-
Notifications
You must be signed in to change notification settings - Fork 39
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
b2292ec
commit 701c368
Showing
349 changed files
with
8,004 additions
and
0 deletions.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
22 changes: 22 additions & 0 deletions
22
objects/vulnerability/vulnerability--00ae05fa-7a09-4170-97a9-fa48aba0e6b1.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
{ | ||
"type": "bundle", | ||
"id": "bundle--3e140161-e60d-4b8e-8113-2b26de5462e9", | ||
"objects": [ | ||
{ | ||
"type": "vulnerability", | ||
"spec_version": "2.1", | ||
"id": "vulnerability--00ae05fa-7a09-4170-97a9-fa48aba0e6b1", | ||
"created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", | ||
"created": "2024-12-30T00:22:03.507874Z", | ||
"modified": "2024-12-30T00:22:03.507874Z", | ||
"name": "CVE-2024-56590", | ||
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix not checking skb length on hci_acldata_packet\n\nThis fixes not checking if skb really contains an ACL header otherwise\nthe code may attempt to access some uninitilized/invalid memory past the\nvalid skb->data.", | ||
"external_references": [ | ||
{ | ||
"source_name": "cve", | ||
"external_id": "CVE-2024-56590" | ||
} | ||
] | ||
} | ||
] | ||
} |
22 changes: 22 additions & 0 deletions
22
objects/vulnerability/vulnerability--00d563a7-a0de-4ec2-ae7a-bba677e0f98b.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
{ | ||
"type": "bundle", | ||
"id": "bundle--7235653a-2c47-4f69-bd2e-173b742eaa7e", | ||
"objects": [ | ||
{ | ||
"type": "vulnerability", | ||
"spec_version": "2.1", | ||
"id": "vulnerability--00d563a7-a0de-4ec2-ae7a-bba677e0f98b", | ||
"created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", | ||
"created": "2024-12-30T00:22:03.497685Z", | ||
"modified": "2024-12-30T00:22:03.497685Z", | ||
"name": "CVE-2024-56545", | ||
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hyperv: streamline driver probe to avoid devres issues\n\nIt was found that unloading 'hid_hyperv' module results in a devres\ncomplaint:\n\n ...\n hv_vmbus: unregistering driver hid_hyperv\n ------------[ cut here ]------------\n WARNING: CPU: 2 PID: 3983 at drivers/base/devres.c:691 devres_release_group+0x1f2/0x2c0\n ...\n Call Trace:\n <TASK>\n ? devres_release_group+0x1f2/0x2c0\n ? __warn+0xd1/0x1c0\n ? devres_release_group+0x1f2/0x2c0\n ? report_bug+0x32a/0x3c0\n ? handle_bug+0x53/0xa0\n ? exc_invalid_op+0x18/0x50\n ? asm_exc_invalid_op+0x1a/0x20\n ? devres_release_group+0x1f2/0x2c0\n ? devres_release_group+0x90/0x2c0\n ? rcu_is_watching+0x15/0xb0\n ? __pfx_devres_release_group+0x10/0x10\n hid_device_remove+0xf5/0x220\n device_release_driver_internal+0x371/0x540\n ? klist_put+0xf3/0x170\n bus_remove_device+0x1f1/0x3f0\n device_del+0x33f/0x8c0\n ? __pfx_device_del+0x10/0x10\n ? cleanup_srcu_struct+0x337/0x500\n hid_destroy_device+0xc8/0x130\n mousevsc_remove+0xd2/0x1d0 [hid_hyperv]\n device_release_driver_internal+0x371/0x540\n driver_detach+0xc5/0x180\n bus_remove_driver+0x11e/0x2a0\n ? __mutex_unlock_slowpath+0x160/0x5e0\n vmbus_driver_unregister+0x62/0x2b0 [hv_vmbus]\n ...\n\nAnd the issue seems to be that the corresponding devres group is not\nallocated. Normally, devres_open_group() is called from\n__hid_device_probe() but Hyper-V HID driver overrides 'hid_dev->driver'\nwith 'mousevsc_hid_driver' stub and basically re-implements\n__hid_device_probe() by calling hid_parse() and hid_hw_start() but not\ndevres_open_group(). hid_device_probe() does not call __hid_device_probe()\nfor it. Later, when the driver is removed, hid_device_remove() calls\ndevres_release_group() as it doesn't check whether hdev->driver was\ninitially overridden or not.\n\nThe issue seems to be related to the commit 62c68e7cee33 (\"HID: ensure\ntimely release of driver-allocated resources\") but the commit itself seems\nto be correct.\n\nFix the issue by dropping the 'hid_dev->driver' override and using\nhid_register_driver()/hid_unregister_driver() instead. Alternatively, it\nwould have been possible to rely on the default handling but\nHID_CONNECT_DEFAULT implies HID_CONNECT_HIDRAW and it doesn't seem to work\nfor mousevsc as-is.", | ||
