admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-06-21 17:41:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2024-05-05T02:00:30.239490+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2024-05-05 02:03:23 +00:00
parent 49558e0815
commit b670914091
771 changed files with 4051 additions and 806 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CVE-2019/CVE-2019-197xx/CVE-2019-19751.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "easyMINE before 2019-12-05 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io."
},
{
"lang": "es",
"value": "easyMINE antes del 5 de diciembre de 2019 se env\u00eda con claves de host SSH integradas en la imagen de instalaci\u00f3n, lo que permite ataques de intermediario y hace que la identificaci\u00f3n de todos los nodos IPv4 p\u00fablicos sea trivial con Shodan.io."
}
],
"metrics": {},

4
CVE-2019/CVE-2019-197xx/CVE-2019-19752.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plans to fix this in the next image build."
},
{
"lang": "es",
"value": "nvOC hasta 3.2 se entrega con claves de host SSH incorporadas en la imagen de instalaci\u00f3n, lo que permite ataques de intermediario y hace que la identificaci\u00f3n de todos los nodos IPv4 p\u00fablicos sea trivial con Shodan.io. NOTA: a partir del 1 de diciembre de 2019, el proveedor indic\u00f3 planes para solucionar este problema en la siguiente compilaci\u00f3n de imagen."
}
],
"metrics": {},

4
CVE-2019/CVE-2019-197xx/CVE-2019-19753.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: the vendor indicated that they have no plans to fix this, and discourage deployment using public IPv4."
},
{
"lang": "es",
"value": "SimpleMiningOS hasta v1259 se entrega con claves de host SSH integradas en la imagen de instalaci\u00f3n, lo que permite ataques de intermediario y hace que la identificaci\u00f3n de todos los nodos IPv4 p\u00fablicos sea trivial con Shodan.io. NOTA: el proveedor indic\u00f3 que no tiene planes de solucionar este problema y desaconseja la implementaci\u00f3n mediante IPv4 p\u00fablico."
}
],
"metrics": {},

4
CVE-2019/CVE-2019-197xx/CVE-2019-19754.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-09-26, the vendor indicated that they would consider fixing this."
},
{
"lang": "es",
"value": "HiveOS hasta 0.6-102@191212 se entrega con claves de host SSH integradas en la imagen de instalaci\u00f3n, lo que permite ataques de intermediario y hace que la identificaci\u00f3n de todos los nodos IPv4 p\u00fablicos sea trivial con Shodan.io. NOTA: a partir del 26 de septiembre de 2019, el proveedor indic\u00f3 que considerar\u00eda solucionar este problema."
}
],
"metrics": {},

4
CVE-2019/CVE-2019-197xx/CVE-2019-19755.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "ethOS through 1.3.3 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated that they plan to fix this."
},
{
"lang": "es",
"value": "ethOS hasta 1.3.3 se entrega con claves de host SSH incorporadas en la imagen de instalaci\u00f3n, lo que permite ataques de intermediario y hace que la identificaci\u00f3n de todos los nodos IPv4 p\u00fablicos sea trivial con Shodan.io. NOTA: a partir del 1 de diciembre de 2019, el proveedor indic\u00f3 que planea solucionar este problema."
}
],
"metrics": {},

4
CVE-2020/CVE-2020-274xx/CVE-2020-27478.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Cross Site Scripting vulnerability found in Simplcommerce v.40734964b0811f3cbaf64b6dac261683d256f961 thru 3103357200c70b4767986544e01b19dbf11505a7 allows a remote attacker to execute arbitrary code via a crafted script to the search bar feature."
},
{
"lang": "es",
"value": "Vulnerabilidad de cross-site scripting encontrada en Simplcommerce v.40734964b0811f3cbaf64b6dac261683d256f961 hasta 3103357200c70b4767986544e01b19dbf11505a7 permite a un atacante remoto ejecutar c\u00f3digo arbitrario a trav\u00e9s de un script manipulado en la funci\u00f3n de la barra de b\u00fasqueda."
}
],
"metrics": {},

4
CVE-2020/CVE-2020-52xx/CVE-2020-5200.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io."
},
{
"lang": "es",
"value": "Minerbabe hasta V4.16 se entrega con claves de host SSH integradas en la imagen de instalaci\u00f3n, lo que permite ataques de intermediario y hace que la identificaci\u00f3n de todos los nodos IPv4 p\u00fablicos sea trivial con Shodan.io."
}
],
"metrics": {},

4
CVE-2021/CVE-2021-286xx/CVE-2021-28656.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions."
},
{
"lang": "es",
"value": "La vulnerabilidad de Cross-Site Request Forgery (CSRF) en la p\u00e1gina de credenciales de Apache Zeppelin permite a un atacante enviar solicitudes maliciosas. Este problema afecta a Apache Zeppelin Apache Zeppelin versi\u00f3n 0.9.0 y versiones anteriores."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-383xx/CVE-2022-38386.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite for Software 1.10.12.0 through 1.10.19.0 does not set the SameSite attribute for sensitive cookies which could allow an attacker to obtain sensitive information using man-in-the-middle techniques. IBM X-Force ID: 233778."
},
{
"lang": "es",
"value": "IBM Cloud Pak for Security (CP4S) 1.10.0.0 a 1.10.11.0 e IBM QRadar Suite for Software 1.10.12.0 a 1.10.19.0 no configuran el atributo SameSite para cookies confidenciales que podr\u00edan permitir a un atacante obtener informaci\u00f3n confidencial mediante t\u00e9cnicas man-in-the-middle. ID de IBM X-Force: 233778."
}
],
"metrics": {

4
CVE-2022/CVE-2022-478xx/CVE-2022-47894.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nFor more information, the fix already was merged in the source code but Zeppelin decided to retire the SAP component\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\n"
},
{
"lang": "es",
"value": "Vulnerabilidad de validaci\u00f3n de entrada incorrecta en Apache Zeppelin SAP. Este problema afecta a Apache Zeppelin SAP: desde 0.8.0 antes de 0.11.0. Como este proyecto est\u00e1 retirado, no planeamos lanzar una versi\u00f3n que solucione este problema. Se recomienda a los usuarios que busquen una alternativa o restrinjan el acceso a la instancia a usuarios confiables. Para obtener m\u00e1s informaci\u00f3n, la soluci\u00f3n ya se fusion\u00f3 en el c\u00f3digo fuente, pero Zeppelin decidi\u00f3 retirar el componente SAP. NOTA: Esta vulnerabilidad solo afecta a los productos que ya no son compatibles con el fabricante."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48611.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges."
},
{
"lang": "es",
"value": "Se solucion\u00f3 un problema de l\u00f3gica con controles mejorados. Este problema se solucion\u00f3 en iTunes 12.12.4 para Windows. Un atacante local podr\u00eda aumentar sus privilegios."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48631.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0\n\nWhen walking through an inode extents, the ext4_ext_binsearch_idx() function\nassumes that the extent header has been previously validated. However, there\nare no checks that verify that the number of entries (eh->eh_entries) is\nnon-zero when depth is > 0. And this will lead to problems because the\nEXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this:\n\n[ 135.245946] ------------[ cut here ]------------\n[ 135.247579] kernel BUG at fs/ext4/extents.c:2258!\n[ 135.249045] invalid opcode: 0000 [#1] PREEMPT SMP\n[ 135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4\n[ 135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014\n[ 135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0\n[ 135.256475] Code:\n[ 135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246\n[ 135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023\n[ 135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c\n[ 135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c\n[ 135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024\n[ 135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000\n[ 135.272394] FS: 00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000\n[ 135.274510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0\n[ 135.277952] Call Trace:\n[ 135.278635] <TASK>\n[ 135.279247] ? preempt_count_add+0x6d/0xa0\n[ 135.280358] ? percpu_counter_add_batch+0x55/0xb0\n[ 135.281612] ? _raw_read_unlock+0x18/0x30\n[ 135.282704] ext4_map_blocks+0x294/0x5a0\n[ 135.283745] ? xa_load+0x6f/0xa0\n[ 135.284562] ext4_mpage_readpages+0x3d6/0x770\n[ 135.285646] read_pages+0x67/0x1d0\n[ 135.286492] ? folio_add_lru+0x51/0x80\n[ 135.287441] page_cache_ra_unbounded+0x124/0x170\n[ 135.288510] filemap_get_pages+0x23d/0x5a0\n[ 135.289457] ? path_openat+0xa72/0xdd0\n[ 135.290332] filemap_read+0xbf/0x300\n[ 135.291158] ? _raw_spin_lock_irqsave+0x17/0x40\n[ 135.292192] new_sync_read+0x103/0x170\n[ 135.293014] vfs_read+0x15d/0x180\n[ 135.293745] ksys_read+0xa1/0xe0\n[ 135.294461] do_syscall_64+0x3c/0x80\n[ 135.295284] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThis patch simply adds an extra check in __ext4_ext_check(), verifying that\neh_entries is not 0 when eh_depth is > 0."