ICSA-25-226-15: Siemens SINEC OS

CISA's summary

Summary: SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.

Products, as the advisory lists them

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

• CVE-2021-44879 — CVE-2021-44879 · CWE-476

  In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.

• CVE-2022-48655 — CVE-2022-48655 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave. Add an internal consistency check before any such domains descriptors accesses.

• CVE-2022-48772 — CVE-2022-48772 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: media: lgdt3306a: Add a check against null-pointer-def The driver should check whether the client provides the platform_data. The following log reveals it: [ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40 [ 29.610730] Read of size 40 at addr 0000000000000000 by task bash/414 [ 29.612820] Call Trace: [ 29.613030] <TASK> [ 29.613201] dump_stack_lvl+0x56/0x6f [ 29.613496] ? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x52/0x310 [ 29.616339] i2c_device_probe+0x951/0xa90

• CVE-2022-48935 — CVE-2022-48935 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unregister flowtable hooks on netns exit

• CVE-2023-3567 — CVE-2023-3567 · CWE-416

  A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

• CVE-2023-5178 — CVE-2023-5178 · CWE-416

  A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious local privileged user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation problem.

• CVE-2023-5678 — CVE-2023-5678 · CWE-606

  Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

• CVE-2023-5717 — CVE-2023-5717 · CWE-787

  A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

• CVE-2023-6040 — CVE-2023-6040 · CWE-125

  An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.

• CVE-2023-6121 — CVE-2023-6121 · CWE-125

  An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).

• CVE-2023-6606 — CVE-2023-6606 · CWE-125

  An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

• CVE-2023-6931 — CVE-2023-6931 · CWE-787

  A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

• CVE-2023-6932 — CVE-2023-6932 · CWE-416

  A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

• CVE-2023-35827 — CVE-2023-35827 · CWE-416

  An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.

• CVE-2023-39198 — CVE-2023-39198 · CWE-416

  A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.

• CVE-2023-45863 — CVE-2023-45863 · CWE-787

  An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.

• CVE-2023-46343 — CVE-2023-46343 · CWE-476

  In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c.

• CVE-2023-51779 — CVE-2023-51779 · CWE-416

  bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_sock_ioctl race condition.

• CVE-2023-51780 — CVE-2023-51780 · CWE-416

  An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.

• CVE-2023-51781 — CVE-2023-51781 · CWE-416

  An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.

• CVE-2023-51782 — CVE-2023-51782 · CWE-416

  An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.

• CVE-2023-52340 — CVE-2023-52340 · CWE-400

  The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket.

• CVE-2023-52433 — CVE-2023-52433 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

• CVE-2023-52435 — CVE-2023-52435 · CWE-119

  In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in skb_segment()

• CVE-2023-52475 — CVE-2023-52475 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free in powermate_config_complete

• CVE-2023-52477 — CVE-2023-52477 · CWE-476

  In the Linux kernel, the following vulnerability has been resolved: usb: hub: Guard against accesses to uninitialized BOS descriptors

• CVE-2023-52478 — CVE-2023-52478 · CWE-362

  In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect

• CVE-2023-52486 — CVE-2023-52486 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling

• CVE-2023-52502 — CVE-2023-52502 · CWE-362

  In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()

• CVE-2023-52504 — CVE-2023-52504 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Disable KASAN in apply_alternatives()

• CVE-2023-52507 — CVE-2023-52507 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: nfc: nci: assert requested protocol is valid

• CVE-2023-52509 — CVE-2023-52509 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work()

• CVE-2023-52510 — CVE-2023-52510 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: Fix a potential UAF in ca8210_probe

• CVE-2023-52581 — CVE-2023-52581 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired

• CVE-2023-52583 — CVE-2023-52583 · CWE-833

  In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode of misusing dget()

• CVE-2023-52587 — CVE-2023-52587 · CWE-413

  In the Linux kernel, the following vulnerability has been resolved: IB/ipoib: Fix mcast list locking

• CVE-2023-52594 — CVE-2023-52594 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()

• CVE-2023-52595 — CVE-2023-52595 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: restart beacon queue when hardware reset

• CVE-2023-52597 — CVE-2023-52597 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix setting of fpc register

• CVE-2023-52598 — CVE-2023-52598 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: s390/ptrace: handle setting of fpc register correctly