"external_references": [ | ||
{ | ||
"source_name": "cve", | ||
"external_id": "CVE-2024-56545" | ||
} | ||
] | ||
} | ||
] | ||
} |
22 changes: 22 additions & 0 deletions
22
objects/vulnerability/vulnerability--01694d05-8394-4954-9581-1fd1e01e74db.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
{ | ||
"type": "bundle", | ||
"id": "bundle--48205d46-0227-4b5a-89cc-fe27658cc466", | ||
"objects": [ | ||
{ | ||
"type": "vulnerability", | ||
"spec_version": "2.1", | ||
"id": "vulnerability--01694d05-8394-4954-9581-1fd1e01e74db", | ||
"created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", | ||
"created": "2024-12-30T00:22:02.391925Z", | ||
"modified": "2024-12-30T00:22:02.391925Z", | ||
"name": "CVE-2024-53204", | ||
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: realtek: usb: fix NULL deref in rtk_usb3phy_probe\n\nIn rtk_usb3phy_probe() devm_kzalloc() may return NULL\nbut this returned value is not checked.", | ||
"external_references": [ | ||
{ | ||
"source_name": "cve", | ||
"external_id": "CVE-2024-53204" | ||
} | ||
] | ||
} | ||
] | ||
} |
22 changes: 22 additions & 0 deletions
22
objects/vulnerability/vulnerability--01827e2f-4620-49cc-977b-6345f3efcd87.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
{ | ||
"type": "bundle", | ||
"id": "bundle--11e2aebf-1e22-43b1-9ade-3c1a12b4b7f8", | ||
"objects": [ | ||
{ | ||
"type": "vulnerability", | ||
"spec_version": "2.1", | ||
"id": "vulnerability--01827e2f-4620-49cc-977b-6345f3efcd87", | ||
"created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", | ||
"created": "2024-12-30T00:22:03.960074Z", | ||
"modified": "2024-12-30T00:22:03.960074Z", | ||
"name": "CVE-2024-13006", | ||
"description": "A vulnerability, which was classified as critical, has been found in 1000 Projects Human Resource Management System 1.0. This issue affects some unknown processing of the file /employeeview.php. The manipulation of the argument search leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", | ||
"external_references": [ | ||
{ | ||
"source_name": "cve", | ||
"external_id": "CVE-2024-13006" | ||
} | ||
] | ||
} | ||
] | ||
} |
22 changes: 22 additions & 0 deletions
22
objects/vulnerability/vulnerability--026cc885-2a79-4e27-9c79-43aa5ba5e260.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
{ | ||
"type": "bundle", | ||
"id": "bundle--6a64c0c3-63d3-45ea-ba41-be199c6ee115", | ||
"objects": [ | ||
{ | ||
"type": "vulnerability", | ||
"spec_version": "2.1", | ||
"id": "vulnerability--026cc885-2a79-4e27-9c79-43aa5ba5e260", | ||
"created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", | ||
"created": "2024-12-30T00:22:03.491482Z", | ||
"modified": "2024-12-30T00:22:03.491482Z", | ||
"name": "CVE-2024-56636", | ||
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngeneve: do not assume mac header is set in geneve_xmit_skb()\n\nWe should not assume mac header is set in output path.\n\nUse skb_eth_hdr() instead of eth_hdr() to fix the issue.