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: corrige error en el an\u00e1lisis de extensiones cuando eh_entries == 0 y eh_ Depth &gt; 0 Al recorrer las extensiones de un inodo, la funci\u00f3n ext4_ext_binsearch_idx() asume que el encabezado de la extensi\u00f3n ha sido validado previamente. Sin embargo, no hay comprobaciones que verifiquen que el n\u00famero de entradas (eh-&gt;eh_entries) sea distinto de cero cuando la profundidad es &gt; 0. Y esto generar\u00e1 problemas porque EXT_FIRST_INDEX() y EXT_LAST_INDEX() devolver\u00e1n basura y dar\u00e1n como resultado esto: [135.245946] ------------[ cortar aqu\u00ed ]------------ [ 135.247579] \u00a1ERROR del kernel en fs/ext4/extents.c:2258! [ 135.249045] c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] SMP PREEMPT [ 135.250320] CPU: 2 PID: 238 Comm: tmp118 No contaminado 5.19.0-rc8+ #4 [ 135.252067] Nombre de hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996) , BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 01/04/2014 [135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0 [135.256475] C\u00f3digo: [135.261433] RSP: ffffc900005939f8 EFLAGS: 00010246 [ 135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023 [ 135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000000 3 RDI: ffff8880046e922c [ 135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c [ 135.268576] R10: 00000000000002602 R 11: 0000000000000000 R12: 0000000000000024 [ 135.270477 ] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000 [ 135.272394] FS: 00007fdabdc56740(0000) GS:ffff88807dd00000(0000) ) knlGS:0000000000000000 [ 135.274510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.276075] CR2: 00007ffc26bd4f00 CR3 : 0000000006261004 CR4: 0000000000170ea0 [ 135.277952] Seguimiento de llamadas: [ 135.278635] [ 135.279247] ? preempt_count_add+0x6d/0xa0 [135.280358]? \u00bfpercpu_counter_add_batch+0x55/0xb0 [135.281612]? _raw_read_unlock+0x18/0x30 [ 135.282704] ext4_map_blocks+0x294/0x5a0 [ 135.283745] ? xa_load+0x6f/0xa0 [135.284562] ext4_mpage_readpages+0x3d6/0x770 [135.285646] read_pages+0x67/0x1d0 [135.286492] ? folio_add_lru+0x51/0x80 [ 135.287441] page_cache_ra_unbounded+0x124/0x170 [ 135.288510] filemap_get_pages+0x23d/0x5a0 [ 135.289457] ? path_openat+0xa72/0xdd0 [135.290332] filemap_read+0xbf/0x300 [135.291158]? _raw_spin_lock_irqsave+0x17/0x40 [ 135.292192] new_sync_read+0x103/0x170 [ 135.293014] vfs_read+0x15d/0x180 [ 135.293745] ksys_read+0xa1/0xe0 [ 135.294461] do_syscall_64+0x3c/0x80 [ 135.295284] Entry_SYSCALL_64_after_hwframe+0x46/0xb0 Este parche simplemente agrega un verificaci\u00f3n adicional en __ext4_ext_check(), verificando que eh_entries no sea 0 cuando eh_ Depth sea &gt; 0."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48632.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()\n\nmemcpy() is called in a loop while 'operation->length' upper bound\nis not checked and 'data_idx' also increments."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i2c: mlxbf: evita el desbordamiento de pila en mlxbf_i2c_smbus_start_transaction() memcpy() se llama en un bucle mientras que el l\u00edmite superior 'operation-&gt;length' no est\u00e1 marcado y 'data_idx' tambi\u00e9n aumenta."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48633.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix WARN_ON(lock->magic != lock) error\n\npsb_gem_unpin() calls dma_resv_lock() but the underlying ww_mutex\ngets destroyed by drm_gem_object_release() move the\ndrm_gem_object_release() call in psb_gem_free_object() to after\nthe unpin to fix the below warning:\n\n[ 79.693962] ------------[ cut here ]------------\n[ 79.693992] DEBUG_LOCKS_WARN_ON(lock->magic != lock)\n[ 79.694015] WARNING: CPU: 0 PID: 240 at kernel/locking/mutex.c:582 __ww_mutex_lock.constprop.0+0x569/0xfb0\n[ 79.694052] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer qrtr bnep ath9k ath9k_common ath9k_hw snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel ath3k snd_intel_dspcfg mac80211 snd_intel_sdw_acpi btusb snd_hda_codec btrtl btbcm btintel btmtk bluetooth at24 snd_hda_core snd_hwdep uvcvideo snd_seq libarc4 videobuf2_vmalloc ath videobuf2_memops videobuf2_v4l2 videobuf2_common snd_seq_device videodev acer_wmi intel_powerclamp coretemp mc snd_pcm joydev sparse_keymap ecdh_generic pcspkr wmi_bmof cfg80211 i2c_i801 i2c_smbus snd_timer snd r8169 rfkill lpc_ich soundcore acpi_cpufreq zram rtsx_pci_sdmmc mmc_core serio_raw rtsx_pci gma500_gfx(E) video wmi ip6_tables ip_tables i2c_dev fuse\n[ 79.694436] CPU: 0 PID: 240 Comm: plymouthd Tainted: G W E 6.0.0-rc3+ #490\n[ 79.694457] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[ 79.694469] RIP: 0010:__ww_mutex_lock.constprop.0+0x569/0xfb0\n[ 79.694496] Code: ff 85 c0 0f 84 15 fb ff ff 8b 05 ca 3c 11 01 85 c0 0f 85 07 fb ff ff 48 c7 c6 30 cb 84 aa 48 c7 c7 a3 e1 82 aa e8 ac 29 f8 ff <0f> 0b e9 ed fa ff ff e8 5b 83 8a ff 85 c0 74 10 44 8b 0d 98 3c 11\n[ 79.694513] RSP: 0018:ffffad1dc048bbe0 EFLAGS: 00010282\n[ 79.694623] RAX: 0000000000000028 RBX: 0000000000000000 RCX: 0000000000000000\n[ 79.694636] RDX: 0000000000000001 RSI: ffffffffaa8b0ffc RDI: 00000000ffffffff\n[ 79.694650] RBP: ffffad1dc048bc80 R08: 0000000000000000 R09: ffffad1dc048ba90\n[ 79.694662] R10: 0000000000000003 R11: ffffffffaad62fe8 R12: ffff9ff302103138\n[ 79.694675] R13: ffff9ff306ec8000 R14: ffff9ff307779078 R15: ffff9ff3014c0270\n[ 79.694690] FS: 00007ff1cccf1740(0000) GS:ffff9ff3bc200000(0000) knlGS:0000000000000000\n[ 79.694705] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 79.694719] CR2: 0000559ecbcb4420 CR3: 0000000013210000 CR4: 00000000000006f0\n[ 79.694734] Call Trace:\n[ 79.694749] <TASK>\n[ 79.694761] ? __schedule+0x47f/0x1670\n[ 79.694796] ? psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[ 79.694830] ? lock_is_held_type+0xe3/0x140\n[ 79.694864] ? ww_mutex_lock+0x38/0xa0\n[ 79.694885] ? __cond_resched+0x1c/0x30\n[ 79.694902] ww_mutex_lock+0x38/0xa0\n[ 79.694925] psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[ 79.694964] psb_gem_unpin+0x199/0x1a0 [gma500_gfx]\n[ 79.694996] drm_gem_object_release_handle+0x50/0x60\n[ 79.695020] ? drm_gem_object_handle_put_unlocked+0xf0/0xf0\n[ 79.695042] idr_for_each+0x4b/0xb0\n[ 79.695066] ? _raw_spin_unlock_irqrestore+0x30/0x60\n[ 79.695095] drm_gem_release+0x1c/0x30\n[ 79.695118] drm_file_free.part.0+0x1ea/0x260\n[ 79.695150] drm_release+0x6a/0x120\n[ 79.695175] __fput+0x9f/0x260\n[ 79.695203] task_work_run+0x59/0xa0\n[ 79.695227] do_exit+0x387/0xbe0\n[ 79.695250] ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90\n[ 79.695275] ? lockdep_hardirqs_on+0x7d/0x100\n[ 79.695304] do_group_exit+0x33/0xb0\n[ 79.695331] __x64_sys_exit_group+0x14/0x20\n[ 79.695353] do_syscall_64+0x58/0x80\n[ 79.695376] ? up_read+0x17/0x20\n[ 79.695401] ? lock_is_held_type+0xe3/0x140\n[ 79.695429] ? asm_exc_page_fault+0x22/0x30\n[ 79.695450] ? lockdep_hardirqs_on+0x7d/0x100\n[ 79.695473] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[ 79.695493] RIP: 0033:0x7ff1ccefe3f1\n[ 79.695516] Code: Unable to access opcode bytes at RIP 0x7ff1ccefe3c7.\n[ 79.695607] RSP: 002b:00007ffed4413378 EFLAGS: \n---truncated---"
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/gma500: Se solucion\u00f3 el error WARN_ON(lock-&gt;magic!= lock) psb_gem_unpin() llama a dma_resv_lock() pero el ww_mutex subyacente es destruido por drm_gem_object_release() mueve drm_gem_object_release() llame a psb_gem_free_object() despu\u00e9s de desanclar para corregir la siguiente advertencia: [79.693962] ------------[ cortar aqu\u00ed ]------------ [ 79.693992] DEBUG_LOCKS_WARN_ON (lock-&gt;magic!= lock) [79.694015] ADVERTENCIA: CPU: 0 PID: 240 en kernel/locking/mutex.c:582 __ww_mutex_lock.constprop.0+0x569/0xfb0 [79.694052] M\u00f3dulos vinculados en: rfcomm snd_seq_dummy snd_hrtimer qrtr bnep ath9k ath9k_common ath9k_hw snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel ath3k snd_intel_dspcfg mac80211 snd_intel_sdw_acpi btusb snd_hda_codec btrtl btbcm btintel btmtk bluetooth at24 snd_hda_core snd_hwdep uvcvideo snd_seq libarc4 videobuf2_vmalloc ath videobuf2_memops videobuf2_v4l2 videobuf2_common snd_seq_device videodev acer_wmi intel_powerclamp coretemp mc snd_pcm joydev sparse_keymap pcspkr gen\u00e9rico wmi_bmof cfg80211 i2c_i801 i2c_smbus snd_timer snd r8169 rfkill lpc_ich soundcore acpi_cpufreq zram rtsx_pci_sdmmc mmc_core serio_raw rtsx_pci gma500_gfx(E) video wmi ip6_tables ip_tables i2c_dev fuse [79.694436] CPU: 0 PID: 240 Comm: plymouthd Tainted: GWE 6.0.0-rc3+ 0 [79.694457] Nombre del hardware: Packard Bell puntos s /SJE01_CT, BIOS V1.10 23/07/2013 [ 79.694469] RIP: 0010:__ww_mutex_lock.constprop.0+0x569/0xfb0 [ 79.694496] C\u00f3digo: ff 85 c0 0f 84 15 fb ff ff 8b 05 ca 3c 11 01 85 c0 0f 85 07 fb ff ff 48 c7 c6 30 cb 84 aa 48 c7 c7 a3 e1 82 aa e8 ac 29 f8 ff &lt;0f&gt; 0b e9 ed fa ff ff e8 5b 83 8a ff 85 c0 74 10 44 8b 0d 98 3c 11 [ 79.694513] RSP: 0018:ffffad1dc048bbe0 EFLAGS: 00010282 [ 79.694623] RAX: 0000000000000028 RBX: 00000000000000000 RCX: 000000000000000000000 [ 79 .694636] RDX: 0000000000000001 RSI: ffffffffaa8b0ffc RDI: 00000000ffffffff [ 79.694650] RBP: ffffad1dc048bc80 R08: 0000000000000000 R09: 0 [79.694662] R10 : 0000000000000003 R11: fffffffaad62fe8 R12: ffff9ff302103138 [ 79.694675] R13: ffff9ff306ec8000 R14: ffff9ff307779078 R15: ffff9ff3014c0270 [ 79.694 690] FS: 00007ff1cccf1740(0000) GS:ffff9ff3bc200000(0000) knlGS:0000000000000000 [ 79.694705] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 79.694719] CR2: 0000559ecbcb4420 CR3: 0000000013210000 CR4: 00000000000006f0 [ 79.694734] Seguimiento de llamadas: [ 79.694749] [ 79.694761] ? __programar+0x47f/0x1670 [ 79.694796] ? psb_gem_unpin+0x27/0x1a0 [gma500_gfx] [79.694830]? lock_is_held_type+0xe3/0x140 [79.694864]? ww_mutex_lock+0x38/0xa0 [79.694885]? __cond_resched+0x1c/0x30 [ 79.694902] ww_mutex_lock+0x38/0xa0 [ 79.694925] psb_gem_unpin+0x27/0x1a0 [gma500_gfx] [ 79.694964] psb_gem_unpin+0x199/0x1a0 ma500_gfx] [79.694996] drm_gem_object_release_handle+0x50/0x60 [79.695020]? drm_gem_object_handle_put_unlocked+0xf0/0xf0 [ 79.695042] idr_for_each+0x4b/0xb0 [ 79.695066] ? _raw_spin_unlock_irqrestore+0x30/0x60 [ 79.695095] drm_gem_release+0x1c/0x30 [ 79.695118] drm_file_free.part.0+0x1ea/0x260 [ 79.695150] drm_release+0x6a/0x120 [ 79.695175 ] __fput+0x9f/0x260 [ 79.695203] task_work_run+0x59/0xa0 [ 79.695227] do_exit+0x387/0xbe0 [ 79.695250] ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90 [79.695275]? lockdep_hardirqs_on+0x7d/0x100 [ 79.695304] do_group_exit+0x33/0xb0 [ 79.695331] __x64_sys_exit_group+0x14/0x20 [ 79.695353] do_syscall_64+0x58/0x80 [ 79.69 5376] ? up_read+0x17/0x20 [ 79.695401] ? lock_is_held_type+0xe3/0x140 [79.695429]? asm_exc_page_fault+0x22/0x30 [79.695450]? lockdep_hardirqs_on+0x7d/0x100 [ 79.695473] Entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 79.695493] RIP: 0033:0x7ff1ccefe3f1 [ 79.695516] C\u00f3digo: No se puede acceder a los bytes del c\u00f3digo de operaci\u00f3n en RIP 0x7ff1ccefe3 c7. [79.695607] RSP: 002b:00007ffed4413378 EFLAGS: ---truncado---"
