[Git][security-tracker-team/security-tracker][master] Merge Linux CVEs from kernel-sec

Sat Aug 17 10:54:31 BST 2024


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7001bde3 by Salvatore Bonaccorso at 2024-08-17T11:53:47+02:00
Merge Linux CVEs from kernel-sec

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,172 @@
+CVE-2024-43860 [remoteproc: imx_rproc: Skip over memory region when node value is NULL]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/2fa26ca8b786888673689ccc9da6094150939982 (6.11-rc1)
+CVE-2024-43859 [f2fs: fix to truncate preallocated blocks in f2fs_file_open()]
+	- linux 6.10.3-1
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/298b1e4182d657c3e388adcc29477904e9600ed5 (6.11-rc1)
+CVE-2024-43858 [jfs: Fix array-index-out-of-bounds in diFree]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/f73f969b2eb39ad8056f6c7f3a295fa2f85e313a (6.11-rc1)
+CVE-2024-43857 [f2fs: fix null reference error when checking end of zone]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/c82bc1ab2a8a5e73d9728e80c4c2ed87e8921a38 (6.11-rc1)
+CVE-2024-43856 [dma: fix call order in dmam_free_coherent]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/28e8b7406d3a1f5329a03aa25a43aa28e087cb20 (6.11-rc1)
+CVE-2024-43855 [md: fix deadlock between mddev_suspend and flush bio]
+	- linux 6.10.3-1
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/611d5cbc0b35a752e657a83eebadf40d814d006b (6.11-rc1)
+CVE-2024-43854 [block: initialize integrity buffer to zero before writing it to media]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/899ee2c3829c5ac14bfc7d3c4a5846c0b709b78f (6.11-rc1)
+CVE-2024-43853 [cgroup/cpuset: Prevent UAF in proc_cpuset_show()]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/1be59c97c83ccd67a519d8a49486b3a8a73ca28a (6.11-rc1)
+CVE-2024-43852 [hwmon: (ltc2991) re-order conditions to fix off by one bug]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/99bf7c2eccff82760fa23ce967cc67c8c219c6a6 (6.11-rc1)
+CVE-2024-43851 [soc: xilinx: rename cpu_number1 to dummy_cpu_number]
+	- linux 6.10.3-1
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/4a95449dd975e2ea6629a034f3e74b46c9634916 (6.11-rc1)
+CVE-2024-43850 [soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove]
+	- linux 6.10.3-1
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/24086640ab39396eb1a92d1cb1cd2f31b2677c52 (6.11-rc1)
+CVE-2024-43849 [soc: qcom: pdr: protect locator_addr with the main mutex]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/107924c14e3ddd85119ca43c26a4ee1056fa9b84 (6.11-rc1)
+CVE-2024-43848 [wifi: mac80211: fix TTLM teardown work]
+	- linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/2fe0a605d083b884490ee4de02be071b5b4291b1 (6.11-rc1)
+CVE-2024-43847 [wifi: ath12k: fix invalid memory access while processing fragmented packets]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/073f9f249eecd64ab9d59c91c4a23cfdcc02afe4 (6.11-rc1)
+CVE-2024-43846 [lib: objagg: Fix general protection fault]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/b4a3a89fffcdf09702b1f161b914e52abca1894d (6.11-rc1)
+CVE-2024-43845 [udf: Fix bogus checksum computation in udf_rename()]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/27ab33854873e6fb958cb074681a0107cc2ecc4c (6.11-rc1)
+CVE-2024-43844 [wifi: rtw89: wow: fix GTK offload H2C skbuff issue]
+	- linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/dda364c345913fe03ddbe4d5ae14a2754c100296 (6.11-rc1)
+CVE-2024-43843 [riscv, bpf: Fix out-of-bounds issue when preparing trampoline image]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/9f1e16fb1fc9826001c69e0551d51fbbcd2d74e9 (6.11-rc1)
+CVE-2024-43842 [wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()]
+	- linux 6.10.3-1
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/85099c7ce4f9e64c66aa397cd9a37473637ab891 (6.11-rc1)
+CVE-2024-43841 [wifi: virt_wifi: avoid reporting connection success with wrong SSID]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/b5d14b0c6716fad7f0c94ac6e1d6f60a49f985c7 (6.11-rc1)
+CVE-2024-43840 [bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG]
+	- linux 6.10.3-1
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/19d3c179a37730caf600a97fed3794feac2b197b (6.11-rc1)
+CVE-2024-43839 [bna: adjust 'name' buf size of bna_tcb and bna_ccb structures]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/c9741a03dc8e491e57b95fba0058ab46b7e506da (6.11-rc1)
+CVE-2024-43838 [bpf: fix overflow check in adjust_jmp_off()]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/4a04b4f0de59dd5c621e78f15803ee0b0544eeb8 (6.11-rc1)