• CVE-2023-52599 — CVE-2023-52599 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in diNewExt

• CVE-2023-52600 — CVE-2023-52600 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: jfs: fix uaf in jfs_evict_inode

• CVE-2023-52601 — CVE-2023-52601 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in dbAdjTree

• CVE-2023-52602 — CVE-2023-52602 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds Read in dtSearch

• CVE-2023-52603 — CVE-2023-52603 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: UBSAN: array-index-out-of-bounds in dtSplitRoot

• CVE-2023-52604 — CVE-2023-52604 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree

• CVE-2023-52606 — CVE-2023-52606 · CWE-121

  In the Linux kernel, the following vulnerability has been resolved: powerpc/lib: Validate size for vector operations

• CVE-2023-52607 — CVE-2023-52607 · CWE-395

  In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: Fix null-pointer dereference in pgtable_cache_add

• CVE-2023-52615 — CVE-2023-52615 · CWE-833

  In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock on mmap-ed hwrng

• CVE-2023-52617 — CVE-2023-52617 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: PCI: switchtec: Fix stdev_release() crash after surprise hot remove

• CVE-2023-52619 — CVE-2023-52619 · CWE-99

  In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when setting number of cpus to an odd number

• CVE-2023-52622 — CVE-2023-52622 · CWE-131

  In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg.

• CVE-2023-52623 — CVE-2023-52623 · CWE-362

  In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a suspicious RCU usage warning

• CVE-2023-52637 — CVE-2023-52637 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)

• CVE-2023-52654 — CVE-2023-52654 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: disable sending io_uring over sockets

• CVE-2023-52655 — CVE-2023-52655 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit

• CVE-2023-52670 — CVE-2023-52670 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: rpmsg: virtio: Free driver_override when rpmsg_remove()

• CVE-2023-52753 — CVE-2023-52753 · CWE-476

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid NULL dereference of timing generator

• CVE-2023-52764 — CVE-2023-52764 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: media: gspca: cpia1: shift-out-of-bounds in set_flicker

• CVE-2023-52774 — CVE-2023-52774 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: s390/dasd: protect device queue against concurrent access

• CVE-2023-52784 — CVE-2023-52784 · CWE-99

  In the Linux kernel, the following vulnerability has been resolved: bonding: stop the device in bond_setup_by_slave()

• CVE-2023-52789 — CVE-2023-52789 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: tty: vcc: Add check for kstrdup() in vcc_probe()

• CVE-2023-52791 — CVE-2023-52791 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: i2c: core: Run atomic i2c xfer when !preemptible

• CVE-2023-52796 — CVE-2023-52796 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_outbound() helper

• CVE-2023-52799 — CVE-2023-52799 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in dbFindLeaf

• CVE-2023-52804 — CVE-2023-52804 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Add validity check for db_maxag and db_agpref

• CVE-2023-52805 — CVE-2023-52805 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in diAlloc

• CVE-2023-52806 — CVE-2023-52806 · CWE-476

  In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix possible null-ptr-deref when assigning a stream

• CVE-2023-52809 — CVE-2023-52809 · CWE-476

  In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()

• CVE-2023-52810 — CVE-2023-52810 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Add check for negative db_l2nbperpage

• CVE-2023-52813 — CVE-2023-52813 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix hungtask for PADATA_RESET

• CVE-2023-52817 — CVE-2023-52817 · CWE-476

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

• CVE-2023-52818 — CVE-2023-52818 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

• CVE-2023-52819 — CVE-2023-52819 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

• CVE-2023-52832 — CVE-2023-52832 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return unset power in ieee80211_get_tx_power()

• CVE-2023-52835 — CVE-2023-52835 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound

• CVE-2023-52836 — CVE-2023-52836 · CWE-99

  In the Linux kernel, the following vulnerability has been resolved: locking/ww_mutex/test: Fix potential workqueue corruption

• CVE-2023-52838 — CVE-2023-52838 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: fbdev: imsttfb: fix a resource leak in probe

• CVE-2023-52840 — CVE-2023-52840 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()

• CVE-2023-52843 — CVE-2023-52843 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: llc: verify mac len before reading mac header

• CVE-2023-52845 — CVE-2023-52845 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING

• CVE-2023-52847 — CVE-2023-52847 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: media: bttv: fix use after free error due to btv->timeout timer

• CVE-2023-52853 — CVE-2023-52853 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: hid: cp2112: Fix duplicate workqueue initialization

• CVE-2023-52855 — CVE-2023-52855 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency

• CVE-2023-52858 — CVE-2023-52858 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data

• CVE-2023-52864 — CVE-2023-52864 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device

• CVE-2023-52865 — CVE-2023-52865 · CWE-476

  In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data

• CVE-2023-52867 — CVE-2023-52867 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: drm/radeon: possible buffer overflow

• CVE-2023-52868 — CVE-2023-52868 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: thermal: core: prevent potential string overflow

• CVE-2023-52871 — CVE-2023-52871 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: soc: qcom: llcc: Handle a second device without data corruption

• CVE-2023-52873 — CVE-2023-52873 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data

• CVE-2023-52875 — CVE-2023-52875 · CWE-476

  In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data

• CVE-2023-52876 — CVE-2023-52876 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data

• CVE-2023-52879 — CVE-2023-52879 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters

• CVE-2023-52881 — CVE-2023-52881 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent

• CVE-2023-52882 — CVE-2023-52882 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) while also doing a lot of frequency switches, we can't observe any instability issues anymore when doing reparenting to stable clock like 24 MHz oscillator.

• CVE-2023-52887 — CVE-2023-52887 · CWE-20

  net: can: j1939: vulnerability related to error handling for closely received RTS messages in xtp_rx_rts_session_new, which is addressed by replacing less informative backtraces with a new method that provides clearer error messages and allows for early termination of problematic sessions.

• CVE-2023-52918 — CVE-2023-52918 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: check cx23885_vdev_init() return cx23885_vdev_init() can return a NULL pointer, but that pointer is used in the next line without a check. Add a NULL pointer check and go to the error unwind if it is NULL.

• CVE-2023-52919 — CVE-2023-52919 · CWE-476

  In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix possible NULL pointer dereference in send_acknowledge()

• CVE-2024-0193 — CVE-2024-0193 · CWE-416

  A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.

• CVE-2024-0584 — CVE-2024-0584 · CWE-416

  A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an igmp query packet, leading to a kernel information leak.

• CVE-2024-0646 — CVE-2024-0646 · CWE-1314

  An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

• CVE-2024-0841 — CVE-2024-0841 · CWE-476

  A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

• CVE-2024-1086 — CVE-2024-1086 · CWE-416

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.

• CVE-2024-2511 — CVE-2024-2511 · CWE-400

  Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

• CVE-2024-4603 — CVE-2024-4603 · CWE-834

  Checking excessively long DSA keys or parameters may be very slow. Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.

• CVE-2024-4741 — CVE-2024-4741 · CWE-416

  Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations

• CVE-2024-5535 — CVE-2024-5535 · CWE-200

  Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists). This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a "no overlap" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem. In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur. This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.

• CVE-2024-6119 — CVE-2024-6119 · CWE-843

  Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an `otherName` subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program. Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address. TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

• CVE-2024-6232 — CVE-2024-6232 · CWE-1333

  There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

• CVE-2024-25741 — CVE-2024-25741 · CWE-703

  printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might allow attackers to cause a denial of service or have unspecified other impact.

• CVE-2024-26581 — CVE-2024-26581 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip end interval element from gc

• CVE-2024-26593 — CVE-2024-26593 · CWE-125

  In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions

• CVE-2024-26598 — CVE-2024-26598 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache

• CVE-2024-26600 — CVE-2024-26600 · CWE-476

  In the Linux kernel, the following vulnerability has been resolved: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP

• CVE-2024-26602 — CVE-2024-26602 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier

• CVE-2024-26606 — CVE-2024-26606 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work

• CVE-2024-26615 — CVE-2024-26615 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: net/smc: fix illegal rmb_desc access in SMC-D connection dump

• CVE-2024-26625 — CVE-2024-26625 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at release time

• CVE-2024-26635 — CVE-2024-26635 · CWE-456

  In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2.

