diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-04-17 17:59:47 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-04-17 17:59:47 +0200 |
| commit | b1f93e9aafe2f4a183a41fc5867285d24a067570 (patch) | |
| tree | 9146f63ae1c11cb55f4f9fd456b3925ff1befa45 | |
| parent | 2465ec11ce1e424645378c26c2fb893a5e32e739 (diff) | |
| download | vulns-b1f93e9aafe2f4a183a41fc5867285d24a067570.tar.gz | |
some more 6.7.6 CVEs assigned
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
48 files changed, 2412 insertions, 0 deletions
diff --git a/cve/reserved/2023/CVE-2023-52645 b/cve/published/2023/CVE-2023-52645 index e69de29b..e69de29b 100644 --- a/cve/reserved/2023/CVE-2023-52645 +++ b/cve/published/2023/CVE-2023-52645 diff --git a/cve/published/2023/CVE-2023-52645.json b/cve/published/2023/CVE-2023-52645.json new file mode 100644 index 00000000..7f92a919 --- /dev/null +++ b/cve/published/2023/CVE-2023-52645.json @@ -0,0 +1,133 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: mediatek: fix race conditions with genpd\n\nIf the power domains are registered first with genpd and *after that*\nthe driver attempts to power them on in the probe sequence, then it is\npossible that a race condition occurs if genpd tries to power them on\nin the same time.\nThe same is valid for powering them off before unregistering them\nfrom genpd.\nAttempt to fix race conditions by first removing the domains from genpd\nand *after that* powering down domains.\nAlso first power up the domains and *after that* register them\nto genpd." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "59b644b01cf4", + "lessThan": "475426ad1ae0", + "status": "affected", + "versionType": "git" + }, + { + "version": "59b644b01cf4", + "lessThan": "339ddc983bc1", + "status": "affected", + "versionType": "git" + }, + { + "version": "59b644b01cf4", + "lessThan": "f83b9abee9fa", + "status": "affected", + "versionType": "git" + }, + { + "version": "59b644b01cf4", + "lessThan": "3cd1d92ee1db", + "status": "affected", + "versionType": "git" + }, + { + "version": "59b644b01cf4", + "lessThan": "c41336f4d690", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "5.11", + "status": "affected" + }, + { + "version": "0", + "lessThan": "5.11", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.15.150", + "lessThanOrEqual": "5.15.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.1.80", + "lessThanOrEqual": "6.1.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.6.18", + "lessThanOrEqual": "6.6.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/475426ad1ae0bfdfd8f160ed9750903799392438" + }, + { + "url": "https://git.kernel.org/stable/c/339ddc983bc1622341d95f244c361cda3da3a4ff" + }, + { + "url": "https://git.kernel.org/stable/c/f83b9abee9faa4868a6fac4669b86f4c215dae25" + }, + { + "url": "https://git.kernel.org/stable/c/3cd1d92ee1dbf3e8f988767eb75f26207397792b" + }, + { + "url": "https://git.kernel.org/stable/c/c41336f4d69057cbf88fed47951379b384540df5" + } + ], + "title": "pmdomain: mediatek: fix race conditions with genpd", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2023-52645", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2023/CVE-2023-52645.mbox b/cve/published/2023/CVE-2023-52645.mbox new file mode 100644 index 00000000..b2dfe484 --- /dev/null +++ b/cve/published/2023/CVE-2023-52645.mbox @@ -0,0 +1,79 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2023-52645: pmdomain: mediatek: fix race conditions with genpd +Message-Id: <2024041733-CVE-2023-52645-68dc@gregkh> +Content-Length: 2617 +Lines: 62 +X-Developer-Signature: v=1; a=openpgp-sha256; l=2680; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=Oo4VK/lplUFBA3lW5/FqqdOeedAS6fsfFSSxqZwlLxY=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH5+yn7h55Xz1a/sMbcYa18+pk2USg3t+fHu4ZOeCh + oDDZt4nO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiD/sZ5rsoOX9p7rrV9Ip1 + 60/xfOaVPTv0uRgW7OSd9mjquxVLYqemPkz2bZob7Zj+HwA= +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +pmdomain: mediatek: fix race conditions with genpd + +If the power domains are registered first with genpd and *after that* +the driver attempts to power them on in the probe sequence, then it is +possible that a race condition occurs if genpd tries to power them on +in the same time. +The same is valid for powering them off before unregistering them +from genpd. +Attempt to fix race conditions by first removing the domains from genpd +and *after that* powering down domains. +Also first power up the domains and *after that* register them +to genpd. + +The Linux kernel CVE team has assigned CVE-2023-52645 to this issue. + + +Affected and fixed versions +=========================== + + Issue introduced in 5.11 with commit 59b644b01cf4 and fixed in 5.15.150 with commit 475426ad1ae0 + Issue introduced in 5.11 with commit 59b644b01cf4 and fixed in 6.1.80 with commit 339ddc983bc1 + Issue introduced in 5.11 with commit 59b644b01cf4 and fixed in 6.6.18 with commit f83b9abee9fa + Issue introduced in 5.11 with commit 59b644b01cf4 and fixed in 6.7.6 with commit 3cd1d92ee1db + Issue introduced in 5.11 with commit 59b644b01cf4 and fixed in 6.8 with commit c41336f4d690 + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2023-52645 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + drivers/pmdomain/mediatek/mtk-pm-domains.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/475426ad1ae0bfdfd8f160ed9750903799392438 + https://git.kernel.org/stable/c/339ddc983bc1622341d95f244c361cda3da3a4ff + https://git.kernel.org/stable/c/f83b9abee9faa4868a6fac4669b86f4c215dae25 + https://git.kernel.org/stable/c/3cd1d92ee1dbf3e8f988767eb75f26207397792b + https://git.kernel.org/stable/c/c41336f4d69057cbf88fed47951379b384540df5 diff --git a/cve/published/2023/CVE-2023-52645.sha1 b/cve/published/2023/CVE-2023-52645.sha1 new file mode 100644 index 00000000..9db175bd --- /dev/null +++ b/cve/published/2023/CVE-2023-52645.sha1 @@ -0,0 +1 @@ +c41336f4d69057cbf88fed47951379b384540df5 diff --git a/cve/reserved/2024/CVE-2024-26910 b/cve/published/2024/CVE-2024-26910 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26910 +++ b/cve/published/2024/CVE-2024-26910 diff --git a/cve/published/2024/CVE-2024-26910.json b/cve/published/2024/CVE-2024-26910.json new file mode 100644 index 00000000..b91f99a1 --- /dev/null +++ b/cve/published/2024/CVE-2024-26910.json @@ -0,0 +1,163 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: fix performance regression in swap operation\n\nThe patch \"netfilter: ipset: fix race condition between swap/destroy\nand kernel side add/del/test\", commit 28628fa9 fixes a race condition.\nBut the synchronize_rcu() added to the swap function unnecessarily slows\nit down: it can safely be moved to destroy and use call_rcu() instead.\n\nEric Dumazet pointed out that simply calling the destroy functions as\nrcu callback does not work: sets with timeout use garbage collectors\nwhich need cancelling at destroy which can wait. Therefore the destroy\nfunctions are split into two: cancelling garbage collectors safely at\nexecuting the command received by netlink and moving the remaining\npart only into the rcu callback." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "427deb5ba566", + "lessThan": "c7f2733e5011", + "status": "affected", + "versionType": "git" + }, + { + "version": "e7152a138a5a", + "lessThan": "a24d5f2ac8ef", + "status": "affected", + "versionType": "git" + }, + { + "version": "8bb930c3a1ea", + "lessThan": "c2dc077d8f72", + "status": "affected", + "versionType": "git" + }, + { + "version": "875ee3a09e27", + "lessThan": "653bc5e6d999", + "status": "affected", + "versionType": "git" + }, + { + "version": "23c31036f862", + "lessThan": "b93a6756a01f", + "status": "affected", + "versionType": "git" + }, + { + "version": "28628fa952fe", + "lessThan": "970709a67696", + "status": "affected", + "versionType": "git" + }, + { + "version": "28628fa952fe", + "lessThan": "97f7cf1cd80e", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "6.7", + "status": "affected" + }, + { + "version": "0", + "lessThan": "6.7", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.4.269", + "lessThanOrEqual": "5.4.