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48634.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix BUG: sleeping function called from invalid context errors\n\ngma_crtc_page_flip() was holding the event_lock spinlock while calling\ncrtc_funcs->mode_set_base() which takes ww_mutex.\n\nThe only reason to hold event_lock is to clear gma_crtc->page_flip_event\non mode_set_base() errors.\n\nInstead unlock it after setting gma_crtc->page_flip_event and on\nerrors re-take the lock and clear gma_crtc->page_flip_event it\nit is still set.\n\nThis fixes the following WARN/stacktrace:\n\n[ 512.122953] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:870\n[ 512.123004] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1253, name: gnome-shell\n[ 512.123031] preempt_count: 1, expected: 0\n[ 512.123048] RCU nest depth: 0, expected: 0\n[ 512.123066] INFO: lockdep is turned off.\n[ 512.123080] irq event stamp: 0\n[ 512.123094] hardirqs last enabled at (0): [<0000000000000000>] 0x0\n[ 512.123134] hardirqs last disabled at (0): [<ffffffff8d0ec28c>] copy_process+0x9fc/0x1de0\n[ 512.123176] softirqs last enabled at (0): [<ffffffff8d0ec28c>] copy_process+0x9fc/0x1de0\n[ 512.123207] softirqs last disabled at (0): [<0000000000000000>] 0x0\n[ 512.123233] Preemption disabled at:\n[ 512.123241] [<0000000000000000>] 0x0\n[ 512.123275] CPU: 3 PID: 1253 Comm: gnome-shell Tainted: G W 5.19.0+ #1\n[ 512.123304] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[ 512.123323] Call Trace:\n[ 512.123346] <TASK>\n[ 512.123370] dump_stack_lvl+0x5b/0x77\n[ 512.123412] __might_resched.cold+0xff/0x13a\n[ 512.123458] ww_mutex_lock+0x1e/0xa0\n[ 512.123495] psb_gem_pin+0x2c/0x150 [gma500_gfx]\n[ 512.123601] gma_pipe_set_base+0x76/0x240 [gma500_gfx]\n[ 512.123708] gma_crtc_page_flip+0x95/0x130 [gma500_gfx]\n[ 512.123808] drm_mode_page_flip_ioctl+0x57d/0x5d0\n[ 512.123897] ? drm_mode_cursor2_ioctl+0x10/0x10\n[ 512.123936] drm_ioctl_kernel+0xa1/0x150\n[ 512.123984] drm_ioctl+0x21f/0x420\n[ 512.124025] ? drm_mode_cursor2_ioctl+0x10/0x10\n[ 512.124070] ? rcu_read_lock_bh_held+0xb/0x60\n[ 512.124104] ? lock_release+0x1ef/0x2d0\n[ 512.124161] __x64_sys_ioctl+0x8d/0xd0\n[ 512.124203] do_syscall_64+0x58/0x80\n[ 512.124239] ? do_syscall_64+0x67/0x80\n[ 512.124267] ? trace_hardirqs_on_prepare+0x55/0xe0\n[ 512.124300] ? do_syscall_64+0x67/0x80\n[ 512.124340] ? rcu_read_lock_sched_held+0x10/0x80\n[ 512.124377] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[ 512.124411] RIP: 0033:0x7fcc4a70740f\n[ 512.124442] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00\n[ 512.124470] RSP: 002b:00007ffda73f5390 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n[ 512.124503] RAX: ffffffffffffffda RBX: 000055cc9e474500 RCX: 00007fcc4a70740f\n[ 512.124524] RDX: 00007ffda73f5420 RSI: 00000000c01864b0 RDI: 0000000000000009\n[ 512.124544] RBP: 00007ffda73f5420 R08: 000055cc9c0b0cb0 R09: 0000000000000034\n[ 512.124564] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000c01864b0\n[ 512.124584] R13: 0000000000000009 R14: 000055cc9df484d0 R15: 000055cc9af5d0c0\n[ 512.124647] </TASK>"
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/gma500: Correcci\u00f3n de ERROR: funci\u00f3n inactiva llamada desde errores de contexto no v\u00e1lidos gma_crtc_page_flip() estaba manteniendo el spinlock event_lock mientras llamaba a crtc_funcs-&gt;mode_set_base() que toma ww_mutex. La \u00fanica raz\u00f3n para mantener event_lock es borrar los errores de gma_crtc-&gt;page_flip_event en mode_set_base(). En su lugar, desbloqu\u00e9elo despu\u00e9s de configurar gma_crtc-&gt;page_flip_event y, en caso de errores, vuelva a tomar el bloqueo y borre gma_crtc-&gt;page_flip_event si todav\u00eda est\u00e1 configurado. Esto corrige la siguiente ADVERTENCIA/stacktrace: [512.122953] ERROR: funci\u00f3n inactiva llamada desde un contexto no v\u00e1lido en kernel/locking/mutex.c:870 [512.123004] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1253, nombre: gnome-shell [512.123031] preempt_count: 1, esperado: 0 [512.123048] Profundidad del nido de RCU: 0, esperado: 0 [512.123066] INFORMACI\u00d3N: lockdep est\u00e1 desactivado. [ 512.123080] sello de evento irq: 0 [ 512.123094] hardirqs habilitado por \u00faltima vez en (0): [&lt;0000000000000000&gt;] 0x0 [ 512.123134] hardirqs deshabilitado por \u00faltima vez en (0): [] copy_process+0x9fc/0x1de0 [ 5 12.123176] softirqs habilitado por \u00faltima vez en (0): [] copy_process+0x9fc/0x1de0 [ 512.123207] softirqs deshabilitado por \u00faltima vez en (0): [&lt;0000000000000000&gt;] 0x0 [ 512.123233] Preferencia deshabilitada en: [ 512.123241] 0000000000&gt;] 0x0 [ 512.123275] CPU: 3 PID: 1253 Comunicaciones: gnome-shell Contaminado: GW 5.19.0+ #1 [ 512.123304] Nombre de hardware: Packard Bell dot s/SJE01_CT, BIOS V1.10 23/07/2013 [ 512.123323] Seguimiento de llamadas : [ 512.123346] [ 512.123370] dump_stack_lvl+0x5b/0x77 [ 512.123412] __might_resched.cold+0xff/0x13a [ 512.123458] ww_mutex_lock+0x1e/0xa0 [ 512.123495 ] psb_gem_pin+0x2c/0x150 [gma500_gfx] [ 512.123601] gma_pipe_set_base+0x76 /0x240 [gma500_gfx] [ 512.123708] gma_crtc_page_flip+0x95/0x130 [gma500_gfx] [ 512.123808] drm_mode_page_flip_ioctl+0x57d/0x5d0 [ 512.123897] ? drm_mode_cursor2_ioctl+0x10/0x10 [ 512.123936] drm_ioctl_kernel+0xa1/0x150 [ 512.123984] drm_ioctl+0x21f/0x420 [ 512.124025] ? drm_mode_cursor2_ioctl+0x10/0x10 [512.124070]? rcu_read_lock_bh_held+0xb/0x60 [512.124104]? lock_release+0x1ef/0x2d0 [ 512.124161] __x64_sys_ioctl+0x8d/0xd0 [ 512.124203] do_syscall_64+0x58/0x80 [ 512.124239] ? do_syscall_64+0x67/0x80 [512.124267]? trace_hardirqs_on_prepare+0x55/0xe0 [512.124300]? do_syscall_64+0x67/0x80 [512.124340]? rcu_read_lock_sched_held+0x10/0x80 [ 512.124377] Entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 512.124411] RIP: 0033:0x7fcc4a70740f [ 512.124442] C\u00f3digo: 00 48 89 44 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 &lt;89&gt; c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 24470]RSP: 002b:00007ffda73f5390 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 512.124503] RAX: ffffffffffffffda RBX: 000055cc9e474500 RCX: 00007fcc4a70740f [ 512.124524] RDX: 7ffda73f5420 RSI: 00000000c01864b0 RDI: 0000000000000009 [ 512.124544] RBP: 00007ffda73f5420 R08: 000055cc9c0b0cb0 R09: 0000000000000034 12.124564] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000c01864b0 [ 512.124584] R13: 0000000000000009 R14: 000055cc9df484d0 R15: 000055cc9af5d0c0 [ 512.124647 ] "
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48635.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsdax: Fix infinite loop in dax_iomap_rw()\n\nI got an infinite loop and a WARNING report when executing a tail command\nin virtiofs.\n\n WARNING: CPU: 10 PID: 964 at fs/iomap/iter.c:34 iomap_iter+0x3a2/0x3d0\n Modules linked in:\n CPU: 10 PID: 964 Comm: tail Not tainted 5.19.0-rc7\n Call Trace:\n <TASK>\n dax_iomap_rw+0xea/0x620\n ? __this_cpu_preempt_check+0x13/0x20\n fuse_dax_read_iter+0x47/0x80\n fuse_file_read_iter+0xae/0xd0\n new_sync_read+0xfe/0x180\n ? 0xffffffff81000000\n vfs_read+0x14d/0x1a0\n ksys_read+0x6d/0xf0\n __x64_sys_read+0x1a/0x20\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe tail command will call read() with a count of 0. In this case,\niomap_iter() will report this WARNING, and always return 1 which casuing\nthe infinite loop in dax_iomap_rw().\n\nFixing by checking count whether is 0 in dax_iomap_rw()."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: fsdax: Reparar bucle infinito en dax_iomap_rw() Obtuve un bucle infinito y un informe de ADVERTENCIA al ejecutar un comando tail en virtiofs. ADVERTENCIA: CPU: 10 PID: 964 en fs/iomap/iter.c:34 iomap_iter+0x3a2/0x3d0 M\u00f3dulos vinculados en: CPU: 10 PID: 964 Comm: tail No contaminado 5.19.0-rc7 Seguimiento de llamadas: dax_iomap_rw +0xea/0x620 ? __this_cpu_preempt_check+0x13/0x20 fuse_dax_read_iter+0x47/0x80 fuse_file_read_iter+0xae/0xd0 new_sync_read+0xfe/0x180 ? 0xffffffff81000000 vfs_read+0x14d/0x1a0 ksys_read+0x6d/0xf0 __x64_sys_read+0x1a/0x20 do_syscall_64+0x3b/0x90 Entry_SYSCALL_64_after_hwframe+0x63/0xcd El comando tail llamar\u00e1 a read() con un recuento de 0. En este caso, iomap_iter() informar\u00e1 esto ADVERTENCIA, y siempre devuelve 1, lo que provoca el bucle infinito en dax_iomap_rw(). Arreglando verificando el recuento si es 0 en dax_iomap_rw()."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48636.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup\n\nFix Oops in dasd_alias_get_start_dev() function caused by the pavgroup\npointer being NULL.\n\nThe pavgroup pointer is checked on the entrance of the function but\nwithout the lcu->lock being held. Therefore there is a race window\nbetween dasd_alias_get_start_dev() and _lcu_update() which sets\npavgroup to NULL with the lcu->lock held.\n\nFix by checking the pavgroup pointer with lcu->lock held."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: s390/dasd: corrige Ups en dasd_alias_get_start_dev debido a la falta de pavgroup. Corrige Ups en la funci\u00f3n dasd_alias_get_start_dev() causada porque el puntero pavgroup es NULL. El puntero pavgroup se verifica en la entrada de la funci\u00f3n pero sin que se mantenga presionado el bloqueo lcu-&gt;. Por lo tanto, existe una ventana de ejecuci\u00f3n entre dasd_alias_get_start_dev() y _lcu_update() que establece pavgroup en NULL con el bloqueo lcu-&gt;retenido. Para solucionarlo, compruebe el puntero de pavgroup con lcu-&gt;lock retenido."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48637.