\n\nsysbot reported the following :\n\n WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 skb_mac_header include/linux/skbuff.h:3052 [inline]\n WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 eth_hdr include/linux/if_ether.h:24 [inline]\n WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 geneve_xmit_skb drivers/net/geneve.c:898 [inline]\n WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 geneve_xmit+0x4c38/0x5730 drivers/net/geneve.c:1039\nModules linked in:\nCPU: 0 UID: 0 PID: 11635 Comm: syz.4.1423 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n RIP: 0010:skb_mac_header include/linux/skbuff.h:3052 [inline]\n RIP: 0010:eth_hdr include/linux/if_ether.h:24 [inline]\n RIP: 0010:geneve_xmit_skb drivers/net/geneve.c:898 [inline]\n RIP: 0010:geneve_xmit+0x4c38/0x5730 drivers/net/geneve.c:1039\nCode: 21 c6 02 e9 35 d4 ff ff e8 a5 48 4c fb 90 0f 0b 90 e9 fd f5 ff ff e8 97 48 4c fb 90 0f 0b 90 e9 d8 f5 ff ff e8 89 48 4c fb 90 <0f> 0b 90 e9 41 e4 ff ff e8 7b 48 4c fb 90 0f 0b 90 e9 cd e7 ff ff\nRSP: 0018:ffffc90003b2f870 EFLAGS: 00010283\nRAX: 000000000000037a RBX: 000000000000ffff RCX: ffffc9000dc3d000\nRDX: 0000000000080000 RSI: ffffffff86428417 RDI: 0000000000000003\nRBP: ffffc90003b2f9f0 R08: 0000000000000003 R09: 000000000000ffff\nR10: 000000000000ffff R11: 0000000000000002 R12: ffff88806603c000\nR13: 0000000000000000 R14: ffff8880685b2780 R15: 0000000000000e23\nFS: 00007fdc2deed6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b30a1dff8 CR3: 0000000056b8c000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n __netdev_start_xmit include/linux/netdevice.h:5002 [inline]\n netdev_start_xmit include/linux/netdevice.h:5011 [inline]\n __dev_direct_xmit+0x58a/0x720 net/core/dev.c:4490\n dev_direct_xmit include/linux/netdevice.h:3181 [inline]\n packet_xmit+0x1e4/0x360 net/packet/af_packet.c:285\n packet_snd net/packet/af_packet.c:3146 [inline]\n packet_sendmsg+0x2700/0x5660 net/packet/af_packet.c:3178\n sock_sendmsg_nosec net/socket.c:711 [inline]\n __sock_sendmsg net/socket.c:726 [inline]\n __sys_sendto+0x488/0x4f0 net/socket.c:2197\n __do_sys_sendto net/socket.c:2204 [inline]\n __se_sys_sendto net/socket.c:2200 [inline]\n __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2200\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f", | ||
"external_references": [ | ||
{ | ||
"source_name": "cve", | ||
"external_id": "CVE-2024-56636" | ||
} | ||
] | ||
} | ||
] | ||
} |
22 changes: 22 additions & 0 deletions
22
objects/vulnerability/vulnerability--032bc7e8-033a-4d8c-a5e5-ac0eefcab182.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
{ | ||
"type": "bundle", | ||
"id": "bundle--c170011d-2c39-4d32-b4f1-3ba3ce89727a", | ||
"objects": [ | ||
{ | ||
"type": "vulnerability", | ||
"spec_version": "2.1", | ||
"id": "vulnerability--032bc7e8-033a-4d8c-a5e5-ac0eefcab182", | ||
"created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", | ||
"created": "2024-12-30T00:22:03.47105Z", | ||
"modified": "2024-12-30T00:22:03.47105Z", | ||
"name": "CVE-2024-56559", | ||
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation\n\nWhen compiling kernel source 'make -j $(nproc)' with the up-and-running\nKASAN-enabled kernel on a 256-core machine, the following soft lockup is\nshown:\n\nwatchdog: BUG: soft lockup - CPU#28 stuck for 22s! [kworker/28:1:1760]\nCPU: 28 PID: 1760 Comm: kworker/28:1 Kdump: loaded Not tainted 6.10.0-rc5 #95\nWorkqueue: events drain_vmap_area_work\nRIP: 0010:smp_call_function_many_cond+0x1d8/0xbb0\nCode: 38 c8 7c 08 84 c9 0f 85 49 08 00 00 8b 45 08 a8 01 74 2e 48 89 f1 49 89 f7 48 c1 e9 03 41 83 e7 07 4c 01 e9 41 83 c7 03 f3 90 <0f> b6 01 41 38 c7 7c 08 84 c0 0f 85 d4 06 00 00 8b 45 08 a8 01 75\nRSP: 0018:ffffc9000cb3fb60 EFLAGS: 00000202\nRAX: 0000000000000011 RBX: ffff8883bc4469c0 RCX: ffffed10776e9949\nRDX: 0000000000000002 RSI: ffff8883bb74ca48 RDI: ffffffff8434dc50\nRBP: ffff8883bb74ca40 R08: ffff888103585dc0 R09: ffff8884533a1800\nR10: 0000000000000004 R11: ffffffffffffffff R12: ffffed1077888d39\nR13: dffffc0000000000 R14: ffffed1077888d38 R15: 0000000000000003\nFS: 0000000000000000(0000) GS:ffff8883bc400000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005577b5c8d158 CR3: 0000000004850000 CR4: 0000000000350ef0\nCall Trace:\n <IRQ>\n ? watchdog_timer_fn+0x2cd/0x390\n ? __pfx_watchdog_timer_fn+0x10/0x10\n ? __hrtimer_run_queues+0x300/0x6d0\n ? sched_clock_cpu+0x69/0x4e0\n ? __pfx___hrtimer_run_queues+0x10/0x10\n ? srso_return_thunk+0x5/0x5f\n ? ktime_get_update_offsets_now+0x7f/0x2a0\n ? srso_return_thunk+0x5/0x5f\n ? srso_return_thunk+0x5/0x5f\n ? hrtimer_interrupt+0x2ca/0x760\n ? __sysvec_apic_timer_interrupt+0x8c/0x2b0\n ? sysvec_apic_timer_interrupt+0x6a/0x90\n </IRQ>\n <TASK>\n ? asm_sysvec_apic_timer_interrupt+0x16/0x20\n ? smp_call_function_many_cond+0x1d8/0xbb0\n ? __pfx_do_kernel_range_flush+0x10/0x10\n on_each_cpu_cond_mask+0x20/0x40\n flush_tlb_kernel_range+0x19b/0x250\n ? srso_return_thunk+0x5/0x5f\n ? kasan_release_vmalloc+0xa7/0xc0\n purge_vmap_node+0x357/0x820\n ? __pfx_purge_vmap_node+0x10/0x10\n __purge_vmap_area_lazy+0x5b8/0xa10\n drain_vmap_area_work+0x21/0x30\n process_one_work+0x661/0x10b0\n worker_thread+0x844/0x10e0\n ? srso_return_thunk+0x5/0x5f\n ? __kthread_parkme+0x82/0x140\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2a5/0x370\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x30/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nDebugging Analysis:\n\n 1. The following ftrace log shows that the lockup CPU spends too much\n time iterating vmap_nodes and flushing TLB when purging vm_area\n structures. (Some info is trimmed).\n\n kworker: funcgraph_entry: | drain_vmap_area_work() {\n kworker: funcgraph_entry: | mutex_lock() {\n kworker: funcgraph_entry: 1.092 us | __cond_resched();\n kworker: funcgraph_exit: 3.306 us | }\n ... ...\n kworker: funcgraph_entry: | flush_tlb_kernel_range() {\n ... ...\n kworker: funcgraph_exit: # 7533.649 us | }\n ... ...\n kworker: funcgraph_entry: 2.344 us | mutex_unlock();\n kworker: funcgraph_exit: $ 23871554 us | }\n\n The drain_vmap_area_work() spends over 23 seconds.\n\n There are 2805 flush_tlb_kernel_range() calls in the ftrace log.\n * One is called in __purge_vmap_area_lazy().\n * Others are called by purge_vmap_node->kasan_release_vmalloc.\n purge_vmap_node() iteratively releases kasan vmalloc\n allocations and flushes TLB for each vmap_area.\n - [Rough calculation] Each flush_tlb_kernel_range() runs\n about 7.5ms.\n -- 2804 * 7.5ms = 21.03 seconds.\n -- That's why a soft lock is triggered.\n\n 2. Extending the soft lockup time can work around the issue (For example,\n # echo\n---truncated---", | ||
"external_references": [ | ||
{ | ||
"source_name": "cve", | ||
"external_id": "CVE-2024-56559" | ||
} | ||
] | ||
} | ||
] | ||
} |
22 changes: 22 additions & 0 deletions
22
objects/vulnerability/vulnerability--032fbc4f-d4cf-49a4-b5d3-1658fc62809b.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
{ | ||
"type": "bundle", | ||
"id": "bundle--1ed5c7b5-34ce-4539-af0f-0ee9d2195f8b", | ||
"objects": [ | ||
{ | ||
"type": "vulnerability", | ||
"spec_version": "2.1", | ||
"id": "vulnerability--032fbc4f-d4cf-49a4-b5d3-1658fc62809b", | ||
"created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", | ||
"created": "2024-12-30T00:22:03.440291Z", | ||
"modified": "2024-12-30T00:22:03.440291Z", | ||
"name": "CVE-2024-56596", | ||
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in jfs_readdir\n\nThe stbl might contain some invalid values. Added a check to\nreturn error code in that case.", | ||
"external_references": [ | ||
{ | ||
"source_name": "cve", | ||
"external_id": "CVE-2024-56596" | ||
} | ||
] | ||
} | ||
] | ||
} |
22 changes: 22 additions & 0 deletions
22
objects/vulnerability/vulnerability--03e4bcda-abe3-4cd3-95df-49aa95edc844.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
{ | ||
"type": "bundle", | ||
"id": "bundle--8e3b45e4-a08e-46a2-b43d-64e8966b2dc8", | ||
"objects": [ | ||
{ | ||
"type": "vulnerability", | ||
"spec_version": "2.1", | ||
"id": "vulnerability--03e4bcda-abe3-4cd3-95df-49aa95edc844", | ||
