciphkeylen instead of hashivlen which could lead to going beyond the buffer boundaries. Fix this bug by changing ciphkeylen to hashivlen. Found by...

CVE-2024-38577 rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow

In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix showrcutaskstracegpkthread buffer overflow There is a possibility of buffer overflow in showrcutaskstracegpkthread if counters, passed to sprintf are huge. Counter numbers, needed for this are unrealistically high,...

CVE-2024-38573 cppc_cpufreq: Fix possible null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: cppccpufreq: Fix possible null pointer dereference cppccpufreqgetrate and hisicppccpufreqgetrate can be called from different places with various parameters. So cpufreqcpuget can return null as 'policy' in some circumstances. Fix...

CVE-2024-38569 drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group

In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisipcie: Fix out-of-bound access when valid event group The perf tool allows users to create event groups through following cmd 1, but the driver does not check whether the array index is out of bounds when writing...

CVE-2024-38562 wifi: nl80211: Avoid address calculations via out of bounds array indexing

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: Avoid address calculations via out of bounds array indexing Before request-channels can be used, request-nchannels must be set. Additionally, address calculations for memory after the "channels" array need to be...

CVE-2024-38559

CVE-2024-38559: In the Linux kernel, the qedf SCSI path copies a userspace buffer without guaranteeing a NUL terminator, risking an OOB read in kstrtouint. The fix uses memdup_user_nul instead of memdup_user. Affected: kernel SCSI qedf path; Root cause: missing termination of the copied buffer. R...

CVE-2024-38559 scsi: qedf: Ensure the copied buf is NUL terminated

In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Ensure the copied buf is NUL terminated Currently, we allocate a count-sized kernel buffer and copy count from userspace to that buffer. Later, we use kstrtouint on this buffer but we don't ensure that the string is...

CVE-2024-38556 net/mlx5: Add a timeout to acquire the command queue semaphore

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Add a timeout to acquire the command queue semaphore Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely...

CVE-2024-38556

CVE-2024-38556 affects the Linux kernel net/mlx5 code. The vulnerability arises from how the command queue semaphore timeout handling can allow an entry to be processed before an index is allocated, risking an out-of-bounds access at idx = -22 if the completion path proceeds without proper synchr...

CVE-2024-38549 drm/mediatek: Add 0 size check to mtk_drm_gem_obj

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add 0 size check to mtkdrmgemobj Add a check to mtkdrmgeminit if we attempt to allocate a GEM object of 0 bytes. Currently, no such check exists and the kernel will panic if a userspace application attempts to...

CVE-2024-38546 drm: vc4: Fix possible null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: drm: vc4: Fix possible null pointer dereference In vc4hdmiaudioinit ofgetaddress may return NULL which is later dereferenced. Fix this bug by adding NULL check. Found by Linux Verification Center linuxtesting.org with SVACE...

CVE-2024-38543 lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure

In the Linux kernel, the following vulnerability has been resolved: lib/testhmm.c: handle srcpfns and dstpfns allocation failure The kcalloc in dmirrordeviceevictchunk will return null if the physical memory has run out. As a result, if srcpfns or dstpfns is dereferenced, the null pointer...

CVE-2024-38543

CVE-2024-38543 : In the Linux kernel, a vulnerability in lib/test_hmm.c arose from allocation failures for src_pfns/dst_pfns. If kcalloc() returns NULL, dereferencing these pointers could trigger a null pointer dereference, especially as the device could be evicted. Remediation implemented: add a...

CVE-2024-38539

CVE-2024-38539 affects the Linux kernel RDMA subsystem (RDMA/cma and ib_core) with kmemleak-related leakage observed during blktests nvme/rdma when siw is used. The root cause is that kmemleak-detected unreferenced objects can be produced due to rdma_put_gid_attr not being invoked when sgid_attr ...

CVE-2024-38538

CVE-2024-38538 is a Linux kernel vulnerability in the bridge xmit path. The issue arises when a short skb (less than ETH_HLEN) is processed, risking uninitialized data in br_dev_xmit. The fix adds a guard to ensure the kernel only pulls the required ETH header bytes and does not assume availabili...

CVE-2024-36978

In the Linux kernel, the following vulnerability has been resolved: net: sched: schmultiq: fix possible OOB write in multiqtune q-bands will be assigned to qopt-bands to execute subsequent code logic after kmalloc. So the old q-bands should not be used in kmalloc. Otherwise, an out-of-bounds writ...