Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path<br /> <br /> Dan Carpenter reported a Smack static checker warning:<br /> fs/smb/client/cifsfs.c:1981 init_cifs()<br /> error: we previously assumed &amp;#39;serverclose_wq&amp;#39; could be null (see line 1895)<br /> <br /> The patch which introduced the serverclose workqueue used the wrong<br /> oredering in error paths in init_cifs() for freeing it on errors.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes<br /> <br /> In psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is<br /> assigned to mode, which will lead to a possible NULL pointer dereference<br /> on failure of drm_mode_duplicate(). Add a check to avoid npd.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ice: Add a per-VF limit on number of FDIR filters<br /> <br /> While the iavf driver adds a s/w limit (128) on the number of FDIR<br /> filters that the VF can request, a malicious VF driver can request more<br /> than that and exhaust the resources for other VFs.<br /> <br /> Add a similar limit in ice.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Fix a segment issue when downgrading gso_size<br /> <br /> Linearize the skb when downgrading gso_size because it may trigger a<br /> BUG_ON() later when the skb is segmented as described in [1,2].

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling<br /> <br /> Move the freeing of the dummy net_device from mtk_free_dev() to<br /> mtk_remove().<br /> <br /> Previously, if alloc_netdev_dummy() failed in mtk_probe(),<br /> eth-&gt;dummy_dev would be NULL. The error path would then call<br /> mtk_free_dev(), which in turn called free_netdev() assuming dummy_dev<br /> was allocated (but it was not), potentially causing a NULL pointer<br /> dereference.<br /> <br /> By moving free_netdev() to mtk_remove(), we ensure it&amp;#39;s only called when<br /> mtk_probe() has succeeded and dummy_dev is fully allocated. This<br /> addresses a potential NULL pointer dereference detected by Smatch[1].

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: nexthop: Initialize all fields in dumped nexthops<br /> <br /> struct nexthop_grp contains two reserved fields that are not initialized by<br /> nla_put_nh_group(), and carry garbage. This can be observed e.g. with<br /> strace (edited for clarity):<br /> <br /> # ip nexthop add id 1 dev lo<br /> # ip nexthop add id 101 group 1<br /> # strace -e recvmsg ip nexthop get id 101<br /> ...<br /> recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},<br /> [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52<br /> <br /> The fields are reserved and therefore not currently used. But as they are, they<br /> leak kernel memory, and the fact they are not just zero complicates repurposing<br /> of the fields for new ends. Initialize the full structure.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tipc: Return non-zero value from tipc_udp_addr2str() on error<br /> <br /> tipc_udp_addr2str() should return non-zero value if the UDP media<br /> address is invalid. Otherwise, a buffer overflow access can occur in<br /> tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP<br /> media address.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/iwcm: Fix a use-after-free related to destroying CM IDs<br /> <br /> iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with<br /> an existing struct iw_cm_id (cm_id) as follows:<br /> <br /> conn_id-&gt;cm_id.iw = cm_id;<br /> cm_id-&gt;context = conn_id;<br /> cm_id-&gt;cm_handler = cma_iw_handler;<br /> <br /> rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make<br /> sure that cm_work_handler() does not trigger a use-after-free by only<br /> freeing of the struct rdma_id_private after all pending work has finished.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: qla2xxx: validate nvme_local_port correctly<br /> <br /> The driver load failed with error message,<br /> <br /> qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef<br /> <br /> and with a kernel crash,<br /> <br /> BUG: unable to handle kernel NULL pointer dereference at 0000000000000070<br /> Workqueue: events_unbound qla_register_fcport_fn [qla2xxx]<br /> RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc]<br /> RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282<br /> RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000<br /> RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000<br /> RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030<br /> R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4<br /> R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8<br /> FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0<br /> Call Trace:<br /> qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx]<br /> ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx]<br /> qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx]<br /> qla_register_fcport_fn+0x54/0xc0 [qla2xxx]<br /> <br /> Exit the qla_nvme_register_remote() function when qla_nvme_register_hba()<br /> fails and correctly validate nvme_local_port.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: qla2xxx: Complete command early within lock<br /> <br /> A crash was observed while performing NPIV and FW reset,<br /> <br /> BUG: kernel NULL pointer dereference, address: 000000000000001c<br /> #PF: supervisor read access in kernel mode<br /> #PF: error_code(0x0000) - not-present page<br /> PGD 0 P4D 0<br /> Oops: 0000 1 PREEMPT_RT SMP NOPTI<br /> RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0<br /> RSP: 0018:ffffc90026f47b88 EFLAGS: 00010246<br /> RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000002<br /> RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8881041130d0<br /> RBP: ffff8881041130d0 R08: 0000000000000000 R09: 0000000000000034<br /> R10: ffffc90026f47c48 R11: 0000000000000031 R12: 0000000000000000<br /> R13: 0000000000000000 R14: ffff8881565e4a20 R15: 0000000000000000<br /> FS: 00007f4c69ed3d00(0000) GS:ffff889faac80000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 000000000000001c CR3: 0000000288a50002 CR4: 00000000007706e0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> PKRU: 55555554<br /> Call Trace:<br /> <br /> ? __die_body+0x1a/0x60<br /> ? page_fault_oops+0x16f/0x4a0<br /> ? do_user_addr_fault+0x174/0x7f0<br /> ? exc_page_fault+0x69/0x1a0<br /> ? asm_exc_page_fault+0x22/0x30<br /> ? dma_direct_unmap_sg+0x51/0x1e0<br /> ? preempt_count_sub+0x96/0xe0<br /> qla2xxx_qpair_sp_free_dma+0x29f/0x3b0 [qla2xxx]<br /> qla2xxx_qpair_sp_compl+0x60/0x80 [qla2xxx]<br /> __qla2x00_abort_all_cmds+0xa2/0x450 [qla2xxx]<br /> <br /> The command completion was done early while aborting the commands in driver<br /> unload path but outside lock to avoid the WARN_ON condition of performing<br /> dma_free_attr within the lock. However this caused race condition while<br /> command completion via multiple paths causing system crash.<br /> <br /> Hence complete the command early in unload path but within the lock to<br /> avoid race condition.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: qla2xxx: Fix for possible memory corruption<br /> <br /> Init Control Block is dereferenced incorrectly. Correctly dereference ICB