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.10.210", + "lessThanOrEqual": "5.10.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.15.149", + "lessThanOrEqual": "5.15.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.1.79", + "lessThanOrEqual": "6.1.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.6.18", + "lessThanOrEqual": "6.6.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/c7f2733e5011bfd136f1ca93497394d43aa76225" + }, + { + "url": "https://git.kernel.org/stable/c/a24d5f2ac8ef702a58e55ec276aad29b4bd97e05" + }, + { + "url": "https://git.kernel.org/stable/c/c2dc077d8f722a1c73a24e674f925602ee5ece49" + }, + { + "url": "https://git.kernel.org/stable/c/653bc5e6d9995d7d5f497c665b321875a626161c" + }, + { + "url": "https://git.kernel.org/stable/c/b93a6756a01f4fd2f329a39216f9824c56a66397" + }, + { + "url": "https://git.kernel.org/stable/c/970709a67696b100a57b33af1a3d75fc34b747eb" + }, + { + "url": "https://git.kernel.org/stable/c/97f7cf1cd80eeed3b7c808b7c12463295c751001" + } + ], + "title": "netfilter: ipset: fix performance regression in swap operation", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26910", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26910.mbox b/cve/published/2024/CVE-2024-26910.mbox new file mode 100644 index 00000000..58e5f663 --- /dev/null +++ b/cve/published/2024/CVE-2024-26910.mbox @@ -0,0 +1,89 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26910: netfilter: ipset: fix performance regression in swap operation +Message-Id: <2024041736-CVE-2024-26910-3617@gregkh> +Content-Length: 3362 +Lines: 72 +X-Developer-Signature: v=1; a=openpgp-sha256; l=3435; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=sFAv9ABeDfURMmyYSm7GHb1Jqgoh43r9nqij/rq0ZKs=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH19sfHrrfUd7xHUhBqWX1ntdrmlFX+U3ivDnWZ1wT + nnC5LxpHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRBBOGBRfyY/8z3n7zXMbL + nmGi7xs9XpYoaYYFN9qXSJ4TX+IinKX7sX4G02p+nrlaAA== +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +netfilter: ipset: fix performance regression in swap operation + +The patch "netfilter: ipset: fix race condition between swap/destroy +and kernel side add/del/test", commit 28628fa9 fixes a race condition. +But the synchronize_rcu() added to the swap function unnecessarily slows +it down: it can safely be moved to destroy and use call_rcu() instead. + +Eric Dumazet pointed out that simply calling the destroy functions as +rcu callback does not work: sets with timeout use garbage collectors +which need cancelling at destroy which can wait. Therefore the destroy +functions are split into two: cancelling garbage collectors safely at +executing the command received by netlink and moving the remaining +part only into the rcu callback. + +The Linux kernel CVE team has assigned CVE-2024-26910 to this issue. + + +Affected and fixed versions +=========================== + + Issue introduced in 5.4.264 with commit 427deb5ba566 and fixed in 5.4.269 with commit c7f2733e5011 + Issue introduced in 5.10.204 with commit e7152a138a5a and fixed in 5.10.210 with commit a24d5f2ac8ef + Issue introduced in 5.15.143 with commit 8bb930c3a1ea and fixed in 5.15.149 with commit c2dc077d8f72 + Issue introduced in 6.1.68 with commit 875ee3a09e27 and fixed in 6.1.79 with commit 653bc5e6d999 + Issue introduced in 6.6.7 with commit 23c31036f862 and fixed in 6.6.18 with commit b93a6756a01f + Issue introduced in 6.7 with commit 28628fa952fe and fixed in 6.7.6 with commit 970709a67696 + Issue introduced in 6.7 with commit 28628fa952fe and fixed in 6.8 with commit 97f7cf1cd80e + Issue introduced in 4.19.302 with commit a12606e5ad0c + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26910 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + include/linux/netfilter/ipset/ip_set.h + net/netfilter/ipset/ip_set_bitmap_gen.h + net/netfilter/ipset/ip_set_core.c + net/netfilter/ipset/ip_set_hash_gen.h + net/netfilter/ipset/ip_set_list_set.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/c7f2733e5011bfd136f1ca93497394d43aa76225 + https://git.kernel.org/stable/c/a24d5f2ac8ef702a58e55ec276aad29b4bd97e05 + https://git.kernel.org/stable/c/c2dc077d8f722a1c73a24e674f925602ee5ece49 + https://git.kernel.org/stable/c/653bc5e6d9995d7d5f497c665b321875a626161c + https://git.kernel.org/stable/c/b93a6756a01f4fd2f329a39216f9824c56a66397 + https://git.kernel.org/stable/c/970709a67696b100a57b33af1a3d75fc34b747eb + https://git.kernel.org/stable/c/97f7cf1cd80eeed3b7c808b7c12463295c751001 diff --git a/cve/published/2024/CVE-2024-26910.sha1 b/cve/published/2024/CVE-2024-26910.sha1 new file mode 100644 index 00000000..9bfc75e5 --- /dev/null +++ b/cve/published/2024/CVE-2024-26910.sha1 @@ -0,0 +1 @@ +97f7cf1cd80eeed3b7c808b7c12463295c751001 diff --git a/cve/reserved/2024/CVE-2024-26911 b/cve/published/2024/CVE-2024-26911 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26911 +++ b/cve/published/2024/CVE-2024-26911 diff --git a/cve/published/2024/CVE-2024-26911.json b/cve/published/2024/CVE-2024-26911.json new file mode 100644 index 00000000..db713ed1 --- /dev/null +++ b/cve/published/2024/CVE-2024-26911.json @@ -0,0 +1,88 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Fix alloc_range() error handling code\n\nFew users have observed display corruption when they boot\nthe machine to KDE Plasma or playing games. We have root\ncaused the problem that whenever alloc_range() couldn't\nfind the required memory blocks the function was returning\nSUCCESS in some of the corner cases.\n\nThe right approach would be if the total allocated size\nis less than the required size, the function should\nreturn -ENOSPC." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "0a1844bf0b53", + "lessThan": "4b59c3fada06", + "status": "affected", + "versionType": "git" + }, + { + "version": "0a1844bf0b53", + "lessThan": "8746c6c9dfa3", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "6.7", + "status": "affected" + }, + { + "version": "0", + "lessThan": "6.7", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2" + }, + { + "url": "https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91" + } + ], + "title": "drm/buddy: Fix alloc_range() error handling code", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26911", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26911.mbox b/cve/published/2024/CVE-2024-26911.mbox new file mode 100644 index 00000000..574c0a10 --- /dev/null +++ b/cve/published/2024/CVE-2024-26911.mbox @@ -0,0 +1,72 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26911: drm/buddy: Fix alloc_range() error handling code +Message-Id: <2024041736-CVE-2024-26911-e758@gregkh> +Content-Length: 1986 +Lines: 55 +X-Developer-Signature: v=1; a=openpgp-sha256; l=2042; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=8J5SO3DNUT//NPtTHrQJ3AhLspye+0Yfz7f+M9ySrFY=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH1+oLTRrleq1nHXrWdn+it7H5j+999/Y8lGTXbR07 + lsHjxnBHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRYG+GBQfvixdoGS228Lgz + ceXqvzYW574+SmeYnxgp7BCz2TjnWJ/u788ikYqL2x8HAQA= +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +drm/buddy: Fix alloc_range() error handling code + +Few users have observed display corruption when they boot +the machine to KDE Plasma or playing games. We have root +caused the problem that whenever alloc_range() couldn't +find the required memory blocks the function was returning +SUCCESS in some of the corner cases. + +The right approach would be if the total allocated size +is less than the required size, the function should +return -ENOSPC. + +The Linux kernel CVE team has assigned CVE-2024-26911 to this issue. + + +Affected and fixed versions +=========================== + + Issue introduced in 6.7 with commit 0a1844bf0b53 and fixed in 6.7.6 with commit 4b59c3fada06 + Issue introduced in 6.7 with commit 0a1844bf0b53 and fixed in 6.8 with commit 8746c6c9dfa3 + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26911 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + drivers/gpu/drm/drm_buddy.