+CVE-2024-43837 [bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT]
+	- linux 6.10.3-1
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/f7866c35873377313ff94398f17d425b28b71de1 (6.11-rc1)
+CVE-2024-43836 [net: ethtool: pse-pd: Fix possible null-deref]
+	- linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/4cddb0f15ea9c62f81b4889ea69a99368cc63a86 (6.11-rc1)
+CVE-2024-43835 [virtio_net: Fix napi_skb_cache_put warning]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/f8321fa75102246d7415a6af441872f6637c93ab (6.11-rc1)
+CVE-2024-43834 [xdp: fix invalid wait context of page_pool_destroy()]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/59a931c5b732ca5fc2ca727f5a72aeabaafa85ec (6.11-rc1)
+CVE-2024-43833 [media: v4l: async: Fix NULL pointer dereference in adding ancillary links]
+	- linux 6.10.3-1
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/9b4667ea67854f0b116fe22ad11ef5628c5b5b5f (6.11-rc1)
+CVE-2024-43832 [s390/uv: Don't call folio_wait_writeback() without a folio reference]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/3f29f6537f54d74e64bac0a390fb2e26da25800d (6.11-rc1)
+CVE-2024-43831 [media: mediatek: vcodec: Handle invalid decoder vsi]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/59d438f8e02ca641c58d77e1feffa000ff809e9f (6.11-rc1)
+CVE-2024-43830 [leds: trigger: Unregister sysfs attributes before calling deactivate()]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/c0dc9adf9474ecb7106e60e5472577375aedaed3 (6.11-rc1)
+CVE-2024-43829 [drm/qxl: Add check for drm_cvt_mode]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/7bd09a2db0f617377027a2bb0b9179e6959edff3 (6.11-rc1)
+CVE-2024-43828 [ext4: fix infinite loop when replaying fast_commit]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/907c3fe532253a6ef4eb9c4d67efb71fab58c706 (6.11-rc1)
+CVE-2024-43827 [drm/amd/display: Add null check before access structs]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/c96140000915b610d86f941450e15ca552de154a (6.11-rc1)
+CVE-2024-43826 [nfs: pass explicit offset/count to trace events]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/fada32ed6dbc748f447c8d050a961b75d946055a (6.11-rc1)
+CVE-2024-43825 [iio: Fix the sorting functionality in iio_gts_build_avail_time_table]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/5acc3f971a01be48d5ff4252d8f9cdb87998cdfb (6.11-rc1)
+CVE-2024-43824 [PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/5a5095a8bd1bd349cce1c879e5e44407a34dda8a (6.11-rc1)
+CVE-2024-43823 [PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/a231707a91f323af1e5d9f1722055ec2fc1c7775 (6.11-rc1)
+CVE-2024-43822 [ASoc: PCM6240: Return directly after a failed devm_kzalloc() in pcmdevice_i2c_probe()]
+	- linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/3722873d49a1788d5420894d4f6f63e35f5c1f13 (6.11-rc1)
+CVE-2024-43821 [scsi: lpfc: Fix a possible null pointer dereference]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/5e0bf3e8aec2cbc51123f84b29aaacbd91fc56fa (6.11-rc1)
+CVE-2024-43820 [dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume]
+	- linux 6.10.3-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/3199a34bfaf7561410e0be1e33a61eba870768fc (6.11-rc1)
+CVE-2024-43819 [kvm: s390: Reject memory region operations for ucontrol VMs]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/7816e58967d0e6cadce05c8540b47ed027dc2499 (6.11-rc1)
+CVE-2024-43818 [ASoC: amd: Adjust error handling in case of absent codec device]
+	- linux 6.10.3-1
+	[bullseye] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/5080808c3339de2220c602ab7c7fa23dc6c1a5a3 (6.11-rc1)
+CVE-2024-43817 [net: missing check virtio]
+	- linux 6.10.3-1
+	NOTE: https://git.kernel.org/linus/e269d79c7d35aa3808b1f3c1737d63dab504ddc8 (6.11-rc1)
+CVE-2024-43816 [scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages]
+	- linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/8bc7c617642db6d8d20ee671fb6c4513017e7a7e (6.11-rc1)
+CVE-2024-43815 [crypto: mxs-dcp - Ensure payload is zero when using key slot]
+	- linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/dd52b5eeb0f70893f762da7254e923fd23fd1379 (6.11-rc1)
 CVE-2024-42322 [ipvs: properly dereference pe in ip_vs_add_service]
 	- linux 6.10.3-1
 	NOTE: https://git.kernel.org/linus/cbd070a4ae62f119058973f6d2c984e325bce6e7 (6.11-rc1)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7001bde384f3925726f45099cd4c874687b8dab2

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7001bde384f3925726f45099cd4c874687b8dab2
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240817/f707252d/attachment.htm>