"created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", | ||
"created": "2024-12-30T00:22:03.43415Z", | ||
"modified": "2024-12-30T00:22:03.43415Z", | ||
"name": "CVE-2024-56553", | ||
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix memleak of proc->delivered_freeze\n\nIf a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION\nbefore calling binder_freeze_notification_done(), then it is detached\nfrom its reference (e.g. ref->freeze) but the work remains queued in\nproc->delivered_freeze. This leads to a memory leak when the process\nexits as any pending entries in proc->delivered_freeze are not freed:\n\n unreferenced object 0xffff38e8cfa36180 (size 64):\n comm \"binder-util\", pid 655, jiffies 4294936641\n hex dump (first 32 bytes):\n b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff .....8.......8..\n 0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00 ........<.K.....\n backtrace (crc 95983b32):\n [<000000000d0582cf>] kmemleak_alloc+0x34/0x40\n [<000000009c99a513>] __kmalloc_cache_noprof+0x208/0x280\n [<00000000313b1704>] binder_thread_write+0xdec/0x439c\n [<000000000cbd33bb>] binder_ioctl+0x1b68/0x22cc\n [<000000002bbedeeb>] __arm64_sys_ioctl+0x124/0x190\n [<00000000b439adee>] invoke_syscall+0x6c/0x254\n [<00000000173558fc>] el0_svc_common.constprop.0+0xac/0x230\n [<0000000084f72311>] do_el0_svc+0x40/0x58\n [<000000008b872457>] el0_svc+0x38/0x78\n [<00000000ee778653>] el0t_64_sync_handler+0x120/0x12c\n [<00000000a8ec61bf>] el0t_64_sync+0x190/0x194\n\nThis patch fixes the leak by ensuring that any pending entries in\nproc->delivered_freeze are freed during binder_deferred_release().", | ||
"external_references": [ | ||
{ | ||
"source_name": "cve", | ||
"external_id": "CVE-2024-56553" | ||
} | ||
] | ||
} | ||
] | ||
} |
22 changes: 22 additions & 0 deletions
22
objects/vulnerability/vulnerability--04a3c6ca-80f2-4270-bb4a-7f6ff69e3e3e.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
{ | ||
"type": "bundle", | ||
"id": "bundle--cf47c7b1-94c3-4d35-ab51-2a94f1b95288", | ||
"objects": [ | ||
{ | ||
"type": "vulnerability", | ||
"spec_version": "2.1", | ||
"id": "vulnerability--04a3c6ca-80f2-4270-bb4a-7f6ff69e3e3e", | ||
"created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a", | ||
"created": "2024-12-30T00:22:03.574714Z", | ||
"modified": "2024-12-30T00:22:03.574714Z", | ||
"name": "CVE-2024-56701", | ||
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Fix dtl_access_lock to be a rw_semaphore\n\nThe dtl_access_lock needs to be a rw_sempahore, a sleeping lock, because\nthe code calls kmalloc() while holding it, which can sleep:\n\n # echo 1 > /proc/powerpc/vcpudispatch_stats\n BUG: sleeping function called from invalid context at include/linux/sched/mm.h:337\n in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 199, name: sh\n preempt_count: 1, expected: 0\n 3 locks held by sh/199:\n #0: c00000000a0743f8 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x324/0x438\n #1: c0000000028c7058 (dtl_enable_mutex){+.+.}-{3:3}, at: vcpudispatch_stats_write+0xd4/0x5f4\n #2: c0000000028c70b8 (dtl_access_lock){+.+.}-{2:2}, at: vcpudispatch_stats_write+0x220/0x5f4\n CPU: 0 PID: 199 Comm: sh Not tainted 6.10.0-rc4 #152\n Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries\n Call Trace:\n dump_stack_lvl+0x130/0x148 (unreliable)\n __might_resched+0x174/0x410\n kmem_cache_alloc_noprof+0x340/0x3d0\n alloc_dtl_buffers+0x124/0x1ac\n vcpudispatch_stats_write+0x2a8/0x5f4\n proc_reg_write+0xf4/0x150\n vfs_write+0xfc/0x438\n ksys_write+0x88/0x148\n system_call_exception+0x1c4/0x5a0\n system_call_common+0xf4/0x258", | ||
"external_references": [ | ||
{ | ||
"source_name": "cve", | ||
"external_id": "CVE-2024-56701" | ||
} | ||
] | ||
} | ||
] | ||
} |
Oops, something went wrong.