• CVE-2024-26636 — CVE-2024-26636 · CWE-413

  In the Linux kernel, the following vulnerability has been resolved: llc: make llc_ui_sendmsg() more robust against bonding changes

• CVE-2024-26645 — CVE-2024-26645 · CWE-362

  In the Linux kernel, the following vulnerability has been resolved: tracing: Ensure visibility when inserting an element into tracing_map.

• CVE-2024-26663 — CVE-2024-26663 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()

• CVE-2024-26664 — CVE-2024-26664 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Fix out-of-bounds memory access

• CVE-2024-26671 — CVE-2024-26671 · CWE-362

  In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race.

• CVE-2024-26673 — CVE-2024-26673 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations

• CVE-2024-26675 — CVE-2024-26675 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K

• CVE-2024-26679 — CVE-2024-26679 · CWE-413

  In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error()

• CVE-2024-26684 — CVE-2024-26684 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac: fix handling of DPP safety error for DMA channels

• CVE-2024-26685 — CVE-2024-26685 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in end_buffer_async_write

• CVE-2024-26688 — CVE-2024-26688 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super

• CVE-2024-26696 — CVE-2024-26696 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()

• CVE-2024-26697 — CVE-2024-26697 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes

• CVE-2024-26702 — CVE-2024-26702 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC

• CVE-2024-26704 — CVE-2024-26704 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents moved_len

• CVE-2024-26720 — CVE-2024-26720 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again

• CVE-2024-26722 — CVE-2024-26722 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()

• CVE-2024-26735 — CVE-2024-26735 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-after-free and null-ptr-deref

• CVE-2024-26736 — CVE-2024-26736 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: afs: Increase buffer size in afs_update_volume_status()

• CVE-2024-26748 — CVE-2024-26748 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix memory double free when handle zero packet

• CVE-2024-26749 — CVE-2024-26749 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()

• CVE-2024-26751 — CVE-2024-26751 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: ARM: ep93xx: Add terminator to gpiod_lookup_table

• CVE-2024-26752 — CVE-2024-26752 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data

• CVE-2024-26754 — CVE-2024-26754 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()

• CVE-2024-26763 — CVE-2024-26763 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: dm-crypt: don't modify the data when using authenticated encryption

• CVE-2024-26764 — CVE-2024-26764 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio

• CVE-2024-26766 — CVE-2024-26766 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error

• CVE-2024-26772 — CVE-2024-26772 · CWE-413

  In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap.

• CVE-2024-26773 — CVE-2024-26773 · CWE-413

  In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found().

• CVE-2024-26777 — CVE-2024-26777 · CWE-369

  In the Linux kernel, the following vulnerability has been resolved: fbdev: sis: Error out if pixclock equals zero

• CVE-2024-26778 — CVE-2024-26778 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Error out if pixclock equals zero

• CVE-2024-26779 — CVE-2024-26779 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix race condition on enabling fast-xmit

• CVE-2024-26788 — CVE-2024-26788 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: init irq after reg initialization

• CVE-2024-26790 — CVE-2024-26790 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read

• CVE-2024-26791 — CVE-2024-26791 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names

• CVE-2024-26793 — CVE-2024-26793 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_newlink()

• CVE-2024-26801 — CVE-2024-26801 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset

• CVE-2024-26804 — CVE-2024-26804 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth

• CVE-2024-26805 — CVE-2024-26805 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in skb_datagram_iter.

• CVE-2024-26825 — CVE-2024-26825 · CWE-402

  In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free rx_data_reassembly skb on NCI device cleanup

• CVE-2024-26835 — CVE-2024-26835 · CWE-459

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dormant flag on hook register failure

• CVE-2024-26839 — CVE-2024-26839 · CWE-402

  In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix a memleak in init_credit_return

• CVE-2024-26840 — CVE-2024-26840 · CWE-402

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix memory leak in cachefiles_add_cache()