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt: prevent skb UAF after handing over to PTP worker\n\nWhen reading the timestamp is required bnxt_tx_int() hands\nover the ownership of the completed skb to the PTP worker.\nThe skb should not be used afterwards, as the worker may\nrun before the rest of our code and free the skb, leading\nto a use-after-free.\n\nSince dev_kfree_skb_any() accepts NULL make the loss of\nownership more obvious and set skb to NULL."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bnxt: impide que skb UAF se entregue al trabajador de PTP. Cuando se requiere leer la marca de tiempo, bnxt_tx_int() entrega la propiedad del skb completado al trabajador de PTP. El skb no debe usarse despu\u00e9s, ya que el trabajador puede ejecutarse antes que el resto de nuestro c\u00f3digo y liberar el skb, lo que lleva a un use-after-free. Dado que dev_kfree_skb_any() acepta NULL, la p\u00e9rdida de propiedad es m\u00e1s obvia y establece skb en NULL."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48638.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: cgroup_get_from_id() must check the looked-up kn is a directory\n\ncgroup has to be one kernfs dir, otherwise kernel panic is caused,\nespecially cgroup id is provide from userspace."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: cgroup: cgroup_get_from_id() debe verificar que el kn buscado sea un directorio. cgroup tiene que ser un directorio kernfs; de lo contrario, se produce un p\u00e1nico en el kernel, especialmente la identificaci\u00f3n de cgroup se proporciona desde el espacio de usuario."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48639.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix possible refcount leak in tc_new_tfilter()\n\ntfilter_put need to be called to put the refount got by tp->ops->get to\navoid possible refcount leak when chain->tmplt_ops != NULL and\nchain->tmplt_ops != tp->ops."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: sched: corrige posible fuga de recuento en tc_new_tfilter() Es necesario llamar a tfilter_put para colocar el recuento obtenido mediante tp-&gt;ops-&gt;get para evitar una posible fuga de recuento cuando se realiza la cadena. &gt;tmplt_ops != NULL y cadena-&gt;tmplt_ops != tp-&gt;ops."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48640.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: fix NULL deref in bond_rr_gen_slave_id\n\nFix a NULL dereference of the struct bonding.rr_tx_counter member because\nif a bond is initially created with an initial mode != zero (Round Robin)\nthe memory required for the counter is never created and when the mode is\nchanged there is never any attempt to verify the memory is allocated upon\nswitching modes.\n\nThis causes the following Oops on an aarch64 machine:\n [ 334.686773] Unable to handle kernel paging request at virtual address ffff2c91ac905000\n [ 334.694703] Mem abort info:\n [ 334.697486] ESR = 0x0000000096000004\n [ 334.701234] EC = 0x25: DABT (current EL), IL = 32 bits\n [ 334.706536] SET = 0, FnV = 0\n [ 334.709579] EA = 0, S1PTW = 0\n [ 334.712719] FSC = 0x04: level 0 translation fault\n [ 334.717586] Data abort info:\n [ 334.720454] ISV = 0, ISS = 0x00000004\n [ 334.724288] CM = 0, WnR = 0\n [ 334.727244] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000008044d662000\n [ 334.733944] [ffff2c91ac905000] pgd=0000000000000000, p4d=0000000000000000\n [ 334.740734] Internal error: Oops: 96000004 [#1] SMP\n [ 334.745602] Modules linked in: bonding tls veth rfkill sunrpc arm_spe_pmu vfat fat acpi_ipmi ipmi_ssif ixgbe igb i40e mdio ipmi_devintf ipmi_msghandler arm_cmn arm_dsu_pmu cppc_cpufreq acpi_tad fuse zram crct10dif_ce ast ghash_ce sbsa_gwdt nvme drm_vram_helper drm_ttm_helper nvme_core ttm xgene_hwmon\n [ 334.772217] CPU: 7 PID: 2214 Comm: ping Not tainted 6.0.0-rc4-00133-g64ae13ed4784 #4\n [ 334.779950] Hardware name: GIGABYTE R272-P31-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021\n [ 334.789244] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n [ 334.796196] pc : bond_rr_gen_slave_id+0x40/0x124 [bonding]\n [ 334.801691] lr : bond_xmit_roundrobin_slave_get+0x38/0xdc [bonding]\n [ 334.807962] sp : ffff8000221733e0\n [ 334.811265] x29: ffff8000221733e0 x28: ffffdbac8572d198 x27: ffff80002217357c\n [ 334.818392] x26: 000000000000002a x25: ffffdbacb33ee000 x24: ffff07ff980fa000\n [ 334.825519] x23: ffffdbacb2e398ba x22: ffff07ff98102000 x21: ffff07ff981029c0\n [ 334.832646] x20: 0000000000000001 x19: ffff07ff981029c0 x18: 0000000000000014\n [ 334.839773] x17: 0000000000000000 x16: ffffdbacb1004364 x15: 0000aaaabe2f5a62\n [ 334.846899] x14: ffff07ff8e55d968 x13: ffff07ff8e55db30 x12: 0000000000000000\n [ 334.854026] x11: ffffdbacb21532e8 x10: 0000000000000001 x9 : ffffdbac857178ec\n [ 334.861153] x8 : ffff07ff9f6e5a28 x7 : 0000000000000000 x6 : 000000007c2b3742\n [ 334.868279] x5 : ffff2c91ac905000 x4 : ffff2c91ac905000 x3 : ffff07ff9f554400\n [ 334.875406] x2 : ffff2c91ac905000 x1 : 0000000000000001 x0 : ffff07ff981029c0\n [ 334.882532] Call trace:\n [ 334.884967] bond_rr_gen_slave_id+0x40/0x124 [bonding]\n [ 334.890109] bond_xmit_roundrobin_slave_get+0x38/0xdc [bonding]\n [ 334.896033] __bond_start_xmit+0x128/0x3a0 [bonding]\n [ 334.901001] bond_start_xmit+0x54/0xb0 [bonding]\n [ 334.905622] dev_hard_start_xmit+0xb4/0x220\n [ 334.909798] __dev_queue_xmit+0x1a0/0x720\n [ 334.913799] arp_xmit+0x3c/0xbc\n [ 334.916932] arp_send_dst+0x98/0xd0\n [ 334.920410] arp_solicit+0xe8/0x230\n [ 334.923888] neigh_probe+0x60/0xb0\n [ 334.927279] __neigh_event_send+0x3b0/0x470\n [ 334.931453] neigh_resolve_output+0x70/0x90\n [ 334.935626] ip_finish_output2+0x158/0x514\n [ 334.939714] __ip_finish_output+0xac/0x1a4\n [ 334.943800] ip_finish_output+0x40/0xfc\n [ 334.947626] ip_output+0xf8/0x1a4\n [ 334.950931] ip_send_skb+0x5c/0x100\n [ 334.954410] ip_push_pending_frames+0x3c/0x60\n [ 334.958758] raw_sendmsg+0x458/0x6d0\n [ 334.962325] inet_sendmsg+0x50/0x80\n [ 334.965805] sock_sendmsg+0x60/0x6c\n [ 334.969286] __sys_sendto+0xc8/0x134\n [ 334.972853] __arm64_sys_sendto+0x34/0x4c\n---truncated---"
},
{
"lang": "es",
"value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: bonding: corrige la deref NULL en bond_rr_gen_slave_id Se corrige una desreferencia NULL del miembro struct bonding.rr_tx_counter porque si un enlace se crea inicialmente con un modo inicial != cero (Round Robin) la memoria requerido para el contador nunca se crea y cuando se cambia el modo nunca se intenta verificar que la memoria est\u00e9 asignada al cambiar de modo. Esto provoca los siguientes errores en una m\u00e1quina aarch64: [334.686773] No se puede manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual ffff2c91ac905000 [334.694703] Informaci\u00f3n de cancelaci\u00f3n de memoria: [334.697486] ESR = 0x0000000096000004 [334.701234] EC = 0x25: DABT (EL actual), IL = 32 bits [ 334.706536] SET = 0, FnV = 0 [ 334.709579] EA = 0, S1PTW = 0 [ 334.712719] FSC = 0x04: error de traducci\u00f3n de nivel 0 [ 334.717586] Informaci\u00f3n de cancelaci\u00f3n de datos: [ 334.720454] ISV = 0, ISS = 0x00000004 [334.724288] CM = 0, WnR = 0 [334.727244] tabla de intercambio: p\u00e1ginas 4k, VA de 48 bits, pgdp=000008044d662000 [334.733944] [ffff2c91ac905000] 0000000000000, p4d=00000000000000000 [334.740734] Error interno: Ups: 96000004 [#1] SMP [334.745602] M\u00f3dulos vinculados en: uni\u00f3n tls veth rfkill sunrpc arm_spe_pmu vfat fat acpi_ipmi ipmi_ssif ixgbe igb i40e mdio ipmi_devintf ipmi_msghandler arm_cmn arm_dsu_pmu cppc_cpufreq acpi_tad fuse crct10dif_ce ast ghash_ce sbsa_gwdt nvme drm_vram_helper drm_ttm_helper nvme_core ttm xgene_hwmon [334.772217] CPU: 7 PID: 2214 Comm: ping No contaminado 6.0.0-rc4-00133-g64ae13ed4784 #4 [334.779950] Nombre de hardware: GIGABYTE R272-P31-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01 /2021 [ 334.789244] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 334.796196] pc : bond_rr_gen_slave_id+0x40/0x124 [uni\u00f3n] [ 334.801691] lr : _slave_get+0x38/0xdc [ vinculaci\u00f3n] [ 334.807962] sp : ffff8000221733e0 [ 334.811265] x29: ffff8000221733e0 x28: ffffdbac8572d198 x27: ffff80002217357c [ 334.818392] x26: 00000000002a x25: ffffdbacb33ee000 x24: ffff07ff980fa000 [ 334.825519] x23: ffffdbacb2e398ba x22: ffff07ff98102000 x21: ffff07ff981029c0 [ 334.832646] x 20: 0000000000000001 x19: ffff07ff981029c0 x18: 0000000000000014 [ 334.839773] x17: 0000000000000000 x16: ffffdbacb1004364 x15: 0000aaaabe2f5a62 [ 334.846899] 14: ffff07ff8e55d968 x13: ffff07ff8e55db30 x12: 0000000000000000 [ 334.854026] x11: ffffdbacb21532e8 x10: 0000000000000001 x9 : ffffdbac857178ec [ 3 34.861153] x8: ffff07ff9f6e5a28 x7: 0000000000000000 x6: 000000007c2b3742 [334.868279] x5: ffff2c91ac905000 x4: ffff2c91ac905000 x3: ffff07ff9f554400 [334.875406] x2: 1ac905000 x1: 0000000000000001 x0: ffff07ff981029c0 [334.882532] Rastreo de llamadas: [334.884967] bond_rr_gen_slave_id+0x40/0x124 [vinculaci\u00f3n] [334.890109] _obtener+ 0x38/0xdc [v\u00ednculo] [ 334.896033] __bond_start_xmit+0x128/0x3a0 [v\u00ednculo] [ 334.901001] bond_start_xmit+0x54/0xb0 [v\u00ednculo] [ 334.905622] dev_hard_start_xmit+0xb4/0x220 [ 334 .909798] __dev_queue_xmit+0x1a0/0x720 [ 334.913799] arp_xmit+0x3c /0xbc [ 334.916932] arp_send_dst+0x98/0xd0 [ 334.920410] arp_solicit+0xe8/0x230 [ 334.923888] neigh_probe+0x60/0xb0 [ 334.927279] 0x470 [334.931453] neigh_resolve_output+0x70/0x90 [334.935626] ip_finish_output2+0x158/0x514 [ 334.939714] __ip_finish_output+0xac/0x1a4 [ 334.943800] ip_finish_output+0x40/0xfc [ 334.947626] ip_output+0xf8/0x1a4 [ 334.950931] 0 [ 334.954410] ip_push_pending_frames+0x3c/0x60 [ 334.958758] raw_sendmsg+0x458/0x6d0 [ 334.962325 ] inet_sendmsg+0x50/0x80 [ 334.965805] sock_sendmsg+0x60/0x6c [ 334.969286] __sys_sendto+0xc8/0x134 [ 334.972853] __arm64_sys_sendto+0x34/0x4c ncado---"