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/4b59c3fada06e5e8010ef7700689c71986e667a2 + https://git.kernel.org/stable/c/8746c6c9dfa31d269c65dd52ab42fde0720b7d91 diff --git a/cve/published/2024/CVE-2024-26911.sha1 b/cve/published/2024/CVE-2024-26911.sha1 new file mode 100644 index 00000000..716f2928 --- /dev/null +++ b/cve/published/2024/CVE-2024-26911.sha1 @@ -0,0 +1 @@ +8746c6c9dfa31d269c65dd52ab42fde0720b7d91 diff --git a/cve/reserved/2024/CVE-2024-26912 b/cve/published/2024/CVE-2024-26912 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26912 +++ b/cve/published/2024/CVE-2024-26912 diff --git a/cve/published/2024/CVE-2024-26912.json b/cve/published/2024/CVE-2024-26912.json new file mode 100644 index 00000000..6d9ca96c --- /dev/null +++ b/cve/published/2024/CVE-2024-26912.json @@ -0,0 +1,88 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix several DMA buffer leaks\n\nNouveau manages GSP-RM DMA buffers with nvkm_gsp_mem objects. Several of\nthese buffers are never dealloced. Some of them can be deallocated\nright after GSP-RM is initialized, but the rest need to stay until the\ndriver unloads.\n\nAlso futher bullet-proof these objects by poisoning the buffer and\nclearing the nvkm_gsp_mem object when it is deallocated. Poisoning\nthe buffer should trigger an error (or crash) from GSP-RM if it tries\nto access the buffer after we've deallocated it, because we were wrong\nabout when it is safe to deallocate.\n\nFinally, change the mem->size field to a size_t because that's the same\ntype that dma_alloc_coherent expects." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "176fdcbddfd2", + "lessThan": "6190d4c08897", + "status": "affected", + "versionType": "git" + }, + { + "version": "176fdcbddfd2", + "lessThan": "042b5f83841f", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "6.7", + "status": "affected" + }, + { + "version": "0", + "lessThan": "6.7", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/6190d4c08897d748dd25f0b78267a90aa1694e15" + }, + { + "url": "https://git.kernel.org/stable/c/042b5f83841fbf7ce39474412db3b5e4765a7ea7" + } + ], + "title": "drm/nouveau: fix several DMA buffer leaks", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26912", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26912.mbox b/cve/published/2024/CVE-2024-26912.mbox new file mode 100644 index 00000000..9ce615f7 --- /dev/null +++ b/cve/published/2024/CVE-2024-26912.mbox @@ -0,0 +1,77 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26912: drm/nouveau: fix several DMA buffer leaks +Message-Id: <2024041736-CVE-2024-26912-9206@gregkh> +Content-Length: 2311 +Lines: 60 +X-Developer-Signature: v=1; a=openpgp-sha256; l=2372; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=aWSjeFHhYguCtXu+1ZqkbSU7CmH16hLVLwRmHFHmy+E=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH198X3rB4dVjm6y6uN83BLcx2x59Hei1UEly18/7o + ot/tvU3d8SyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEGo0YFkw4t73q/+KXrWa/ + 709h6Rf+empltBXDfG/BfA7RTeEfZ+6Q8XKUO3/zWey+SAA= +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +drm/nouveau: fix several DMA buffer leaks + +Nouveau manages GSP-RM DMA buffers with nvkm_gsp_mem objects. Several of +these buffers are never dealloced. Some of them can be deallocated +right after GSP-RM is initialized, but the rest need to stay until the +driver unloads. + +Also futher bullet-proof these objects by poisoning the buffer and +clearing the nvkm_gsp_mem object when it is deallocated. Poisoning +the buffer should trigger an error (or crash) from GSP-RM if it tries +to access the buffer after we've deallocated it, because we were wrong +about when it is safe to deallocate. + +Finally, change the mem->size field to a size_t because that's the same +type that dma_alloc_coherent expects. + +The Linux kernel CVE team has assigned CVE-2024-26912 to this issue. + + +Affected and fixed versions +=========================== + + Issue introduced in 6.7 with commit 176fdcbddfd2 and fixed in 6.7.6 with commit 6190d4c08897 + Issue introduced in 6.7 with commit 176fdcbddfd2 and fixed in 6.8 with commit 042b5f83841f + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26912 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/6190d4c08897d748dd25f0b78267a90aa1694e15 + https://git.kernel.org/stable/c/042b5f83841fbf7ce39474412db3b5e4765a7ea7 diff --git a/cve/published/2024/CVE-2024-26912.sha1 b/cve/published/2024/CVE-2024-26912.sha1 new file mode 100644 index 00000000..c6674ac3 --- /dev/null +++ b/cve/published/2024/CVE-2024-26912.sha1 @@ -0,0 +1 @@ +042b5f83841fbf7ce39474412db3b5e4765a7ea7 diff --git a/cve/reserved/2024/CVE-2024-26913 b/cve/published/2024/CVE-2024-26913 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26913 +++ b/cve/published/2024/CVE-2024-26913 diff --git a/cve/published/2024/CVE-2024-26913.json b/cve/published/2024/CVE-2024-26913.json new file mode 100644 index 00000000..cd6acda3 --- /dev/null +++ b/cve/published/2024/CVE-2024-26913.json @@ -0,0 +1,78 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue\n\n[why]\nodm calculation is missing for pipe split policy determination\nand cause Underflow/Corruption issue.\n\n[how]\nAdd the odm calculation." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "1da177e4c3f4", + "lessThan": "cdbe0be8874c", + "status": "affected", + "versionType": "git" + }, + { + "version": "1da177e4c3f4", + "lessThan": "faf51b201bc4", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/cdbe0be8874c63bca85b8c38e5b1eecbdd18df31" + }, + { + "url": "https://git.kernel.org/stable/c/faf51b201bc42adf500945732abb6220c707d6f3" + } + ], + "title": "drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26913", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26913.mbox b/cve/published/2024/CVE-2024-26913.mbox new file mode 100644 index 00000000..fe98a326 --- /dev/null +++ b/cve/published/2024/CVE-2024-26913.mbox @@ -0,0 +1,70 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26913: drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue +Message-Id: <2024041736-CVE-2024-26913-2cb3@gregkh> +Content-Length: 1720 +Lines: 53 +X-Developer-Signature: v=1; a=openpgp-sha256; l=1774; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=K+q2VvK5nRsVhr5eF6KRi5o5Ehc/DdQTgywYwC6vryg=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH18+V57jp3vaequVjEvqbymXZWIPf8pwff14ttlpx + z1VVheJjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZiIpxjDLOb++AdlVxrVn62T + L1C2D75/KzhgH8OC2c9OXxPyCzZevyC1ZcdpBsXWz2Z6AA== +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue + +[why] +odm calculation is missing for pipe split policy determination +and cause Underflow/Corruption issue. + +[how] +Add the odm calculation. + +The Linux kernel CVE team has assigned CVE-2024-26913 to this issue. + + +Affected and fixed versions +=========================== + + Fixed in 6.7.6 with commit cdbe0be8874c + Fixed in 6.8 with commit faf51b201bc4 + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26913 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c + drivers/gpu/drm/amd/display/dc/inc/core_types.h + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/cdbe0be8874c63bca85b8c38e5b1eecbdd18df31 + https://git.kernel.org/stable/c/faf51b201bc42adf500945732abb6220c707d6f3 diff --git a/cve/published/2024/CVE-2024-26913.sha1 b/cve/published/2024/CVE-2024-26913.sha1 new file mode 100644 index 00000000..0d1e30e7 --- /dev/null +++ b/cve/published/2024/CVE-2024-26913.sha1 @@ -0,0 +1 @@ +faf51b201bc42adf500945732abb6220c707d6f3 diff --git a/cve/reserved/2024/CVE-2024-26914 b/cve/published/2024/CVE-2024-26914 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26914 +++ b/cve/published/2024/CVE-2024-26914 diff --git a/cve/published/2024/CVE-2024-26914.json b/cve/published/2024/CVE-2024-26914.json new file mode 100644 index 00000000..48e0ee3e --- /dev/null +++ b/cve/published/2024/CVE-2024-26914.json @@ -0,0 +1,78 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix incorrect mpc_combine array size\n\n[why]\nMAX_SURFACES is per stream, while MAX_PLANES is per asic. The\nmpc_combine is an array that records all the planes per asic. Therefore\nMAX_PLANES should be used as the array size. Using MAX_SURFACES causes\narray overflow when there are more than 3 planes.\n\n[how]\nUse the MAX_PLANES for the mpc_combine array size." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "1da177e4c3f4", + "lessThan": "0bd8ef618a42", + "status": "affected", + "versionType": "git" + }, + { + "version": "1da177e4c3f4", + "lessThan": "39079fe8e660", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3" + }, + { + "url": "https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f" + } + ], + "title": "drm/amd/display: fix incorrect mpc_combine array size", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26914", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26914.mbox b/cve/published/2024/CVE-2024-26914.mbox new file mode 100644 index 00000000..c71332c2 --- /dev/null +++ b/cve/published/2024/CVE-2024-26914.mbox @@ -0,0 +1,71 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26914: drm/amd/display: fix incorrect mpc_combine array size +Message-Id: <2024041737-CVE-2024-26914-e47b@gregkh> +Content-Length: 1837 +Lines: 54 +X-Developer-Signature: v=1; a=openpgp-sha256; l=1892; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=JFkboYKV4Dx35NvoTB116R6CyvQjUP3EsDmii4qG9LU=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH1+Wf6qZIXDo0jqHJNZNr6dt2B32L3Wq4BGfubX7f + 33axV8X1xHLwiDIxCArpsjyZRvP0f0VhxS9DG1Pw8xhZQIZwsDFKQATmS3MsGA516YNJk90pNL3 + arCzHpRteMQ7bTbDPBOOuUvPsZiamHC9W7T0/JOkxYnnVwEA +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +drm/amd/display: fix incorrect mpc_combine array size + +[why] +MAX_SURFACES is per stream, while MAX_PLANES is per asic. The +mpc_combine is an array that records all the planes per asic. Therefore +MAX_PLANES should be used as the array size. Using MAX_SURFACES causes +array overflow when there are more than 3 planes. + +[how] +Use the MAX_PLANES for the mpc_combine array size. + +The Linux kernel CVE team has assigned CVE-2024-26914 to this issue. + + +Affected and fixed versions +=========================== + + Fixed in 6.7.6 with commit 0bd8ef618a42 + Fixed in 6.8 with commit 39079fe8e660 + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26914 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3 + https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f diff --git a/cve/published/2024/CVE-2024-26914.sha1 b/cve/published/2024/CVE-2024-26914.sha1 new file mode 100644 index 00000000..f33d1de0 --- /dev/null +++ b/cve/published/2024/CVE-2024-26914.sha1 @@ -0,0 +1 @@ +39079fe8e660851abbafa90cd55cbf029210661f diff --git a/cve/reserved/2024/CVE-2024-26915 b/cve/published/2024/CVE-2024-26915 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26915 +++ b/cve/published/2024/CVE-2024-26915 diff --git a/cve/published/2024/CVE-2024-26915.json b/cve/published/2024/CVE-2024-26915.json new file mode 100644 index 00000000..4ad2e849 --- /dev/null +++ b/cve/published/2024/CVE-2024-26915.json @@ -0,0 +1,123 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Reset IH OVERFLOW_CLEAR bit\n\nAllows us to detect subsequent IH ring buffer overflows as well." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "1da177e4c3f4", + "lessThan": "9a9d00c23d17", + "status": "affected", + "versionType": "git" + }, + { + "version": "1da177e4c3f4", + "lessThan": "a28f4d1e0bed", + "status": "affected", + "versionType": "git" + }, + { + "version": "1da177e4c3f4", + "lessThan": "8983397951b4", + "status": "affected", + "versionType": "git" + }, + { + "version": "1da177e4c3f4", + "lessThan": "2827633c9dab", + "status": "affected", + "versionType": "git" + }, + { + "version": "1da177e4c3f4", + "lessThan": "733025626866", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "5.15.152", + "lessThanOrEqual": "5.15.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.1.82", + "lessThanOrEqual": "6.1.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.6.18", + "lessThanOrEqual": "6.6.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/9a9d00c23d170d4ef5a1b28e6b69f5c85dd12bc1" + }, + { + "url": "https://git.kernel.org/stable/c/a28f4d1e0bed85943d309ac243fd1c200f8af9a2" + }, + { + "url": "https://git.kernel.org/stable/c/8983397951b4b0bd51bb4b4ba9749424e1ccbb70" + }, + { + "url": "https://git.kernel.org/stable/c/2827633c9dab6304ec4cdbf369363219832e605d" + }, + { + "url": "https://git.kernel.org/stable/c/7330256268664ea0a7dd5b07a3fed363093477dd" + } + ], + "title": "drm/amdgpu: Reset IH OVERFLOW_CLEAR bit", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26915", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26915.mbox b/cve/published/2024/CVE-2024-26915.mbox new file mode 100644 index 00000000..93d245c2 --- /dev/null +++ b/cve/published/2024/CVE-2024-26915.mbox @@ -0,0 +1,79 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26915: drm/amdgpu: Reset IH OVERFLOW_CLEAR bit +Message-Id: <2024041737-CVE-2024-26915-112b@gregkh> +Content-Length: 2250 +Lines: 62 +X-Developer-Signature: v=1; a=openpgp-sha256; l=2313; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=cNSr2cjJ5jgWHjIET0yRtvqg4gL8T3E0FMpW2VIpulc=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH18WMSxptLyzL/LgC6P3Otulr4bw2W5SXm36w3pH1 + s/j3gvSOmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiTBkMC64b1sn6b2xz3D4h + 8hRzW/veQm+Pnwzz634efMRicHb7bA+nnNsJ3NGLTC16AA== +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +drm/amdgpu: Reset IH OVERFLOW_CLEAR bit + +Allows us to detect subsequent IH ring buffer overflows as well. + +The Linux kernel CVE team has assigned CVE-2024-26915 to this issue. + + +Affected and fixed versions +=========================== + + Fixed in 5.15.152 with commit 9a9d00c23d17 + Fixed in 6.1.82 with commit a28f4d1e0bed + Fixed in 6.6.18 with commit 8983397951b4 + Fixed in 6.7.6 with commit 2827633c9dab + Fixed in 6.8 with commit 733025626866 + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26915 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + drivers/gpu/drm/amd/amdgpu/cik_ih.c + drivers/gpu/drm/amd/amdgpu/cz_ih.c + drivers/gpu/drm/amd/amdgpu/iceland_ih.c + drivers/gpu/drm/amd/amdgpu/ih_v6_0.c + drivers/gpu/drm/amd/amdgpu/ih_v6_1.c + drivers/gpu/drm/amd/amdgpu/navi10_ih.c + drivers/gpu/drm/amd/amdgpu/si_ih.c + drivers/gpu/drm/amd/amdgpu/tonga_ih.c + drivers/gpu/drm/amd/amdgpu/vega10_ih.c + drivers/gpu/drm/amd/amdgpu/vega20_ih.