GSD-2021-1002539 arm64: uaccess: avoid blocking within critical sections

arm64: uaccess: avoid blocking within critical sections This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.6 by commit...

GSD-2023-1002045 bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener

bpf, sockmap: Check for any of tcpbpfprots when cloning a listener This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.93 by commit...

GSD-2023-1001937 net/sched: sch_taprio: fix possible use-after-free

net/sched: schtaprio: fix possible use-after-free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.9 by commit...

GSD-2023-1000450 RISC-V: kexec: Fix memory leak of elf header buffer

RISC-V: kexec: Fix memory leak of elf header buffer This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.18 by commit...

GSD-2022-1007963 bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues

bpf, sockmap: Fix the sk-skforwardalloc warning of skstreamkillqueues This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.79 by commit...

GSD-2022-1005033 perf/x86/lbr: Enable the branch type for the Arch LBR by default

perf/x86/lbr: Enable the branch type for the Arch LBR by default This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.6 by commit...

GSD-2022-1003597 media: rga: fix possible memory leak in rga_probe

media: rga: fix possible memory leak in rgaprobe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.121 by commit...

GSD-2022-1002559 video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove()

video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xxgcuprobe/remove This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by...

GSD-2022-1002522 backdoor in phpass version 0.3.x-dev, 0.3.x

In PHP phpass version 0.3.x-dev, 0.3.x a backdoor exists in the phpass package that can be attacked via malicious package update resulting in credential theft...

GSD-2022-1001546 net: asix: add proper error handling of usb read errors

net: asix: add proper error handling of usb read errors This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1000283 Multiple vulnerabilities in NFT version All

A phishing attack was conducted against users of the Opensea.io NFT platform, resulting in 17 users losing approx. $1.7 Million USD in NFTs. This incident appears to include email phishing, a fake website, bad wallet UI that make it difficult for users to know exactly what is going on and use of...

GSD-2021-1000075 cifs: fix regression when mounting shares with prefix paths

cifs: fix regression when mounting shares with prefix paths This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.3 by commit...

GSD-2023-1002054 riscv/kprobe: Fix instruction simulation of JALR

riscv/kprobe: Fix instruction simulation of JALR This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.91 by commit...

GSD-2023-1000176 tipc: re-fetch skb cb after tipc_msg_validate

tipc: re-fetch skb cb after tipcmsgvalidate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.82 by commit...

GSD-2023-1000069 nvme: fix SRCU protection of nvme_ns_head list

nvme: fix SRCU protection of nvmenshead list This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.12 by commit...

GSD-2022-1005709 wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected

wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.142 by commit...

GSD-2022-1004820 ARM: cns3xxx: Fix refcount leak in cns3xxx_init

ARM: cns3xxx: Fix refcount leak in cns3xxxinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.250 by commit...

GSD-2022-1004553 x86/bugs: Report Intel retbleed vulnerability

x86/bugs: Report Intel retbleed vulnerability This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.133 by commit...

GSD-2022-1004240 powerpc/prom_init: Fix kernel config grep

powerpc/prominit: Fix kernel config grep This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.10 by commit...

GSD-2022-1000578 dma-buf: heaps: Fix potential spectre v1 gadget

dma-buf: heaps: Fix potential spectre v1 gadget This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.22 by commit...

GSD-2022-1000230 ASoC: max9759: fix underflow in speaker_gain_control_put()

ASoC: max9759: fix underflow in speakergaincontrolput This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.99 by commit...

GSD-2022-1000212 rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()

rtnetlink: make sure to refresh masterdev/mops in rtnlnewlink This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.97 by commit...

GSD-2022-1000095 drm/vmwgfx: Fix stale file descriptors on failed usercopy

drm/vmwgfx: Fix stale file descriptors on failed usercopy This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.264 by commit...

GSD-2022-1000008 faker.js 6.6.6 is broken and the developer has wiped the original GitHub repo

faker.js had it's version updated to 6.6.6 in NPM which reports it as having 2,571 dependent packages that rely upon it and the GitHub repo has been wiped of content. This appears to have been done intentionally as the repo only has a single commit so it was likjely deleted, recreated and a singl...