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48641.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: fix memory leak when blob is malformed\n\nThe bug fix was incomplete, it \"replaced\" crash with a memory leak.\nThe old code had an assignment to \"ret\" embedded into the conditional,\nrestore this."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: netfilter: ebtables: corrige la p\u00e9rdida de memoria cuando el blob tiene un formato incorrecto La correcci\u00f3n del error estaba incompleta, \"reemplaz\u00f3\" el bloqueo con una p\u00e9rdida de memoria. El c\u00f3digo antiguo ten\u00eda una asignaci\u00f3n para \"ret\" incrustada en el condicional, restaurar esto."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48642.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()\n\nIt seems to me that percpu memory for chain stats started leaking since\ncommit 3bc158f8d0330f0a (\"netfilter: nf_tables: map basechain priority to\nhardware priority\") when nft_chain_offload_priority() returned an error."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: netfilter: nf_tables: corrige la p\u00e9rdida de memoria de percpu en nf_tables_addchain() Me parece que la memoria de percpu para las estad\u00edsticas de la cadena comenz\u00f3 a perderse desde el commit 3bc158f8d0330f0a (\"netfilter: nf_tables: asigna la prioridad de la cadena base al hardware prioridad\") cuando nft_chain_offload_priority() devolvi\u00f3 un error."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48643.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()\n\nsyzbot is reporting underflow of nft_counters_enabled counter at\nnf_tables_addchain() [1], for commit 43eb8949cfdffa76 (\"netfilter:\nnf_tables: do not leave chain stats enabled on error\") missed that\nnf_tables_chain_destroy() after nft_basechain_init() in the error path of\nnf_tables_addchain() decrements the counter because nft_basechain_init()\nmakes nft_is_base_chain() return true by setting NFT_CHAIN_BASE flag.\n\nIncrement the counter immediately after returning from\nnft_basechain_init()."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_tables: corrige el desbordamiento de nft_counters_enabled en nf_tables_addchain() syzbot informa el desbordamiento del contador nft_counters_enabled en nf_tables_addchain() [1], para el commit 43eb8949cfdffa76 (\"netfilter: nf_tables: no salir estad\u00edsticas de cadena habilitadas en caso de error\") pas\u00f3 por alto que nf_tables_chain_destroy() despu\u00e9s de nft_basechain_init() en la ruta de error de nf_tables_addchain() disminuye el contador porque nft_basechain_init() hace que nft_is_base_chain() devuelva verdadero al configurar el indicador NFT_CHAIN_BASE. Incrementa el contador inmediatamente despu\u00e9s de regresar de nft_basechain_init()."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48644.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: taprio: avoid disabling offload when it was never enabled\n\nIn an incredibly strange API design decision, qdisc->destroy() gets\ncalled even if qdisc->init() never succeeded, not exclusively since\ncommit 87b60cfacf9f (\"net_sched: fix error recovery at qdisc creation\"),\nbut apparently also earlier (in the case of qdisc_create_dflt()).\n\nThe taprio qdisc does not fully acknowledge this when it attempts full\noffload, because it starts off with q->flags = TAPRIO_FLAGS_INVALID in\ntaprio_init(), then it replaces q->flags with TCA_TAPRIO_ATTR_FLAGS\nparsed from netlink (in taprio_change(), tail called from taprio_init()).\n\nBut in taprio_destroy(), we call taprio_disable_offload(), and this\ndetermines what to do based on FULL_OFFLOAD_IS_ENABLED(q->flags).\n\nBut looking at the implementation of FULL_OFFLOAD_IS_ENABLED()\n(a bitwise check of bit 1 in q->flags), it is invalid to call this macro\non q->flags when it contains TAPRIO_FLAGS_INVALID, because that is set\nto U32_MAX, and therefore FULL_OFFLOAD_IS_ENABLED() will return true on\nan invalid set of flags.\n\nAs a result, it is possible to crash the kernel if user space forces an\nerror between setting q->flags = TAPRIO_FLAGS_INVALID, and the calling\nof taprio_enable_offload(). This is because drivers do not expect the\noffload to be disabled when it was never enabled.\n\nThe error that we force here is to attach taprio as a non-root qdisc,\nbut instead as child of an mqprio root qdisc:\n\n$ tc qdisc add dev swp0 root handle 1: \\\n\tmqprio num_tc 8 map 0 1 2 3 4 5 6 7 \\\n\tqueues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0\n$ tc qdisc replace dev swp0 parent 1:1 \\\n\ttaprio num_tc 8 map 0 1 2 3 4 5 6 7 \\\n\tqueues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \\\n\tsched-entry S 0x7f 990000 sched-entry S 0x80 100000 \\\n\tflags 0x0 clockid CLOCK_TAI\nUnable to handle kernel paging request at virtual address fffffffffffffff8\n[fffffffffffffff8] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 96000004 [#1] PREEMPT SMP\nCall trace:\n taprio_dump+0x27c/0x310\n vsc9959_port_setup_tc+0x1f4/0x460\n felix_port_setup_tc+0x24/0x3c\n dsa_slave_setup_tc+0x54/0x27c\n taprio_disable_offload.isra.0+0x58/0xe0\n taprio_destroy+0x80/0x104\n qdisc_create+0x240/0x470\n tc_modify_qdisc+0x1fc/0x6b0\n rtnetlink_rcv_msg+0x12c/0x390\n netlink_rcv_skb+0x5c/0x130\n rtnetlink_rcv+0x1c/0x2c\n\nFix this by keeping track of the operations we made, and undo the\noffload only if we actually did it.\n\nI've added \"bool offloaded\" inside a 4 byte hole between \"int clockid\"\nand \"atomic64_t picos_per_byte\". Now the first cache line looks like\nbelow:\n\n$ pahole -C taprio_sched net/sched/sch_taprio.o\nstruct taprio_sched {\n struct Qdisc * * qdiscs; /* 0 8 */\n struct Qdisc * root; /* 8 8 */\n u32 flags; /* 16 4 */\n enum tk_offsets tk_offset; /* 20 4 */\n int clockid; /* 24 4 */\n bool offloaded; /* 28 1 */\n\n /* XXX 3 bytes hole, try to pack */\n\n atomic64_t picos_per_byte; /* 32 0 */\n\n /* XXX 8 bytes hole, try to pack */\n\n spinlock_t current_entry_lock; /* 40 0 */\n\n /* XXX 8 bytes hole, try to pack */\n\n struct sched_entry * current_entry; /* 48 8 */\n struct sched_gate_list * oper_sched; /* 56 8 */\n /* --- cacheline 1 boundary (64 bytes) --- */"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: taprio: evita deshabilitar la descarga cuando nunca estuvo habilitada. En una decisi\u00f3n de dise\u00f1o de API incre\u00edblemente extra\u00f1a, se llama a qdisc-&gt;destroy() incluso si qdisc-&gt;init() nunca tuvo \u00e9xito, no exclusivamente desde el commit 87b60cfacf9f (\"net_sched: corregir recuperaci\u00f3n de error en la creaci\u00f3n de qdisc\"), sino aparentemente tambi\u00e9n antes (en el caso de qdisc_create_dflt()). La qdisc taprio no reconoce completamente esto cuando intenta una descarga completa, porque comienza con q-&gt;flags = TAPRIO_FLAGS_INVALID en taprio_init(), luego reemplaza q-&gt;flags con TCA_TAPRIO_ATTR_FLAGS analizado desde netlink (en taprio_change(), cola llamada de taprio_init()). Pero en taprio_destroy(), llamamos a taprio_disable_offload(), y esto determina qu\u00e9 hacer en funci\u00f3n de FULL_OFFLOAD_IS_ENABLED(q-&gt;flags). Pero al observar la implementaci\u00f3n de FULL_OFFLOAD_IS_ENABLED() (una verificaci\u00f3n bit a bit del bit 1 en q-&gt;flags), no es v\u00e1lido llamar a esta macro en q-&gt;flags cuando contiene TAPRIO_FLAGS_INVALID, porque est\u00e1 configurado en U32_MAX y, por lo tanto, FULL_OFFLOAD_IS_ENABLED () devolver\u00e1 verdadero en un conjunto de indicadores no v\u00e1lido. Como resultado, es posible bloquear el kernel si el espacio del usuario fuerza un error entre configurar q-&gt;flags = TAPRIO_FLAGS_INVALID y la llamada de taprio_enable_offload(). Esto se debe a que los conductores no esperan que se deshabilite la descarga cuando nunca estuvo habilitada. El error que forzamos aqu\u00ed es adjuntar taprio como una qdisc no ra\u00edz, sino como hija de una qdisc ra\u00edz mqprio: $ tc qdisc add dev swp0 root handle 1: \\ mqprio num_tc 8 map 0 1 2 3 4 5 6 7 \\ colas 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0 $ tc qdisc reemplazar dev swp0 padre 1:1 \\ taprio num_tc 8 map 0 1 2 3 4 5 6 7 \\ colas 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 tiempo base 0 \\ entrada programada S 0x7f 990000 entrada programada S 0x80 100000 \\ banderas 0x0 clockid CLOCK_TAI No se puede para manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual ffffffffffffffff8 [ffffffffffffffff8] pgd=0000000000000000, p4d=0000000000000000 Error interno: Vaya: 96000004 [#1] Seguimiento de llamada SMP PREEMPT: taprio_dump+0x27c/0x310 vsc9959_port _setup_tc+0x1f4/0x460 felix_port_setup_tc+0x24/0x3c dsa_slave_setup_tc +0x54/0x27c taprio_disable_offload.isra.0+0x58/0xe0 taprio_destroy+0x80/0x104 qdisc_create+0x240/0x470 tc_modify_qdisc+0x1fc/0x6b0 rtnetlink_rcv_msg+0x12c/0x390 x5c/0x130 rtnetlink_rcv+0x1c/0x2c Solucione este problema manteniendo un registro de operaciones que hicimos, y deshacer la descarga solo si realmente lo hicimos. Agregu\u00e9 \"bool descargado\" dentro de un hueco de 4 bytes entre \"int clockid\" y \"atomic64_t picos_per_byte\". Ahora la primera l\u00ednea de cach\u00e9 se ve as\u00ed: $ pahole -C taprio_sched net/sched/sch_taprio.o struct taprio_sched { struct Qdisc * * qdiscs; /* 0 8 */ struct Qdisc * ra\u00edz; /* 8 8 */ u32 banderas; /* 16 4 */ enum tk_offsets tk_offset; /* 20 4 */ int relojid; /* 24 4 */ bool descargado; /* 28 1 */ /* XXX agujero de 3 bytes, intenta empaquetar */ atomic64_t picos_per_byte; /* 32 0 */ /* XXX agujero de 8 bytes, intenta empaquetar */ spinlock_t current_entry_lock; /* 40 0 */ /* XXX agujero de 8 bytes, intenta empaquetar */ struct sched_entry * current_entry; /* 48 8 */ struct sched_gate_list * oper_sched; /* 56 8 */ /* --- l\u00edmite de l\u00ednea de cach\u00e9 1 (64 bytes) --- */"