• CVE-2024-26845 — CVE-2024-26845 · CWE-99

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling

• CVE-2024-26900 — CVE-2024-26900 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: md: fix kmemleak of rdev->serial If kobject_add() is fail in bind_rdev_to_array(), 'rdev->serial' will be alloc not be freed, and kmemleak occurs. unreferenced object 0xffff88815a350000 (size 49152): comm "mdadm", pid 789, jiffies 4294716910 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc f773277a): [<0000000058b0a453>] kmemleak_alloc+0x61/0xe0 [<00000000366adf14>] __kmalloc_large_node+0x15e/0x270 [<000000002e82961b>] __kmalloc_node.cold+0x11/0x7f [<00000000f206d60a>] kvmalloc_node+0x74/0x150 [<0000000034bf3363>] rdev_init_serial+0x67/0x170 [<0000000010e08fe9>] mddev_create_serial_pool+0x62/0x220 [<00000000c3837bf0>] bind_rdev_to_array+0x2af/0x630 [<0000000073c28560>] md_add_new_disk+0x400/0x9f0 [<00000000770e30ff>] md_ioctl+0x15bf/0x1c10 [<000000006cfab718>] blkdev_ioctl+0x191/0x3f0 [<0000000085086a11>] vfs_ioctl+0x22/0x60 [<0000000018b656fe>] __x64_sys_ioctl+0xba/0xe0 [<00000000e54e675e>] do_syscall_64+0x71/0x150 [<000000008b0ad622>] entry_SYSCALL_64_after_hwframe+0x6c/0x74

• CVE-2024-26910 — CVE-2024-26910 · CWE-362

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix performance regression in swap operation

• CVE-2024-26923 — CVE-2024-26923 · CWE-362

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect().

• CVE-2024-26924 — CVE-2024-26924 · CWE-476

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 100 ms ... add_elem("0000000X") timeout 100 ms del_elem("0000000X") <---------------- delete one that was just added ... add_elem("00005000") timeout 100 ms 1) nft_pipapo_remove() removes element 0000000X Then, KASAN shows a splat. Looking at the remove function there is a chance that we will drop a rule that maps to a non-deactivated element. Removal happens in two steps, first we do a lookup for key k and return the to-be-removed element and mark it as inactive in the next generation. Then, in a second step, the element gets removed from the set/map. The _remove function does not work correctly if we have more than one element that share the same key. This can happen if we insert an element into a set when the set already holds an element with same key, but the element mapping to the existing key has timed out or is not active in the next generation. In such case its possible that removal will unmap the wrong element. If this happens, we will leak the non-deactivated element, it becomes unreachable. The element that got deactivated (and will be freed later) will remain reachable in the set data structure, this can result in a crash when such an element is retrieved during lookup (stale pointer). Add a check that the fully matching key does in fact map to the element that we have marked as inactive in the deactivation step. If not, we need to continue searching. Add a bug/warn trap at the end of the function as well, the remove function must not ever be called with an invisible/unreachable/non-existent element. v2: avoid uneeded temporary variable (Stefano)

• CVE-2024-26926 — CVE-2024-26926 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: binder: check offset alignment in binder_get_object() Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer(). These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder. It is worth noting this check existed prior to commit 7a67a39320df ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time.

• CVE-2024-26988 — CVE-2024-26988 · CWE-120

  In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow

• CVE-2024-26993 — CVE-2024-26993 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection()

• CVE-2024-26994 — CVE-2024-26994 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: speakup: Avoid crash on very long word In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer.

• CVE-2024-26997 — CVE-2024-26997 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference issue in DDMA completion flow.

• CVE-2024-26999 — CVE-2024-26999 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: serial/pmac_zilog: Remove flawed mitigation for rx irq flood The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a crash anyway if you're using pmac_zilog as a serial console: ttyPZ0: pmz: rx irq flood ! BUG: spinlock recursion on CPU#0, swapper/0 That's because the pr_err() call in pmz_receive_chars() results in pmz_console_write() attempting to lock a spinlock already locked in pmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal BUG splat. The spinlock in question is the one in struct uart_port. Even when it's not fatal, the serial port rx function ceases to work. Also, the iteration limit doesn't play nicely with QEMU, as can be seen in the bug report linked below. A web search for other reports of the error message "pmz: rx irq flood" didn't produce anything. So I don't think this code is needed any more. Remove it.