GSD-2021-1001530 ipack: ipoctal: fix module reference leak

ipack: ipoctal: fix module reference leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.249 by commit...

GSD-2021-1000603 Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails

Bluetooth: cmtp: fix file refcount when cmtpattachdevice fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.42 by commit...

GSD-2023-1002382 s390/decompressor: specify __decompress() buf len to avoid overflow

s390/decompressor: specify decompress buf len to avoid overflow This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.169 by commit...

GSD-2023-1002274 netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.

netfilter: ipset: Fix overflow before widen in the bitmapipcreate function. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.270 by commit...

GSD-2023-1002248 ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

ipv4: prevent potential spectre v1 gadget in ipmetricsconvert This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.272 by commit...

GSD-2023-1001870 vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF

vcscreen: move load of struct vcdata pointer in vcsread to avoid UAF This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.11 by commit...

GSD-2023-1001257 ext4: fix deadlock due to mbcache entry corruption

ext4: fix deadlock due to mbcache entry corruption This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001229 mips: ralink: mt7621: do not use kzalloc too early

mips: ralink: mt7621: do not use kzalloc too early This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2022-1007630 xhci: Remove device endpoints from bandwidth list when freeing the device

xhci: Remove device endpoints from bandwidth list when freeing the device This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.332 by commit...

GSD-2022-1007552 x86/unwind/orc: Fix unreliable stack dump with gcov

x86/unwind/orc: Fix unreliable stack dump with gcov This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.298 by commit...

GSD-2022-1002527 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.5 by commit...

GSD-2022-1001608 ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock

ALSA: pcm: Fix potential AB/BA lock with buffermutex and mmaplock This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001341 drm/panel: ili9341: fix optional regulator handling

drm/panel: ili9341: fix optional regulator handling This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.20 by commit...

GSD-2022-1001304 ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock

ALSA: pcm: Fix potential AB/BA lock with buffermutex and mmaplock This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

GSD-2022-1000069 Hardware glitching attack in Trezor One Hardware Wallet version Unknown

The Trezor Hardware Wallet One based on the ARM Cortex-M3-based STM32 F2 uses the RDP2 security level by default in SDP2 RAM cannot be copied, but the security can be downgraded to RDP1 where the contents of memory can be copied via glitch injection during device power on. Please note although th...

GSD-2021-1002637 net: systemport: Add global locking for descriptor lifecycle

net: systemport: Add global locking for descriptor lifecycle This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.259 by commit...

GSD-2021-1002604 ASoC: codecs: wcd934x: handle channel mappping list correctly

ASoC: codecs: wcd934x: handle channel mappping list correctly This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.8 by commit...

GSD-2021-1002509 devlink: fix netns refcount leak in devlink_nl_cmd_reload()

devlink: fix netns refcount leak in devlinknlcmdreload This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.85 by commit...

GSD-2021-1002271 arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency

arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.162 by commit...

GSD-2021-1002262 scsi: core: sysfs: Fix hang when device state is set via sysfs

scsi: core: sysfs: Fix hang when device state is set via sysfs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.162 by commit...

GSD-2021-1000592 i2c: i801: Don't generate an interrupt on bus reset

i2c: i801: Don't generate an interrupt on bus reset This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.42 by commit...

GSD-2023-1001884 arm64: dts: imx8mm-verdin: Do not power down eth-phy

arm64: dts: imx8mm-verdin: Do not power down eth-phy This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.11 by commit...

GSD-2023-1001621 regulator: core: fix module refcount leak in set_supply()

regulator: core: fix module refcount leak in setsupply This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit...

GSD-2022-1007774 phy: qcom-qmp-combo: fix NULL-deref on runtime resume

phy: qcom-qmp-combo: fix NULL-deref on runtime resume This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.9 by commit...

GSD-2022-1006672 wifi: mt76: mt7921e: fix random fw download fail

wifi: mt76: mt7921e: fix random fw download fail This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.6 by commit...

GSD-2022-1005736 arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76

arm64: Fix matchlist for erratum 1286807 on Arm Cortex-A76 This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.140 by commit...