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/9a9d00c23d170d4ef5a1b28e6b69f5c85dd12bc1 + https://git.kernel.org/stable/c/a28f4d1e0bed85943d309ac243fd1c200f8af9a2 + https://git.kernel.org/stable/c/8983397951b4b0bd51bb4b4ba9749424e1ccbb70 + https://git.kernel.org/stable/c/2827633c9dab6304ec4cdbf369363219832e605d + https://git.kernel.org/stable/c/7330256268664ea0a7dd5b07a3fed363093477dd diff --git a/cve/published/2024/CVE-2024-26915.sha1 b/cve/published/2024/CVE-2024-26915.sha1 new file mode 100644 index 00000000..0b23f513 --- /dev/null +++ b/cve/published/2024/CVE-2024-26915.sha1 @@ -0,0 +1 @@ +7330256268664ea0a7dd5b07a3fed363093477dd diff --git a/cve/reserved/2024/CVE-2024-26916 b/cve/published/2024/CVE-2024-26916 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26916 +++ b/cve/published/2024/CVE-2024-26916 diff --git a/cve/published/2024/CVE-2024-26916.json b/cve/published/2024/CVE-2024-26916.json new file mode 100644 index 00000000..5c3bf9e7 --- /dev/null +++ b/cve/published/2024/CVE-2024-26916.json @@ -0,0 +1,133 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"drm/amd: flush any delayed gfxoff on suspend entry\"\n\ncommit ab4750332dbe (\"drm/amdgpu/sdma5.2: add begin/end_use ring\ncallbacks\") caused GFXOFF control to be used more heavily and the\ncodepath that was removed from commit 0dee72639533 (\"drm/amd: flush any\ndelayed gfxoff on suspend entry\") now can be exercised at suspend again.\n\nUsers report that by using GNOME to suspend the lockscreen trigger will\ncause SDMA traffic and the system can deadlock.\n\nThis reverts commit 0dee726395333fea833eaaf838bc80962df886c8." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "f94942885e84", + "lessThan": "65158edb0a3a", + "status": "affected", + "versionType": "git" + }, + { + "version": "78b2ba39beef", + "lessThan": "ff70e6ff6fc2", + "status": "affected", + "versionType": "git" + }, + { + "version": "3aae4ef4d799", + "lessThan": "caa2565a2e13", + "status": "affected", + "versionType": "git" + }, + { + "version": "ab4750332dbe", + "lessThan": "d855ceb6a5fd", + "status": "affected", + "versionType": "git" + }, + { + "version": "ab4750332dbe", + "lessThan": "916361685319", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "6.7", + "status": "affected" + }, + { + "version": "0", + "lessThan": "6.7", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.15.149", + "lessThanOrEqual": "5.15.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.1.79", + "lessThanOrEqual": "6.1.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.6.18", + "lessThanOrEqual": "6.6.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/65158edb0a3a8df23197d52cd24287e39eaf95d6" + }, + { + "url": "https://git.kernel.org/stable/c/ff70e6ff6fc2413caf33410af7462d1f584d927e" + }, + { + "url": "https://git.kernel.org/stable/c/caa2565a2e13899be31f7b1e069e6465d3e2adb0" + }, + { + "url": "https://git.kernel.org/stable/c/d855ceb6a5fde668c5431156bc60fae0cc52b764" + }, + { + "url": "https://git.kernel.org/stable/c/916361685319098f696b798ef1560f69ed96e934" + } + ], + "title": "Revert \"drm/amd: flush any delayed gfxoff on suspend entry\"", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26916", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26916.mbox b/cve/published/2024/CVE-2024-26916.mbox new file mode 100644 index 00000000..1d1918c8 --- /dev/null +++ b/cve/published/2024/CVE-2024-26916.mbox @@ -0,0 +1,79 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26916: Revert "drm/amd: flush any delayed gfxoff on suspend entry" +Message-Id: <2024041737-CVE-2024-26916-4a45@gregkh> +Content-Length: 2640 +Lines: 62 +X-Developer-Signature: v=1; a=openpgp-sha256; l=2703; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=W67Ori5fUFdJco6dH7/ZT5bIXgEo4JAhf1UyPBdGQ4g=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH19uORe+QttYtf/3m876975hapWGnJ8cEpOuXbz7f + fezj1odHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjARn5sMC/Y5rpws7xZlL9cY + FeYtPelFzsIP+xkWTLXznLIsbrNHxocrWn7LGzeqJUZ3AAA= +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +Revert "drm/amd: flush any delayed gfxoff on suspend entry" + +commit ab4750332dbe ("drm/amdgpu/sdma5.2: add begin/end_use ring +callbacks") caused GFXOFF control to be used more heavily and the +codepath that was removed from commit 0dee72639533 ("drm/amd: flush any +delayed gfxoff on suspend entry") now can be exercised at suspend again. + +Users report that by using GNOME to suspend the lockscreen trigger will +cause SDMA traffic and the system can deadlock. + +This reverts commit 0dee726395333fea833eaaf838bc80962df886c8. + +The Linux kernel CVE team has assigned CVE-2024-26916 to this issue. + + +Affected and fixed versions +=========================== + + Issue introduced in 5.15.144 with commit f94942885e84 and fixed in 5.15.149 with commit 65158edb0a3a + Issue introduced in 6.1.69 with commit 78b2ba39beef and fixed in 6.1.79 with commit ff70e6ff6fc2 + Issue introduced in 6.6.8 with commit 3aae4ef4d799 and fixed in 6.6.18 with commit caa2565a2e13 + Issue introduced in 6.7 with commit ab4750332dbe and fixed in 6.7.6 with commit d855ceb6a5fd + Issue introduced in 6.7 with commit ab4750332dbe and fixed in 6.8 with commit 916361685319 + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26916 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/65158edb0a3a8df23197d52cd24287e39eaf95d6 + https://git.kernel.org/stable/c/ff70e6ff6fc2413caf33410af7462d1f584d927e + https://git.kernel.org/stable/c/caa2565a2e13899be31f7b1e069e6465d3e2adb0 + https://git.kernel.org/stable/c/d855ceb6a5fde668c5431156bc60fae0cc52b764 + https://git.kernel.org/stable/c/916361685319098f696b798ef1560f69ed96e934 diff --git a/cve/published/2024/CVE-2024-26916.sha1 b/cve/published/2024/CVE-2024-26916.sha1 new file mode 100644 index 00000000..b309275e --- /dev/null +++ b/cve/published/2024/CVE-2024-26916.sha1 @@ -0,0 +1 @@ +916361685319098f696b798ef1560f69ed96e934 diff --git a/cve/reserved/2024/CVE-2024-26917 b/cve/published/2024/CVE-2024-26917 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26917 +++ b/cve/published/2024/CVE-2024-26917 diff --git a/cve/published/2024/CVE-2024-26917.json b/cve/published/2024/CVE-2024-26917.json new file mode 100644 index 00000000..7ec13d4a --- /dev/null +++ b/cve/published/2024/CVE-2024-26917.json @@ -0,0 +1,178 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: Revert \"scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock\"\n\nThis reverts commit 1a1975551943f681772720f639ff42fbaa746212.\n\nThis commit causes interrupts to be lost for FCoE devices, since it changed\nsping locks from \"bh\" to \"irqsave\".\n\nInstead, a work queue should be used, and will be addressed in a separate\ncommit." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "264eae2f523d", + "lessThan": "94a600226b6d", + "status": "affected", + "versionType": "git" + }, + { + "version": "d2bf25674cea", + "lessThan": "2209fc6e3d77", + "status": "affected", + "versionType": "git" + }, + { + "version": "9cce8ef7a6fa", + "lessThan": "7d4e19f7ff64", + "status": "affected", + "versionType": "git" + }, + { + "version": "076fb40cf27a", + "lessThan": "5b8f473c4de9", + "status": "affected", + "versionType": "git" + }, + { + "version": "5a5fb3b1754f", + "lessThan": "6bb22ac1d11d", + "status": "affected", + "versionType": "git" + }, + { + "version": "1a1975551943", + "lessThan": "2996c7e97ea7", + "status": "affected", + "versionType": "git" + }, + { + "version": "1a1975551943", + "lessThan": "25675159040b", + "status": "affected", + "versionType": "git" + }, + { + "version": "1a1975551943", + "lessThan": "977fe773dcc7", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "6.6", + "status": "affected" + }, + { + "version": "0", + "lessThan": "6.6", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "4.19.307", + "lessThanOrEqual": "4.19.