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48645.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: deny offload of tc-based TSN features on VF interfaces\n\nTSN features on the ENETC (taprio, cbs, gate, police) are configured\nthrough a mix of command BD ring messages and port registers:\nenetc_port_rd(), enetc_port_wr().\n\nPort registers are a region of the ENETC memory map which are only\naccessible from the PCIe Physical Function. They are not accessible from\nthe Virtual Functions.\n\nMoreover, attempting to access these registers crashes the kernel:\n\n$ echo 1 > /sys/bus/pci/devices/0000\\:00\\:00.0/sriov_numvfs\npci 0000:00:01.0: [1957:ef00] type 00 class 0x020001\nfsl_enetc_vf 0000:00:01.0: Adding to iommu group 15\nfsl_enetc_vf 0000:00:01.0: enabling device (0000 -> 0002)\nfsl_enetc_vf 0000:00:01.0 eno0vf0: renamed from eth0\n$ tc qdisc replace dev eno0vf0 root taprio num_tc 8 map 0 1 2 3 4 5 6 7 \\\n\tqueues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \\\n\tsched-entry S 0x7f 900000 sched-entry S 0x80 100000 flags 0x2\nUnable to handle kernel paging request at virtual address ffff800009551a08\nInternal error: Oops: 96000007 [#1] PREEMPT SMP\npc : enetc_setup_tc_taprio+0x170/0x47c\nlr : enetc_setup_tc_taprio+0x16c/0x47c\nCall trace:\n enetc_setup_tc_taprio+0x170/0x47c\n enetc_setup_tc+0x38/0x2dc\n taprio_change+0x43c/0x970\n taprio_init+0x188/0x1e0\n qdisc_create+0x114/0x470\n tc_modify_qdisc+0x1fc/0x6c0\n rtnetlink_rcv_msg+0x12c/0x390\n\nSplit enetc_setup_tc() into separate functions for the PF and for the\nVF drivers. Also remove enetc_qos.o from being included into\nenetc-vf.ko, since it serves absolutely no purpose there."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: enetc: denegar la descarga de funciones TSN basadas en tc en interfaces VF Las funciones TSN en ENETC (taprio, cbs, gate, policial) se configuran mediante una combinaci\u00f3n de comandos BD ring mensajes y registros de puertos: enetc_port_rd(), enetc_port_wr(). Los registros de puerto son una regi\u00f3n del mapa de memoria ENETC a la que solo se puede acceder desde la funci\u00f3n f\u00edsica PCIe. No son accesibles desde las Funciones Virtuales. Adem\u00e1s, al intentar acceder a estos registros se bloquea el kernel: $ echo 1 &gt; /sys/bus/pci/devices/0000\\:00\\:00.0/sriov_numvfs pci 0000:00:01.0: [1957:ef00] type 00 class 0x020001 fsl_enetc_vf 0000:00:01.0: Agregar al grupo iommu 15 fsl_enetc_vf 0000:00:01.0: habilitar el dispositivo (0000 -&gt; 0002) fsl_enetc_vf 0000:00:01.0 eno0vf0: renombrado de eth0 $ tc qdisc reemplazar dev eno0vf0 root taprio num_tc 8 mapa 0 1 2 3 4 5 6 7 \\ colas 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 tiempo base 0 \\ entrada programada S 0x7f 900000 entrada programada S 0x80 100000 banderas 0x2 No se puede manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual ffff800009551a08 Error interno: Ups: 96000007 [#1] PC SMP PREEMPT: enetc_setup_tc_taprio+0x170/0x47c lr: enetc_setup_tc_taprio+0x16c/0x47c Rastreo de llamadas: enetc_setup_tc_taprio +0x170/0x47c enetc_setup_tc+0x38/0x2dc taprio_change+0x43c/0x970 taprio_init+0x188/0x1e0 qdisc_create+0x114/0x470 tc_modify_qdisc+0x1fc/0x6c0 rtnetlink_rcv_msg+0x12c/0x390 Divida enetc_setup_tc() en funciones separadas para los controladores PF y VF. Tambi\u00e9n elimine enetc_qos.o para que no se incluya en enetc-vf.ko, ya que no sirve para nada all\u00ed."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48646.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc/siena: fix null pointer dereference in efx_hard_start_xmit\n\nLike in previous patch for sfc, prevent potential (but unlikely) NULL\npointer dereference."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sfc/siena: corrige la desreferencia del puntero nulo en efx_hard_start_xmit Al igual que en el parche anterior para sfc, evita una posible (pero poco probable) desreferencia del puntero NULL."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48647.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix TX channel offset when using legacy interrupts\n\nIn legacy interrupt mode the tx_channel_offset was hardcoded to 1, but\nthat's not correct if efx_sepparate_tx_channels is false. In that case,\nthe offset is 0 because the tx queues are in the single existing channel\nat index 0, together with the rx queue.\n\nWithout this fix, as soon as you try to send any traffic, it tries to\nget the tx queues from an uninitialized channel getting these errors:\n WARNING: CPU: 1 PID: 0 at drivers/net/ethernet/sfc/tx.c:540 efx_hard_start_xmit+0x12e/0x170 [sfc]\n [...]\n RIP: 0010:efx_hard_start_xmit+0x12e/0x170 [sfc]\n [...]\n Call Trace:\n <IRQ>\n dev_hard_start_xmit+0xd7/0x230\n sch_direct_xmit+0x9f/0x360\n __dev_queue_xmit+0x890/0xa40\n [...]\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000020\n [...]\n RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]\n [...]\n Call Trace:\n <IRQ>\n dev_hard_start_xmit+0xd7/0x230\n sch_direct_xmit+0x9f/0x360\n __dev_queue_xmit+0x890/0xa40\n [...]"
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: sfc: corrige el desplazamiento del canal TX cuando se usan interrupciones heredadas En el modo de interrupci\u00f3n heredado, tx_channel_offset estaba codificado en 1, pero eso no es correcto si efx_sepparate_tx_channels es falso. En ese caso, el desplazamiento es 0 porque las colas de transmisi\u00f3n est\u00e1n en el \u00fanico canal existente en el \u00edndice 0, junto con la cola de recepci\u00f3n. Sin esta soluci\u00f3n, tan pronto como intenta enviar tr\u00e1fico, intenta obtener las colas de transmisi\u00f3n de un canal no inicializado y obtiene estos errores: ADVERTENCIA: CPU: 1 PID: 0 en drivers/net/ethernet/sfc/tx.c: 540 efx_hard_start_xmit+0x12e/0x170 [sfc] [...] RIP: 0010:efx_hard_start_xmit+0x12e/0x170 [sfc] [...] Seguimiento de llamadas: dev_hard_start_xmit+0xd7/0x230 sch_direct_xmit+0x9f/0x360 +0x890 /0xa40 [...] ERROR: no se puede manejar la desreferencia del puntero NULL del kernel en 0000000000000020 [...] RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc] [...] Seguimiento de llamadas: dev_hard_start_xmit+0xd7/ 0x230 sch_direct_xmit+0x9f/0x360 __dev_queue_xmit+0x890/0xa40 [...]"
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48648.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix null pointer dereference in efx_hard_start_xmit\n\nTrying to get the channel from the tx_queue variable here is wrong\nbecause we can only be here if tx_queue is NULL, so we shouldn't\ndereference it. As the above comment in the code says, this is very\nunlikely to happen, but it's wrong anyway so let's fix it.\n\nI hit this issue because of a different bug that caused tx_queue to be\nNULL. If that happens, this is the error message that we get here:\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000020\n [...]\n RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sfc: corrige la desreferencia del puntero nulo en efx_hard_start_xmit Intentar obtener el canal de la variable tx_queue aqu\u00ed es incorrecto porque solo podemos estar aqu\u00ed si tx_queue es NULL, por lo que no debemos desreferenciarlo. Como dice el comentario anterior en el c\u00f3digo, es muy poco probable que esto suceda, pero de todos modos est\u00e1 mal, as\u00ed que solucion\u00e9moslo. Encontr\u00e9 este problema debido a un error diferente que provoc\u00f3 que tx_queue fuera NULL. Si eso sucede, este es el mensaje de error que recibimos aqu\u00ed: ERROR: no se puede manejar la desreferencia del puntero NULL del kernel en 0000000000000020 [...] RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]"
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48649.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab_common: fix possible double free of kmem_cache\n\nWhen doing slub_debug test, kfence's 'test_memcache_typesafe_by_rcu'\nkunit test case cause a use-after-free error:\n\n BUG: KASAN: use-after-free in kobject_del+0x14/0x30\n Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261\n\n CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G B N 6.0.0-rc5-next-20220916 #17\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n Call Trace:\n <TASK>\n dump_stack_lvl+0x34/0x48\n print_address_description.constprop.0+0x87/0x2a5\n print_report+0x103/0x1ed\n kasan_report+0xb7/0x140\n kobject_del+0x14/0x30\n kmem_cache_destroy+0x130/0x170\n test_exit+0x1a/0x30\n kunit_try_run_case+0xad/0xc0\n kunit_generic_run_threadfn_adapter+0x26/0x50\n kthread+0x17b/0x1b0\n </TASK>\n\nThe cause is inside kmem_cache_destroy():\n\nkmem_cache_destroy\n acquire lock/mutex\n shutdown_cache\n schedule_work(kmem_cache_release) (if RCU flag set)\n release lock/mutex\n kmem_cache_release (if RCU flag not set)\n\nIn some certain timing, the scheduled work could be run before\nthe next RCU flag checking, which can then get a wrong value\nand lead to double kmem_cache_release().\n\nFix it by caching the RCU flag inside protected area, just like 'refcnt'"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/slab_common: correcci\u00f3n posible doble liberaci\u00f3n de kmem_cache Al realizar la prueba slub_debug, el caso de prueba kunit 'test_memcache_typesafe_by_rcu' de kfence causa un error de use-after-free: ERROR: KASAN: uso despu\u00e9s -free en kobject_del+0x14/0x30 Lectura de tama\u00f1o 8 en addr ffff888007679090 por tarea kunit_try_catch/261 CPU: 1 PID: 261 Comm: kunit_try_catch Contaminado: GBN 6.0.0-rc5-next-20220916 #17 Nombre de hardware: PC est\u00e1ndar QEMU ( I440FX+PIIX, 1996), BIOS 1.15.0-1 04/01/2014 TRACE DE LLAMADA: dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x87/0x2a5 print_rePort+0x103/0x1ed kasan_report+0xb7/0x140/0x140/0x140+0xb7/0x140/0x140/0x140/0x14/0x140/0xil 0x14/0x30 kmem_cache_destroy+0x130/0x170 test_exit+0x1a/0x30 kunit_try_run_case+0xad/0xc0 kunit_generic_run_threadfn_adapter+0x26/0x50 kthread+0x17b/0x1b0 La causa est\u00e1 dentro de kmem_cache_destroy (): kmem_cache_destroy adquirir bloqueo/mutex Shutdown_cache Schedule_work(kmem_cache_release) (si el indicador RCU est\u00e1 establecido) liberar bloqueo/mutex kmem_cache_release (si el indicador RCU no est\u00e1 establecido) En un momento determinado, el trabajo programado podr\u00eda ejecutarse antes de la siguiente verificaci\u00f3n del indicador RCU, lo que luego puede obtener un valor incorrecto y provocar un doble kmem_cache_release() . Solucionarlo almacenando en cach\u00e9 la bandera RCU dentro del \u00e1rea protegida, como 'refcnt'"
