Vulnerabilities

An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network.<br /> <br /> We have already fixed the vulnerability in the following version:<br /> QTS 5.1.7.2770 build 20240520 and later<br /> QuTS hero h5.1.7.2770 build 20240520 and later

A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute arbitrary code via a network.<br /> <br /> We have already fixed the vulnerability in the following version:<br /> QTS 5.1.7.2770 build 20240520 and later<br /> QuTS hero h5.1.7.2770 build 20240520 and later

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process<br /> <br /> When tearing down a &amp;#39;hisi_hns3&amp;#39; PMU, we mistakenly run the CPU hotplug<br /> callbacks after the device has been unregistered, leading to fireworks<br /> when we try to execute empty function callbacks within the driver:<br /> <br /> | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000<br /> | CPU: 0 PID: 15 Comm: cpuhp/0 Tainted: G W O 5.12.0-rc4+ #1<br /> | Hardware name: , BIOS KpxxxFPGA 1P B600 V143 04/22/2021<br /> | pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)<br /> | pc : perf_pmu_migrate_context+0x98/0x38c<br /> | lr : perf_pmu_migrate_context+0x94/0x38c<br /> |<br /> | Call trace:<br /> | perf_pmu_migrate_context+0x98/0x38c<br /> | hisi_hns3_pmu_offline_cpu+0x104/0x12c [hisi_hns3_pmu]<br /> <br /> Use cpuhp_state_remove_instance_nocalls() instead of<br /> cpuhp_state_remove_instance() so that the notifiers don&amp;#39;t execute after<br /> the PMU device has been unregistered.<br /> <br /> [will: Rewrote commit message]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm: bridge: it66121: Fix invalid connector dereference<br /> <br /> Fix the NULL pointer dereference when no monitor is connected, and the<br /> sound card is opened from userspace.<br /> <br /> Instead return an empty buffer (of zeroes) as the EDID information to<br /> the sound framework if there is no connector attached.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Fix null pointer dereference in error message<br /> <br /> This patch fixes a null pointer dereference in the error message that is<br /> printed when the Display Core (DC) fails to initialize. The original<br /> message includes the DC version number, which is undefined if the DC is<br /> not initialized.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hwmon: (axi-fan-control) Fix possible NULL pointer dereference<br /> <br /> axi_fan_control_irq_handler(), dependent on the private<br /> axi_fan_control_data structure, might be called before the hwmon<br /> device is registered. That will cause an "Unable to handle kernel<br /> NULL pointer dereference" error.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> platform/x86: wmi: Fix opening of char device<br /> <br /> Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via<br /> file private data"), the miscdevice stores a pointer to itself inside<br /> filp-&gt;private_data, which means that private_data will not be NULL when<br /> wmi_char_open() is called. This might cause memory corruption should<br /> wmi_char_open() be unable to find its driver, something which can<br /> happen when the associated WMI device is deleted in wmi_free_devices().<br /> <br /> Fix the problem by using the miscdevice pointer to retrieve the WMI<br /> device data associated with a char device using container_of(). This<br /> also avoids wmi_char_open() picking a wrong WMI device bound to a<br /> driver with the same name as the original driver.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data<br /> <br /> Add the check for the return value of mtk_alloc_clk_data() in order to<br /> avoid NULL pointer dereference.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> HID: uclogic: Fix user-memory-access bug in uclogic_params_ugee_v2_init_event_hooks()<br /> <br /> When CONFIG_HID_UCLOGIC=y and CONFIG_KUNIT_ALL_TESTS=y, launch kernel and<br /> then the below user-memory-access bug occurs.<br /> <br /> In hid_test_uclogic_params_cleanup_event_hooks(),it call<br /> uclogic_params_ugee_v2_init_event_hooks() with the first arg=NULL, so<br /> when it calls uclogic_params_ugee_v2_has_battery(), the hid_get_drvdata()<br /> will access hdev-&gt;dev with hdev=NULL, which will cause below<br /> user-memory-access.