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.4.269", + "lessThanOrEqual": "5.4.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.10.210", + "lessThanOrEqual": "5.10.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.15.149", + "lessThanOrEqual": "5.15.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.1.79", + "lessThanOrEqual": "6.1.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.6.18", + "lessThanOrEqual": "6.6.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/94a600226b6d0ef065ee84024b450b566c5a87d6" + }, + { + "url": "https://git.kernel.org/stable/c/2209fc6e3d7727d787dc6ef9baa1e9eae6b1295b" + }, + { + "url": "https://git.kernel.org/stable/c/7d4e19f7ff644c5b79e8271df8ac2e549b436a5b" + }, + { + "url": "https://git.kernel.org/stable/c/5b8f473c4de95c056c1c767b1ad48c191544f6a5" + }, + { + "url": "https://git.kernel.org/stable/c/6bb22ac1d11d7d20f91e7fd2e657a9e5f6db65e0" + }, + { + "url": "https://git.kernel.org/stable/c/2996c7e97ea7cf4c1838a1b1dbc0885934113783" + }, + { + "url": "https://git.kernel.org/stable/c/25675159040bffc7992d5163f3f33ba7d0142f21" + }, + { + "url": "https://git.kernel.org/stable/c/977fe773dcc7098d8eaf4ee6382cb51e13e784cb" + } + ], + "title": "scsi: Revert \"scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock\"", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26917", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26917.mbox b/cve/published/2024/CVE-2024-26917.mbox new file mode 100644 index 00000000..2835effc --- /dev/null +++ b/cve/published/2024/CVE-2024-26917.mbox @@ -0,0 +1,85 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26917: scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" +Message-Id: <2024041737-CVE-2024-26917-8eda@gregkh> +Content-Length: 3077 +Lines: 68 +X-Developer-Signature: v=1; a=openpgp-sha256; l=3146; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=MgL8c+/S6JnnEEP3fBltvmUDNTiu2iBMmRL0DAnWRnc=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH19K5LNJXl692C5i9l559ZJkVuOJpTOneYR4LbFTV + vR1zg/riGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIlczWdYcHD/eubrEqWPot2j + 8j9zXwvPaoh2YVhw8yLr5WZTQZ/OOu/im2lfpKQaD+wCAA== +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" + +This reverts commit 1a1975551943f681772720f639ff42fbaa746212. + +This commit causes interrupts to be lost for FCoE devices, since it changed +sping locks from "bh" to "irqsave". + +Instead, a work queue should be used, and will be addressed in a separate +commit. + +The Linux kernel CVE team has assigned CVE-2024-26917 to this issue. + + +Affected and fixed versions +=========================== + + Issue introduced in 4.19.295 with commit 264eae2f523d and fixed in 4.19.307 with commit 94a600226b6d + Issue introduced in 5.4.257 with commit d2bf25674cea and fixed in 5.4.269 with commit 2209fc6e3d77 + Issue introduced in 5.10.195 with commit 9cce8ef7a6fa and fixed in 5.10.210 with commit 7d4e19f7ff64 + Issue introduced in 5.15.132 with commit 076fb40cf27a and fixed in 5.15.149 with commit 5b8f473c4de9 + Issue introduced in 6.1.53 with commit 5a5fb3b1754f and fixed in 6.1.79 with commit 6bb22ac1d11d + Issue introduced in 6.6 with commit 1a1975551943 and fixed in 6.6.18 with commit 2996c7e97ea7 + Issue introduced in 6.6 with commit 1a1975551943 and fixed in 6.7.6 with commit 25675159040b + Issue introduced in 6.6 with commit 1a1975551943 and fixed in 6.8 with commit 977fe773dcc7 + Issue introduced in 4.14.326 with commit 4ea46b479a00 + Issue introduced in 6.4.16 with commit 694ddc5bf35a + Issue introduced in 6.5.3 with commit 6c5d7242bcf2 + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26917 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + drivers/scsi/fcoe/fcoe_ctlr.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/94a600226b6d0ef065ee84024b450b566c5a87d6 + https://git.kernel.org/stable/c/2209fc6e3d7727d787dc6ef9baa1e9eae6b1295b + https://git.kernel.org/stable/c/7d4e19f7ff644c5b79e8271df8ac2e549b436a5b + https://git.kernel.org/stable/c/5b8f473c4de95c056c1c767b1ad48c191544f6a5 + https://git.kernel.org/stable/c/6bb22ac1d11d7d20f91e7fd2e657a9e5f6db65e0 + https://git.kernel.org/stable/c/2996c7e97ea7cf4c1838a1b1dbc0885934113783 + https://git.kernel.org/stable/c/25675159040bffc7992d5163f3f33ba7d0142f21 + https://git.kernel.org/stable/c/977fe773dcc7098d8eaf4ee6382cb51e13e784cb diff --git a/cve/published/2024/CVE-2024-26917.sha1 b/cve/published/2024/CVE-2024-26917.sha1 new file mode 100644 index 00000000..fdbc15ed --- /dev/null +++ b/cve/published/2024/CVE-2024-26917.sha1 @@ -0,0 +1 @@ +977fe773dcc7098d8eaf4ee6382cb51e13e784cb diff --git a/cve/reserved/2024/CVE-2024-26918 b/cve/published/2024/CVE-2024-26918 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26918 +++ b/cve/published/2024/CVE-2024-26918 diff --git a/cve/published/2024/CVE-2024-26918.json b/cve/published/2024/CVE-2024-26918.json new file mode 100644 index 00000000..48d21e22 --- /dev/null +++ b/cve/published/2024/CVE-2024-26918.json @@ -0,0 +1,103 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix active state requirement in PME polling\n\nThe commit noted in fixes added a bogus requirement that runtime PM managed\ndevices need to be in the RPM_ACTIVE state for PME polling. In fact, only\ndevices in low power states should be polled.\n\nHowever there's still a requirement that the device config space must be\naccessible, which has implications for both the current state of the polled\ndevice and the parent bridge, when present. It's not sufficient to assume\nthe bridge remains in D0 and cases have been observed where the bridge\npasses the D0 test, but the PM state indicates RPM_SUSPENDING and config\nspace of the polled device becomes inaccessible during pci_pme_wakeup().\n\nTherefore, since the bridge is already effectively required to be in the\nRPM_ACTIVE state, formalize this in the code and elevate the PM usage count\nto maintain the state while polling the subordinate device.\n\nThis resolves a regression reported in the bugzilla below where a\nThunderbolt/USB4 hierarchy fails to scan for an attached NVMe endpoint\ndownstream of a bridge in a D3hot power state." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "d3fcd7360338", + "lessThan": "63b1a3d9dd3b", + "status": "affected", + "versionType": "git" + }, + { + "version": "d3fcd7360338", + "lessThan": "a4f12e5cbac2", + "status": "affected", + "versionType": "git" + }, + { + "version": "d3fcd7360338", + "lessThan": "41044d536068", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "6.6", + "status": "affected" + }, + { + "version": "0", + "lessThan": "6.6", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.6.18", + "lessThanOrEqual": "6.6.