}
],
"metrics": {},

6
CVE-2022/CVE-2022-486xx/CVE-2022-48650.json
View File

@ -3,11 +3,15 @@
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-04-28T13:15:07.380",
"lastModified": "2024-04-29T12:42:03.667",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()\n\nCommit 8f394da36a36 (\"scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG\")\nmade the __qlt_24xx_handle_abts() function return early if\ntcm_qla2xxx_find_cmd_by_tag() didn't find a command, but it missed to clean\nup the allocated memory for the management command."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: scsi: qla2xxx: Reparar p\u00e9rdida de memoria en __qlt_24xx_handle_abts() el commit 8f394da36a36 (\"scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG\") hizo que la funci\u00f3n __qlt_24xx_handle_abts() regresara antes si tcm_qla2xxx_find_cmd_by_tag() no lo hizo encontr\u00f3 un comando, pero no pudo limpiar la memoria asignada para el comando de administraci\u00f3n."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48651.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: Fix out-of-bound bugs caused by unset skb->mac_header\n\nIf an AF_PACKET socket is used to send packets through ipvlan and the\ndefault xmit function of the AF_PACKET socket is changed from\ndev_queue_xmit() to packet_direct_xmit() via setsockopt() with the option\nname of PACKET_QDISC_BYPASS, the skb->mac_header may not be reset and\nremains as the initial value of 65535, this may trigger slab-out-of-bounds\nbugs as following:\n\n=================================================================\nUG: KASAN: slab-out-of-bounds in ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]\nPU: 2 PID: 1768 Comm: raw_send Kdump: loaded Not tainted 6.0.0-rc4+ #6\nardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33\nall Trace:\nprint_address_description.constprop.0+0x1d/0x160\nprint_report.cold+0x4f/0x112\nkasan_report+0xa3/0x130\nipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]\nipvlan_start_xmit+0x29/0xa0 [ipvlan]\n__dev_direct_xmit+0x2e2/0x380\npacket_direct_xmit+0x22/0x60\npacket_snd+0x7c9/0xc40\nsock_sendmsg+0x9a/0xa0\n__sys_sendto+0x18a/0x230\n__x64_sys_sendto+0x74/0x90\ndo_syscall_64+0x3b/0x90\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe root cause is:\n 1. packet_snd() only reset skb->mac_header when sock->type is SOCK_RAW\n and skb->protocol is not specified as in packet_parse_headers()\n\n 2. packet_direct_xmit() doesn't reset skb->mac_header as dev_queue_xmit()\n\nIn this case, skb->mac_header is 65535 when ipvlan_xmit_mode_l2() is\ncalled. So when ipvlan_xmit_mode_l2() gets mac header with eth_hdr() which\nuse \"skb->head + skb->mac_header\", out-of-bound access occurs.\n\nThis patch replaces eth_hdr() with skb_eth_hdr() in ipvlan_xmit_mode_l2()\nand reset mac header in multicast to solve this out-of-bound bug."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ipvlan: corrige errores fuera de los l\u00edmites causados por skb-&gt;mac_header no configurado si se usa un socket AF_PACKET para enviar paquetes a trav\u00e9s de ipvlan y se cambia la funci\u00f3n xmit predeterminada del socket AF_PACKET desde dev_queue_xmit() a paquete_direct_xmit() a trav\u00e9s de setsockopt() con el nombre de opci\u00f3n PACKET_QDISC_BYPASS, es posible que skb-&gt;mac_header no se restablezca y permanezca en el valor inicial de 65535, esto puede desencadenar errores de losa fuera de los l\u00edmites como se muestra a continuaci\u00f3n : =================================================== ================ UG: KASAN: losa fuera de los l\u00edmites en ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan] PU: 2 PID: 1768 Comm: raw_send Kdump: cargado No contaminado 6.0.0-rc4+ #6 nombre de hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 todo Seguimiento: print_address_description.constprop.0+0x1d/0x160 print_report.cold+0x4f/0x112 kasan_report+ 0xa3/0x130 ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan] ipvlan_start_xmit+0x29/0xa0 [ipvlan] __dev_direct_xmit+0x2e2/0x380 paquete_direct_xmit+0x22/0x60 paquete_snd+0x7c9/0xc40 0x9a/0xa0 __sys_sendto+0x18a/0x230 __x64_sys_sendto+0x74/0x90 do_syscall_64 +0x3b/0x90 Entry_SYSCALL_64_after_hwframe+0x63/0xcd La causa principal es: 1. paquete_snd() solo restablece skb-&gt;mac_header cuando sock-&gt;tipo es SOCK_RAW y skb-&gt;protocolo no se especifica como en paquete_parse_headers() 2. paquete_direct_xmit() no restablece skb-&gt;mac_header como dev_queue_xmit() En este caso, skb-&gt;mac_header es 65535 cuando se llama a ipvlan_xmit_mode_l2(). Entonces, cuando ipvlan_xmit_mode_l2() obtiene el encabezado mac con eth_hdr() que usa \"skb-&gt;head + skb-&gt;mac_header\", se produce un acceso fuera de los l\u00edmites. Este parche reemplaza eth_hdr() con skb_eth_hdr() en ipvlan_xmit_mode_l2() y restablece el encabezado de mac en multidifusi\u00f3n para resolver este error fuera de los l\u00edmites."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48652.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix crash by keep old cfg when update TCs more than queues\n\nThere are problems if allocated queues less than Traffic Classes.\n\nCommit a632b2a4c920 (\"ice: ethtool: Prohibit improper channel config\nfor DCB\") already disallow setting less queues than TCs.\n\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\n\n[ 95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[ 95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[ 95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[ 95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[ 95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G U W O --------- -t - 4.18.0 #1\n[ 95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[ 95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[ 95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 <8b> 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[ 95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[ 95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[ 95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[ 95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[ 95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[ 95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[ 95.970981] FS: 00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[ 95.971108] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[ 95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 95.971530] PKRU: 55555554\n[ 95.971573] Call Trace:\n[ 95.971622] ice_setup_rx_ring+0x39/0x110 [ice]\n[ 95.971695] ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[ 95.971774] ice_vsi_open+0x25/0x120 [ice]\n[ 95.971843] ice_open_internal+0xb8/0x1f0 [ice]\n[ 95.971919] ice_ena_vsi+0x4f/0xd0 [ice]\n[ 95.971987] ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[ 95.972082] ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[ 95.972154] ice_dcbnl_setets+0x174/0x1b0 [ice]\n[ 95.972220] dcbnl_ieee_set+0x89/0x230\n[ 95.972279] ? dcbnl_ieee_del+0x150/0x150\n[ 95.972341] dcb_doit+0x124/0x1b0\n[ 95.972392] rtnetlink_rcv_msg+0x243/0x2f0\n[ 95.972457] ? dcb_doit+0x14d/0x1b0\n[ 95.972510] ? __kmalloc_node_track_caller+0x1d3/0x280\n[ 95.972591] ? rtnl_calcit.isra.31+0x100/0x100\n[ 95.972661] netlink_rcv_skb+0xcf/0xf0\n[ 95.972720] netlink_unicast+0x16d/0x220\n[ 95.972781] netlink_sendmsg+0x2ba/0x3a0\n[ 95.975891] sock_sendmsg+0x4c/0x50\n[ 95.979032] ___sys_sendmsg+0x2e4/0x300\n[ 95.982147] ? kmem_cache_alloc+0x13e/0x190\n[ 95.985242] ? __wake_up_common_lock+0x79/0x90\n[ 95.988338] ? __check_object_size+0xac/0x1b0\n[ 95.991440] ? _copy_to_user+0x22/0x30\n[ 95.994539] ? move_addr_to_user+0xbb/0xd0\n[ 95.997619] ? __sys_sendmsg+0x53/0x80\n[ 96.000664] __sys_sendmsg+0x53/0x80\n[ 96.003747] do_syscall_64+0x5b/0x1d0\n[ 96.006862] entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: se corrige el fallo manteniendo cfg antiguo cuando se actualizan TC m\u00e1s que colas. Hay problemas si se asignan colas con menos clases de tr\u00e1fico. el commit a632b2a4c920 (\"ice: ethtool: Prohibir configuraci\u00f3n de canal incorrecta para DCB\") ya no permite configurar menos colas que los TC. Otro caso es si primero configuramos menos colas y luego actualizamos m\u00e1s configuraciones de TC debido a LLDP, ice_vsi_cfg_tc() fallar\u00e1 pero dejar\u00e1 num_txq/rxq y tc_cfg sucios en vsi, lo que provocar\u00e1 un acceso al puntero no v\u00e1lido. [ 95.968089] ice 0000:3b:00.1: M\u00e1s TC definidos que colas/anillos asignados. [ 95.968092] ice 0000:3b:00.1: \u00a1Intentando utilizar m\u00e1s colas de Rx (8) de las asignadas (1)! [ 95.968093] ice 0000:3b:00.1: Error al configurar TC para \u00edndice VSI: 0 [ 95.969621] falla de protecci\u00f3n general: 0000 [#1] SMP NOPTI [ 95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: cargado Contaminado: GUWO --------- -t - 4.18.0 #1 [ 95.969867] Nombre de hardware: OEM/BC11SPSCB10, BIOS 8.23 30/12/2021 [ 95.969992] RIP: 0010:devm_kmalloc+0xa/0x60 [ 95.970052] C\u00f3digo: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 &lt;8b&gt; 97 0 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c [ 95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206 [ 95.970425] RAX: muerto0000000 00200 RBX: ffffea003c425b00 RCX: 00000000006080c0 [ 95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: muerto000000000200 [ 95.970648] RBP: muerto000000000200 R08: 00000000000463c0 R09: ffff888ffa900000 [ 95.970760] R10: 0000000000000000 R11: 00000000000002 R12: ffff888ff6b40100 [ 95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460 [ 95.970981] FS: 1b7d24700(0000) GS: ffff88903ee80000(0000) knlGS:00000000000000000 [ 