• CVE-2024-27000 — CVE-2024-27000 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: serial: mxs-auart: add spinlock around changing cts state The uart_handle_cts_change() function in serial_core expects the caller to hold uport->lock. For example, I have seen the below kernel splat, when the Bluetooth driver is loaded on an i.MX28 board. [ 85.119255] ------------[ cut here ]------------ [ 85.124413] WARNING: CPU: 0 PID: 27 at /drivers/tty/serial/serial_core.c:3453 uart_handle_cts_change+0xb4/0xec [ 85.134694] Modules linked in: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs [ 85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 Not tainted 6.6.3-00021-gd62a2f068f92 #1 [ 85.151396] Hardware name: Freescale MXS (Device Tree) [ 85.156679] Workqueue: hci0 hci_power_on [bluetooth] (...) [ 85.191765] uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4 [ 85.198787] mxs_auart_irq_handle from __handle_irq_event_percpu+0x88/0x210 (...)

• CVE-2024-27001 — CVE-2024-27001 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix incomplete endpoint checking While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can have either bulk or interrupt type, and current version of vmk80xx_find_usb_endpoints() function does not take that fully into account. While this warning does not seem to be too harmful, at the very least it will crash systems with 'panic_on_warn' set on them. Fix the issue found by Syzkaller [1] by somewhat simplifying the endpoint checking process with usb_find_common_endpoints() and ensuring that only expected endpoint types are present. This patch has not been tested on real hardware. [1] Syzkaller report: usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x520 drivers/usb/core/message.c:59 vmk80xx_reset_device drivers/comedi/drivers/vmk80xx.c:227 [inline] vmk80xx_auto_attach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818 comedi_auto_config+0x238/0x380 drivers/comedi/drivers.c:1067 usb_probe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399 ... Similar issue also found by Syzkaller:

• CVE-2024-27004 — CVE-2024-27004 · CWE-667

  In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree during disable_unused

• CVE-2024-27013 — CVE-2024-27013 · CWE-770

  In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhost_worker will call tun call backs to receive packets. If too many illegal packets arrives, tun_do_read will keep dumping packet contents. When console is enabled, it will costs much more cpu time to dump packet and soft lockup will be detected. net_ratelimit mechanism can be used to limit the dumping rate.

• CVE-2024-27019 — CVE-2024-27019 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_tables_objects list in __nft_obj_type_get(). Therefore, there is potential data-race of nf_tables_objects list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_objects list in __nft_obj_type_get(), and use rcu_read_lock() in the caller nft_obj_type_get() to protect the entire type query process.

• CVE-2024-27020 — CVE-2024-27020 · CWE-362

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in nft_expr_type_get().

• CVE-2024-27395 — CVE-2024-27395 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.

• CVE-2024-27396 — CVE-2024-27396 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in gtp_dellink Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.

• CVE-2024-27405 — CVE-2024-27405 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs

• CVE-2024-27410 — CVE-2024-27410 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype change with mesh ID change

• CVE-2024-27412 — CVE-2024-27412 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do not free non existing IRQ

• CVE-2024-27413 — CVE-2024-27413 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size

• CVE-2024-27414 — CVE-2024-27414 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back

• CVE-2024-27416 — CVE-2024-27416 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST

• CVE-2024-27417 — CVE-2024-27417 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()

• CVE-2024-31076 — CVE-2024-31076 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of interrupt affinity reconfiguration via procfs. Instead, the change is deferred until the next instance of the interrupt being triggered on the original CPU. When the interrupt next triggers on the original CPU, the new affinity is enforced within __irq_move_irq(). A vector is allocated from the new CPU, but the old vector on the original CPU remains and is not immediately reclaimed. Instead, apicd->move_in_progress is flagged, and the reclaiming process is delayed until the next trigger of the interrupt on the new CPU. Upon the subsequent triggering of the interrupt on the new CPU, irq_complete_move() adds a task to the old CPU's vector_cleanup list if it remains online. Subsequently, the timer on the old CPU iterates over its vector_cleanup list, reclaiming old vectors. However, a rare scenario arises if the old CPU is outgoing before the interrupt triggers again on the new CPU. In that case irq_force_complete_move() is not invoked on the outgoing CPU to reclaim the old apicd->prev_vector because the interrupt isn't currently affine to the outgoing CPU, and irq_needs_fixup() returns false. Even though __vector_schedule_cleanup() is later called on the new CPU, it doesn't reclaim apicd->prev_vector; instead, it simply resets both apicd->move_in_progress and apicd->prev_vector to 0. As a result, the vector remains unreclaimed in vector_matrix, leading to a CPU vector leak. To address this issue, move the invocation of irq_force_complete_move() before the irq_needs_fixup() call to reclaim apicd->prev_vector, if the interrupt is currently or used to be affine to the outgoing CPU. Additionally, reclaim the vector in __vector_schedule_cleanup() as well, following a warning message, although theoretically it should never see apicd->move_in_progress with apicd->prev_cpu pointing to an offline CPU.