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/63b1a3d9dd3b3f6d67f524e76270e66767090583" + }, + { + "url": "https://git.kernel.org/stable/c/a4f12e5cbac2865c151d1e97e36eb24205afb23b" + }, + { + "url": "https://git.kernel.org/stable/c/41044d5360685e78a869d40a168491a70cdb7e73" + } + ], + "title": "PCI: Fix active state requirement in PME polling", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26918", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26918.mbox b/cve/published/2024/CVE-2024-26918.mbox new file mode 100644 index 00000000..2a97ac35 --- /dev/null +++ b/cve/published/2024/CVE-2024-26918.mbox @@ -0,0 +1,83 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26918: PCI: Fix active state requirement in PME polling +Message-Id: <2024041738-CVE-2024-26918-6767@gregkh> +Content-Length: 2787 +Lines: 66 +X-Developer-Signature: v=1; a=openpgp-sha256; l=2854; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=40DiJQeX1Bpx14icc/pLnzFmRjFSYdzaLgu136nBw1Q=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH1+dTJ577OnfKRGctTsiNykyHrsnNH1LRou7kI+M6 + imBMKfVHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjARp3cMC07yqt5LP/TxUfsF + o/MC0vZ8ek/KUhnmWa2vnLL+bFhv64MNJbUiR630fdWUAQ== +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +PCI: Fix active state requirement in PME polling + +The commit noted in fixes added a bogus requirement that runtime PM managed +devices need to be in the RPM_ACTIVE state for PME polling. In fact, only +devices in low power states should be polled. + +However there's still a requirement that the device config space must be +accessible, which has implications for both the current state of the polled +device and the parent bridge, when present. It's not sufficient to assume +the bridge remains in D0 and cases have been observed where the bridge +passes the D0 test, but the PM state indicates RPM_SUSPENDING and config +space of the polled device becomes inaccessible during pci_pme_wakeup(). + +Therefore, since the bridge is already effectively required to be in the +RPM_ACTIVE state, formalize this in the code and elevate the PM usage count +to maintain the state while polling the subordinate device. + +This resolves a regression reported in the bugzilla below where a +Thunderbolt/USB4 hierarchy fails to scan for an attached NVMe endpoint +downstream of a bridge in a D3hot power state. + +The Linux kernel CVE team has assigned CVE-2024-26918 to this issue. + + +Affected and fixed versions +=========================== + + Issue introduced in 6.6 with commit d3fcd7360338 and fixed in 6.6.18 with commit 63b1a3d9dd3b + Issue introduced in 6.6 with commit d3fcd7360338 and fixed in 6.7.6 with commit a4f12e5cbac2 + Issue introduced in 6.6 with commit d3fcd7360338 and fixed in 6.8 with commit 41044d536068 + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26918 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + drivers/pci/pci.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/63b1a3d9dd3b3f6d67f524e76270e66767090583 + https://git.kernel.org/stable/c/a4f12e5cbac2865c151d1e97e36eb24205afb23b + https://git.kernel.org/stable/c/41044d5360685e78a869d40a168491a70cdb7e73 diff --git a/cve/published/2024/CVE-2024-26918.sha1 b/cve/published/2024/CVE-2024-26918.sha1 new file mode 100644 index 00000000..692e0613 --- /dev/null +++ b/cve/published/2024/CVE-2024-26918.sha1 @@ -0,0 +1 @@ +41044d5360685e78a869d40a168491a70cdb7e73 diff --git a/cve/reserved/2024/CVE-2024-26919 b/cve/published/2024/CVE-2024-26919 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26919 +++ b/cve/published/2024/CVE-2024-26919 diff --git a/cve/published/2024/CVE-2024-26919.json b/cve/published/2024/CVE-2024-26919.json new file mode 100644 index 00000000..2a9f86e6 --- /dev/null +++ b/cve/published/2024/CVE-2024-26919.json @@ -0,0 +1,118 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: Fix debugfs directory leak\n\nThe ULPI per-device debugfs root is named after the ulpi device's\nparent, but ulpi_unregister_interface tries to remove a debugfs\ndirectory named after the ulpi device itself. This results in the\ndirectory sticking around and preventing subsequent (deferred) probes\nfrom succeeding. Change the directory name to match the ulpi device." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "bd0a0a024f2a", + "lessThan": "d31b886ed6a5", + "status": "affected", + "versionType": "git" + }, + { + "version": "bd0a0a024f2a", + "lessThan": "330d22aba17a", + "status": "affected", + "versionType": "git" + }, + { + "version": "bd0a0a024f2a", + "lessThan": "33713945cc92", + "status": "affected", + "versionType": "git" + }, + { + "version": "bd0a0a024f2a", + "lessThan": "3caf2b2ad733", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "5.18", + "status": "affected" + }, + { + "version": "0", + "lessThan": "5.18", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.1.79", + "lessThanOrEqual": "6.1.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.6.18", + "lessThanOrEqual": "6.6.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6" + }, + { + "url": "https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b" + }, + { + "url": "https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3" + }, + { + "url": "https://git.kernel.org/stable/c/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368" + } + ], + "title": "usb: ulpi: Fix debugfs directory leak", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26919", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26919.mbox b/cve/published/2024/CVE-2024-26919.mbox new file mode 100644 index 00000000..9df1c4bf --- /dev/null +++ b/cve/published/2024/CVE-2024-26919.mbox @@ -0,0 +1,72 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26919: usb: ulpi: Fix debugfs directory leak +Message-Id: <2024041738-CVE-2024-26919-5100@gregkh> +Content-Length: 2258 +Lines: 55 +X-Developer-Signature: v=1; a=openpgp-sha256; l=2314; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=uDPEOpi6yuLmgN4+fMQMqeTF3gSwq/IuUBFiPJ5Ek3o=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH1+djIybxd3raMZ5+meT5vNfayYLfhQ/+sW5qDVTw + 3MrX0x2RywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAExk3yuGubIhnO+ago1Lvv/5 + O/fzx5rIq4+YehhmMb9lmmTwY+WR3Xqqq4XlJmo0uSRmAQA= +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +usb: ulpi: Fix debugfs directory leak + +The ULPI per-device debugfs root is named after the ulpi device's +parent, but ulpi_unregister_interface tries to remove a debugfs +directory named after the ulpi device itself. This results in the +directory sticking around and preventing subsequent (deferred) probes +from succeeding. Change the directory name to match the ulpi device. + +The Linux kernel CVE team has assigned CVE-2024-26919 to this issue. + + +Affected and fixed versions +=========================== + + Issue introduced in 5.18 with commit bd0a0a024f2a and fixed in 6.1.79 with commit d31b886ed6a5 + Issue introduced in 5.18 with commit bd0a0a024f2a and fixed in 6.6.18 with commit 330d22aba17a + Issue introduced in 5.18 with commit bd0a0a024f2a and fixed in 6.7.6 with commit 33713945cc92 + Issue introduced in 5.18 with commit bd0a0a024f2a and fixed in 6.8 with commit 3caf2b2ad733 + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26919 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + drivers/usb/common/ulpi.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6 + https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b + https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3 + https://git.kernel.org/stable/c/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368 diff --git a/cve/published/2024/CVE-2024-26919.sha1 b/cve/published/2024/CVE-2024-26919.sha1 new file mode 100644 index 00000000..8fe4ad9c --- /dev/null +++ b/cve/published/2024/CVE-2024-26919.sha1 @@ -0,0 +1 @@ +3caf2b2ad7334ef35f55b95f3e1b138c6f77b368 diff --git a/cve/reserved/2024/CVE-2024-26920 b/cve/published/2024/CVE-2024-26920 index e69de29b..e69de29b 100644 --- a/cve/reserved/2024/CVE-2024-26920 +++ b/cve/published/2024/CVE-2024-26920 diff --git a/cve/published/2024/CVE-2024-26920.json b/cve/published/2024/CVE-2024-26920.json new file mode 100644 index 00000000..202ed01c --- /dev/null +++ b/cve/published/2024/CVE-2024-26920.json @@ -0,0 +1,178 @@ +{ + "containers": { + "cna": { + "providerMetadata": { + "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" + }, + "descriptions": [ + { + "lang": "en", + "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/trigger: Fix to return error if failed to alloc snapshot\n\nFix register_snapshot_trigger() to return error code if it failed to\nallocate a snapshot instead of 0 (success). Unless that, it will register\nsnapshot trigger without an error." + } + ], + "affected": [ + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "unaffected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "57f2a2ad73e9", + "lessThan": "bcf4a115a506", + "status": "affected", + "versionType": "git" + }, + { + "version": "0026e356e51a", + "lessThan": "8ffd5590f4d6", + "status": "affected", + "versionType": "git" + }, + { + "version": "0bbe7f719985", + "lessThan": "56cfbe607107", + "status": "affected", + "versionType": "git" + }, + { + "version": "0bbe7f719985", + "lessThan": "b5085b5ac1d9", + "status": "affected", + "versionType": "git" + }, + { + "version": "0bbe7f719985", + "lessThan": "36be97e9eb53", + "status": "affected", + "versionType": "git" + }, + { + "version": "0bbe7f719985", + "lessThan": "6022c065c9ec", + "status": "affected", + "versionType": "git" + }, + { + "version": "0bbe7f719985", + "lessThan": "4b001ef14baa", + "status": "affected", + "versionType": "git" + }, + { + "version": "0bbe7f719985", + "lessThan": "0958b33ef5a0", + "status": "affected", + "versionType": "git" + } + ] + }, + { + "product": "Linux", + "vendor": "Linux", + "defaultStatus": "affected", + "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", + "versions": [ + { + "version": "5.7", + "status": "affected" + }, + { + "version": "0", + "lessThan": "5.7", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "4.19.307", + "lessThanOrEqual": "4.19.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.4.269", + "lessThanOrEqual": "5.4.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.10.210", + "lessThanOrEqual": "5.10.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "5.15.149", + "lessThanOrEqual": "5.15.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.1.79", + "lessThanOrEqual": "6.1.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.6.18", + "lessThanOrEqual": "6.6.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.7.6", + "lessThanOrEqual": "6.7.*", + "status": "unaffected", + "versionType": "custom" + }, + { + "version": "6.8", + "lessThanOrEqual": "*", + "status": "unaffected", + "versionType": "original_commit_for_fix" + } + ] + } + ], + "references": [ + { + "url": "https://git.kernel.org/stable/c/bcf4a115a5068f3331fafb8c176c1af0da3d8b19" + }, + { + "url": "https://git.kernel.org/stable/c/8ffd5590f4d6ef5460acbeac7fbdff7025f9b419" + }, + { + "url": "https://git.kernel.org/stable/c/56cfbe60710772916a5ba092c99542332b48e870" + }, + { + "url": "https://git.kernel.org/stable/c/b5085b5ac1d96ea2a8a6240f869655176ce44197" + }, + { + "url": "https://git.kernel.org/stable/c/36be97e9eb535fe3008a5cb040b1e56f29f2e398" + }, + { + "url": "https://git.kernel.org/stable/c/6022c065c9ec465d84cebff8f480db083e4ee06b" + }, + { + "url": "https://git.kernel.org/stable/c/4b001ef14baab16b553a002cb9979e31b8fc0c6b" + }, + { + "url": "https://git.kernel.org/stable/c/0958b33ef5a04ed91f61cef4760ac412080c4e08" + } + ], + "title": "tracing/trigger: Fix to return error if failed to alloc snapshot", + "x_generator": { + "engine": "bippy-d175d3acf727" + } + } + }, + "cveMetadata": { + "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", + "cveID": "CVE-2024-26920", + "requesterUserId": "gregkh@kernel.org", + "serial": "1", + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.0" +} diff --git a/cve/published/2024/CVE-2024-26920.mbox b/cve/published/2024/CVE-2024-26920.mbox new file mode 100644 index 00000000..e5872794 --- /dev/null +++ b/cve/published/2024/CVE-2024-26920.mbox @@ -0,0 +1,83 @@ +From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +To: <linux-cve-announce@vger.kernel.org> +Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> +Subject: CVE-2024-26920: tracing/trigger: Fix to return error if failed to alloc snapshot +Message-Id: <2024041738-CVE-2024-26920-a681@gregkh> +Content-Length: 3093 +Lines: 66 +X-Developer-Signature: v=1; a=openpgp-sha256; l=3160; + i=gregkh@linuxfoundation.org; h=from:subject:message-id; + bh=vlL21PwuQg8yy+F7O2s6vhwTgPKhqsELg02KmokuR5I=; + b=owGbwMvMwCRo6H6F97bub03G02pJDGnyH1859SqtPi19OJ1ffln8tvB3vMdu5uU3/I54f5/51 + fGVdzaXdsSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEqqYyLJjJmnyumGl+2akd + a1Te3p0YcXgC7z2GBdP3e3+MTNEot7j/JNV/7rm9Hruj9gAA +X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; + fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 + +Description +=========== + +In the Linux kernel, the following vulnerability has been resolved: + +tracing/trigger: Fix to return error if failed to alloc snapshot + +Fix register_snapshot_trigger() to return error code if it failed to +allocate a snapshot instead of 0 (success). Unless that, it will register +snapshot trigger without an error. + +The Linux kernel CVE team has assigned CVE-2024-26920 to this issue. + + +Affected and fixed versions +=========================== + + Issue introduced in 4.19.117 with commit 57f2a2ad73e9 and fixed in 4.19.307 with commit bcf4a115a506 + Issue introduced in 5.4.34 with commit 0026e356e51a and fixed in 5.4.269 with commit 8ffd5590f4d6 + Issue introduced in 5.7 with commit 0bbe7f719985 and fixed in 5.10.210 with commit 56cfbe607107 + Issue introduced in 5.7 with commit 0bbe7f719985 and fixed in 5.15.149 with commit b5085b5ac1d9 + Issue introduced in 5.7 with commit 0bbe7f719985 and fixed in 6.1.79 with commit 36be97e9eb53 + Issue introduced in 5.7 with commit 0bbe7f719985 and fixed in 6.6.18 with commit 6022c065c9ec + Issue introduced in 5.7 with commit 0bbe7f719985 and fixed in 6.7.6 with commit 4b001ef14baa + Issue introduced in 5.7 with commit 0bbe7f719985 and fixed in 6.8 with commit 0958b33ef5a0 + Issue introduced in 4.4.220 with commit 7c6feb347a4b + Issue introduced in 4.9.220 with commit a289fd864722 + Issue introduced in 4.14.177 with commit 7054f86f268c + Issue introduced in 5.5.19 with commit ffa70d104691 + Issue introduced in 5.6.6 with commit 733c611a758c + +Please see https://www.kernel.org for a full list of currently supported +kernel versions by the kernel community. + +Unaffected versions might change over time as fixes are backported to +older supported kernel versions. The official CVE entry at + https://cve.org/CVERecord/?id=CVE-2024-26920 +will be updated if fixes are backported, please check that for the most +up to date information about this issue. + + +Affected files +============== + +The file(s) affected by this issue are: + kernel/trace/trace_events_trigger.c + + +Mitigation +========== + +The Linux kernel CVE team recommends that you update to the latest +stable kernel version for this, and many other bugfixes. Individual +changes are never tested alone, but rather are part of a larger kernel +release. Cherry-picking individual commits is not recommended or +supported by the Linux kernel community at all. If however, updating to +the latest release is impossible, the individual changes to resolve this +issue can be found at these commits: + https://git.kernel.org/stable/c/bcf4a115a5068f3331fafb8c176c1af0da3d8b19 + https://git.kernel.org/stable/c/8ffd5590f4d6ef5460acbeac7fbdff7025f9b419 + https://git.kernel.org/stable/c/56cfbe60710772916a5ba092c99542332b48e870 + https://git.kernel.org/stable/c/b5085b5ac1d96ea2a8a6240f869655176ce44197 + https://git.kernel.org/stable/c/36be97e9eb535fe3008a5cb040b1e56f29f2e398 + https://git.kernel.org/stable/c/6022c065c9ec465d84cebff8f480db083e4ee06b + https://git.kernel.org/stable/c/4b001ef14baab16b553a002cb9979e31b8fc0c6b + https://git.kernel.org/stable/c/0958b33ef5a04ed91f61cef4760ac412080c4e08 diff --git a/cve/published/2024/CVE-2024-26920.sha1 b/cve/published/2024/CVE-2024-26920.sha1 new file mode 100644 index 00000000..68a68fbf --- /dev/null +++ b/cve/published/2024/CVE-2024-26920.sha1 @@ -0,0 +1 @@ +0958b33ef5a04ed91f61cef4760ac412080c4e08 |