<br /> <br /> So add a fake_device with quirks member and call hid_set_drvdata()<br /> to assign hdev-&gt;dev-&gt;driver_data which avoids the null-ptr-def bug<br /> for drvdata-&gt;quirks in uclogic_params_ugee_v2_has_battery(). After applying<br /> this patch, the below user-memory-access bug never occurs.<br /> <br /> general protection fault, probably for non-canonical address 0xdffffc0000000329: 0000 [#1] PREEMPT SMP KASAN<br /> KASAN: probably user-memory-access in range [0x0000000000001948-0x000000000000194f]<br /> CPU: 5 PID: 2189 Comm: kunit_try_catch Tainted: G B W N 6.6.0-rc2+ #30<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014<br /> RIP: 0010:uclogic_params_ugee_v2_init_event_hooks+0x87/0x600<br /> Code: f3 f3 65 48 8b 14 25 28 00 00 00 48 89 54 24 60 31 d2 48 89 fa c7 44 24 30 00 00 00 00 48 c7 44 24 28 02 f8 02 01 48 c1 ea 03 3c 02 00 0f 85 2c 04 00 00 48 8b 9d 48 19 00 00 48 b8 00 00 00<br /> RSP: 0000:ffff88810679fc88 EFLAGS: 00010202<br /> RAX: dffffc0000000000 RBX: 0000000000000004 RCX: 0000000000000000<br /> RDX: 0000000000000329 RSI: ffff88810679fd88 RDI: 0000000000001948<br /> RBP: 0000000000000000 R08: 0000000000000000 R09: ffffed1020f639f0<br /> R10: ffff888107b1cf87 R11: 0000000000000400 R12: 1ffff11020cf3f92<br /> R13: ffff88810679fd88 R14: ffff888100b97b08 R15: ffff8881030bb080<br /> FS: 0000000000000000(0000) GS:ffff888119e80000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000000 CR3: 0000000005286001 CR4: 0000000000770ee0<br /> DR0: ffffffff8fdd6cf4 DR1: ffffffff8fdd6cf5 DR2: ffffffff8fdd6cf6<br /> DR3: ffffffff8fdd6cf7 DR6: 00000000fffe0ff0 DR7: 0000000000000600<br /> PKRU: 55555554<br /> Call Trace:<br /> <br /> ? die_addr+0x3d/0xa0<br /> ? exc_general_protection+0x144/0x220<br /> ? asm_exc_general_protection+0x22/0x30<br /> ? uclogic_params_ugee_v2_init_event_hooks+0x87/0x600<br /> ? sched_clock_cpu+0x69/0x550<br /> ? uclogic_parse_ugee_v2_desc_gen_params+0x70/0x70<br /> ? load_balance+0x2950/0x2950<br /> ? rcu_trc_cmpxchg_need_qs+0x67/0xa0<br /> hid_test_uclogic_params_cleanup_event_hooks+0x9e/0x1a0<br /> ? uclogic_params_ugee_v2_init_event_hooks+0x600/0x600<br /> ? __switch_to+0x5cf/0xe60<br /> ? migrate_enable+0x260/0x260<br /> ? __kthread_parkme+0x83/0x150<br /> ? kunit_try_run_case_cleanup+0xe0/0xe0<br /> kunit_generic_run_threadfn_adapter+0x4a/0x90<br /> ? kunit_try_catch_throw+0x80/0x80<br /> kthread+0x2b5/0x380<br /> ? kthread_complete_and_exit+0x20/0x20<br /> ret_from_fork+0x2d/0x70<br /> ? kthread_complete_and_exit+0x20/0x20<br /> ret_from_fork_asm+0x11/0x20<br /> <br /> Modules linked in:<br /> Dumping ftrace buffer:<br /> (ftrace buffer empty)<br /> ---[ end trace 0000000000000000 ]---<br /> RIP: 0010:uclogic_params_ugee_v2_init_event_hooks+0x87/0x600<br /> Code: f3 f3 65 48 8b 14 25 28 00 00 00 48 89 54 24 60 31 d2 48 89 fa c7 44 24 30 00 00 00 00 48 c7 44 24 28 02 f8 02 01 48 c1 ea 03 3c 02 00 0f 85 2c 04 00 00 48 8b 9d 48 19 00 00 48 b8 00 00 00<br /> RSP: 0000:ffff88810679fc88 EFLAGS: 00010202<br /> RAX: dffffc0000000000 RBX: 0000000000000004 RCX: 0000000000000000<br /> RDX: 0000000000000329 RSI: ffff88810679fd88 RDI: 0000000000001948<br /> RBP: 0000000000000000 R08: 0000000000000000 R09: ffffed1020f639f0<br /> R10: ffff888107b1cf87 R11: 0000000000000400 R12: 1ffff11020cf3f92<br /> R13: ffff88810679fd88 R14: ffff888100b97b08 R15: ffff8881030bb080<br /> FS: 0000000000000000(0000) GS:ffff888119e80000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000000 CR3: 0000000005286001 CR4: 0000000000770ee0<br /> DR0: ffffffff8fdd6cf4 DR1: <br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/radeon: possible buffer overflow<br /> <br /> Buffer &amp;#39;afmt_status&amp;#39; of size 6 could overflow, since index &amp;#39;afmt_idx&amp;#39; is<br /> checked after access.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> thermal: core: prevent potential string overflow<br /> <br /> The dev-&gt;id value comes from ida_alloc() so it&amp;#39;s a number between zero<br /> and INT_MAX. If it&amp;#39;s too high then these sprintf()s will overflow.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> pstore/platform: Add check for kstrdup<br /> <br /> Add check for the return value of kstrdup() and return the error<br /> if it fails in order to avoid NULL pointer dereference.