• CVE-2024-33621 — CVE-2024-33621 · CWE-1287

  In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v4 / 6_outbound.

• CVE-2024-34397 — CVE-2024-34397 · CWE-20

  An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.

• CVE-2024-35247 — CVE-2024-35247 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: fpga: region: add owner module and take its refcount The current implementation of the fpga region assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach is problematic since it can lead to a null pointer dereference while attempting to get the region during programming if the parent device does not have a driver. To address this problem, add a module owner pointer to the fpga_region struct and use it to take the module's refcount. Modify the functions for registering a region to take an additional owner module parameter and rename them to avoid conflicts. Use the old function names for helper macros that automatically set the module that registers the region as the owner. This ensures compatibility with existing low-level control modules and reduces the chances of registering a region without setting the owner. Also, update the documentation to keep it consistent with the new interface for registering an fpga region.

• CVE-2024-35833 — CVE-2024-35833 · CWE-311

  In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA

• CVE-2024-35835 — CVE-2024-35835 · CWE-415

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfs_create_groups

• CVE-2024-35847 — CVE-2024-35847 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ]

• CVE-2024-35848 — CVE-2024-35848 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: eeprom: at24: fix memory corruption race condition If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device.

• CVE-2024-35852 — CVE-2024-35852 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as supposedly it means that the migration ended. Otherwise, it is rescheduled immediately. After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash" the above is no longer accurate as a non-negative number of credits is no longer indicative of the migration being done. It can also happen if the work encountered an error in which case the migration will resume the next time the work is scheduled. The significance of the above is that it is possible for the work to be pending and associated with hints that were allocated when the migration started. This leads to the hints being leaked [1] when the work is canceled while pending as part of ACL region dismantle. Fix by freeing the hints if hints are associated with a work that was canceled while pending. Blame the original commit since the reliance on not having a pending work associated with hints is fragile. [1] unreferenced object 0xffff88810e7c3000 (size 256): comm "kworker/0:16", pid 176, jiffies 4295460353 hex dump (first 32 bytes): 00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a....... 00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@........... backtrace (crc 2544ddb9): [<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0 [<000000004d9a1ad9>] objagg_hints_get+0x42/0x390 [<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400 [<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160 [<00000000e81fd734>] process_one_work+0x59c/0xf20 [<00000000ceee9e81>] worker_thread+0x799/0x12c0 [<00000000bda6fe39>] kthread+0x246/0x300 [<0000000070056d23>] ret_from_fork+0x34/0x70 [<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30

• CVE-2024-35853 — CVE-2024-35853 · CWE-20

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash The rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters. If the migration fails, the code tries to migrate the filters back to the old region. However, the rollback itself can also fail in which case another migration will be erroneously performed. Besides the fact that this ping pong is not a very good idea, it also creates a problem. Each virtual chunk references two chunks: The currently used one ('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the first holds the chunk we want to migrate filters to and the second holds the chunk we are migrating filters from. The code currently assumes - but does not verify - that the backup chunk does not exist (NULL) if the currently used chunk does not reference the target region. This assumption breaks when we are trying to rollback a rollback, resulting in the backup chunk being overwritten and leaked [1]. Fix by not rolling back a failed rollback and add a warning to avoid future cases. [1] WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20 Modules linked in: CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:parman_destroy+0x17/0x20 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_region_fini+0x19/0x60 mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>

• CVE-2024-35854 — CVE-2024-35854 · CWE-416

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash The rehash delayed work migrates filters from one region to another according to the number of available credits. The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption is that this is indicative of migration being complete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration. The destruction of a region that still has filters referencing it can result in a use-after-free [1]. Fix by not destroying the region if migration failed. [1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858 CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30

Acknowledgments, as the advisory lists them

• Siemens ProductCERT: reported these vulnerabilities to CISA.

The advisory's legal notice

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Sources

• The advisory at cisa.gov
• The CSAF document (JSON)

DeSpy's copy of this version is dated 2026-09-28.