95.971108] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.971197] CR2: 10 CR3: 0000000f2c1de002 CR4: 00000000007606e0 [ 95.971309] DR0: 0000000000000000 DR1: 00000000000000000 DR2: 0000000000000000 [ 95.971419 ] DR3 : 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 95.971530] PKRU: 55555554 [ 95.971573] Seguimiento de llamadas: [ 95.971622] x110 [hielo] [ 95.971695] ice_vsi_setup_rx_rings+0x54/0x90 [hielo] [ 95.971774] ice_vsi_open+0x25/0x120 [hielo] [ 95.971843] ice_open_internal+0xb8/0x1f0 [hielo] [ 95.971919] ice_ena_vsi+0x4f/0xd0 [hielo] [ 95.971987] ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [hielo] [ 95.972082] f_dcb_cfg+0x29a/0x380 [hielo ] [ 95.972154] ice_dcbnl_setets+0x174/0x1b0 [hielo] [ 95.972220] dcbnl_ieee_set+0x89/0x230 [ 95.972279] ? dcbnl_ieee_del+0x150/0x150 [ 95.972341] dcb_doit+0x124/0x1b0 [ 95.972392] rtnetlink_rcv_msg+0x243/0x2f0 [ 95.972457] ? dcb_doit+0x14d/0x1b0 [95.972510]? __kmalloc_node_track_caller+0x1d3/0x280 [95.972591]? rtnl_calcit.isra.31+0x100/0x100 [ 95.972661] netlink_rcv_skb+0xcf/0xf0 [ 95.972720] netlink_unicast+0x16d/0x220 [ 95.972781] netlink_sendmsg+0x2ba/0x3a0 [ 95.975 891] sock_sendmsg+0x4c/0x50 [ 95.979032] ___sys_sendmsg+0x2e4/0x300 [ 95.982147] ? kmem_cache_alloc+0x13e/0x190 [95.985242]? __wake_up_common_lock+0x79/0x90 [95.988338]? __check_object_size+0xac/0x1b0 [ 95.991440] ? _copiar_al_usuario+0x22/0x30 [ 95.994539] ? move_addr_to_user+0xbb/0xd0 [95.997619]? __sys_sendmsg+0x53/0x80 [ 96.000664] __sys_sendmsg+0x53/0x80 [ 96.003747] do_syscall_64+0x5b/0x1d0 [ 96.006862] Entry_SYSCALL_64_after_hwframe+0x65/0xca Solo actualizaci\u00f3n num_txq/rxq cuando se pasa la verificaci\u00f3n y restaura tc_cfg si falla el mapa de cola de configuraci\u00f3n."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48653.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Don't double unplug aux on peer initiated reset\n\nIn the IDC callback that is accessed when the aux drivers request a reset,\nthe function to unplug the aux devices is called. This function is also\ncalled in the ice_prepare_for_reset function. This double call is causing\na \"scheduling while atomic\" BUG.\n\n[ 662.676430] ice 0000:4c:00.0 rocep76s0: cqp opcode = 0x1 maj_err_code = 0xffff min_err_code = 0x8003\n\n[ 662.676609] ice 0000:4c:00.0 rocep76s0: [Modify QP Cmd Error][op_code=8] status=-29 waiting=1 completion_err=1 maj=0xffff min=0x8003\n\n[ 662.815006] ice 0000:4c:00.0 rocep76s0: ICE OICR event notification: oicr = 0x10000003\n\n[ 662.815014] ice 0000:4c:00.0 rocep76s0: critical PE Error, GLPE_CRITERR=0x00011424\n\n[ 662.815017] ice 0000:4c:00.0 rocep76s0: Requesting a reset\n\n[ 662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002\n\n[ 662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002\n[ 662.815477] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill 8021q garp mrp stp llc vfat fat rpcrdma intel_rapl_msr intel_rapl_common sunrpc i10nm_edac rdma_ucm nfit ib_srpt libnvdimm ib_isert iscsi_target_mod x86_pkg_temp_thermal intel_powerclamp coretemp target_core_mod snd_hda_intel ib_iser snd_intel_dspcfg libiscsi snd_intel_sdw_acpi scsi_transport_iscsi kvm_intel iTCO_wdt rdma_cm snd_hda_codec kvm iw_cm ipmi_ssif iTCO_vendor_support snd_hda_core irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hwdep snd_seq snd_seq_device rapl snd_pcm snd_timer isst_if_mbox_pci pcspkr isst_if_mmio irdma intel_uncore idxd acpi_ipmi joydev isst_if_common snd mei_me idxd_bus ipmi_si soundcore i2c_i801 mei ipmi_devintf i2c_smbus i2c_ismt ipmi_msghandler acpi_power_meter acpi_pad rv(OE) ib_uverbs ib_cm ib_core xfs libcrc32c ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helpe\n r ttm\n[ 662.815546] nvme nvme_core ice drm crc32c_intel i40e t10_pi wmi pinctrl_emmitsburg dm_mirror dm_region_hash dm_log dm_mod fuse\n[ 662.815557] Preemption disabled at:\n[ 662.815558] [<0000000000000000>] 0x0\n[ 662.815563] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Tainted: G S OE 5.17.1 #2\n[ 662.815566] Hardware name: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 11/02/2021\n[ 662.815568] Call Trace:\n[ 662.815572] <IRQ>\n[ 662.815574] dump_stack_lvl+0x33/0x42\n[ 662.815581] __schedule_bug.cold.147+0x7d/0x8a\n[ 662.815588] __schedule+0x798/0x990\n[ 662.815595] schedule+0x44/0xc0\n[ 662.815597] schedule_preempt_disabled+0x14/0x20\n[ 662.815600] __mutex_lock.isra.11+0x46c/0x490\n[ 662.815603] ? __ibdev_printk+0x76/0xc0 [ib_core]\n[ 662.815633] device_del+0x37/0x3d0\n[ 662.815639] ice_unplug_aux_dev+0x1a/0x40 [ice]\n[ 662.815674] ice_schedule_reset+0x3c/0xd0 [ice]\n[ 662.815693] irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma]\n[ 662.815712] ? bitmap_find_next_zero_area_off+0x45/0xa0\n[ 662.815719] ice_send_event_to_aux+0x54/0x70 [ice]\n[ 662.815741] ice_misc_intr+0x21d/0x2d0 [ice]\n[ 662.815756] __handle_irq_event_percpu+0x4c/0x180\n[ 662.815762] handle_irq_event_percpu+0xf/0x40\n[ 662.815764] handle_irq_event+0x34/0x60\n[ 662.815766] handle_edge_irq+0x9a/0x1c0\n[ 662.815770] __common_interrupt+0x62/0x100\n[ 662.815774] common_interrupt+0xb4/0xd0\n[ 662.815779] </IRQ>\n[ 662.815780] <TASK>\n[ 662.815780] asm_common_interrupt+0x1e/0x40\n[ 662.815785] RIP: 0010:cpuidle_enter_state+0xd6/0x380\n[ 662.815789] Code: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 00 31 ff e8 ae c5 9c ff fb 45 85 f6 <0f> 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49\n[ 662.815791] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 00000202\n[ 662.815793] RAX: ff280805df140000 RBX: 0000000000000002 RCX: 000000000000001f\n[ 662.815795] RDX: 0000009a52da2d08 R\n---truncated---"
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ice: no desconectar dos veces el auxiliar en el reinicio iniciado por el par. En la devoluci\u00f3n de llamada de IDC a la que se accede cuando los controladores auxiliares solicitan un reinicio, se llama a la funci\u00f3n para desconectar los dispositivos auxiliares. Esta funci\u00f3n tambi\u00e9n se llama en la funci\u00f3n ice_prepare_for_reset. Esta doble llamada est\u00e1 provocando un ERROR de \"programaci\u00f3n at\u00f3mica\". [662.676430] ice 0000:4c:00.0 rocep76s0: cqp opcode = 0x1 maj_err_code = 0xffff min_err_code = 0x8003 [662.676609] ice 0000:4c:00.0 rocep76s0: [Modificar error de comando QP][op_code=8] =-29 esperando=1 complete_err=1 maj=0xffff min=0x8003 [662.815006] ice 0000:4c:00.0 rocep76s0: Notificaci\u00f3n de evento ICE OICR: oicr = 0x10000003 [662.815014] ice 0000:4c:00.0 rocep76s0: Error PE cr\u00edtico, GLPE_CRITERR= 0x00011424 [662.815017] hielo 0000:4c:00.0 rocep76s0: Solicitando un reinicio [662.815475] ERROR: programaci\u00f3n mientras at\u00f3mico: swapper/37/0/0x00010002 [662.815475] ERROR: programaci\u00f3n mientras at\u00f3mico: swapper/37/0/0x00010002 [ 662.815477] M\u00f3dulos vinculados en: rpcsec_gss_krb5 aut\u00e9ntico x86_pkg_temp_thermal intel_powerclamp coretemp target_core_mod snd_hda_intel ib_iser snd_intel_dspcfg libiscsi snd_intel_sdw_acpi scsi_transport_iscsi kvm_intel iTCO_wdt rdma_cm snd_hda_codec kvm iw_cm ipmi_ssif iTCO_vendor_support s nd_hda_core irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hwdep snd_seq snd_seq_device rapl snd_pcm snd_timer isst_if_mbox_pci pcspkr isst_if_mmio irdma intel_uncore idxd acpi_ipmi joydev isst_if_common snd mei_me idxd_bus ipmi_si soundcore i2c_i801 mei i2c_smbus i2c_ismt ipmi_msghandler acpi_power_meter acpi_pad rv(OE) ib_uverbs ib_cm ib_core xfs libcrc32c ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helpe r ttm [ 662.815546 ] nvme nvme_core ice drm crc32c_intel i40e t10_pi wmi pinctrl_emmitsburg dm_mirror dm_region_hash dm_log dm_mod fuse [ 662.815557] Preferencia deshabilitada en: [ 662.815558] [&lt;0000000000000000&gt;] 0x0 [ 6 62.815563] CPU: 37 PID: 0 Comunicaciones: intercambiador/37 Kdump: cargado Contaminado: GS OE 5.17.1 #2 [ 662.815566] Nombre del hardware: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 02/11/2021 [ 662.815568] Seguimiento de llamadas: [ 662.815572] [ 662 .815574] dump_stack_lvl +0x33/0x42 [ 662.815581] __schedule_bug.cold.147+0x7d/0x8a [ 662.815588] __schedule+0x798/0x990 [ 662.815595] horario+0x44/0xc0 [ 662.815597] +0x14/0x20 [ 662.815600] __mutex_lock.isra.11+0x46c /0x490 [662.815603] ? __ibdev_printk+0x76/0xc0 [ib_core] [ 662.815633] dispositivo_del+0x37/0x3d0 [ 662.815639] ice_unplug_aux_dev+0x1a/0x40 [ice] [ 662.815674] ice_schedule_reset+0x3c/0xd0 [ice] [ 2.815693] irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma] [662.815712] ? bitmap_find_next_zero_area_off+0x45/0xa0 [ 662.815719] ice_send_event_to_aux+0x54/0x70 [ice] [ 662.815741] ice_misc_intr+0x21d/0x2d0 [ice] [ 662.815756] pu+0x4c/0x180 [ 662.815762] handle_irq_event_percpu+0xf/0x40 [ 662.815764] handle_irq_event+0x34/ 0x60 [ 662.815766] handle_edge_irq+0x9a/0x1c0 [ 662.815770] __common_interrupt+0x62/0x100 [ 662.815774] common_interrupt+0xb4/0xd0 [ 662.815779] [ 662.81578 0] [ 662.815780] asm_common_interrupt+0x1e/0x40 [ 662.815785] RIP : 0010:cpuidle_enter_state+0xd6/0x380 [ 662.815789] C\u00f3digo: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 31 ff e8 ae c5 9c ff fb 45 85 f6 &lt;0f&gt; 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49 [ 662.815791] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 0202 [662.815793] RAX: ff280805df140000 RBX: 0000000000000002 RCX : 000000000000001f [ 662.815795] RDX: 0000009a52da2d08 R ---truncado---"
}
],
"metrics": {},

6
CVE-2022/CVE-2022-486xx/CVE-2022-48654.json
View File

@ -3,11 +3,15 @@
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-04-28T13:15:07.580",
"lastModified": "2024-04-29T12:42:03.667",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()\n\nnf_osf_find() incorrectly returns true on mismatch, this leads to\ncopying uninitialized memory area in nft_osf which can be used to leak\nstale kernel stack data to userspace."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nfnetlink_osf: corrige una posible coincidencia falsa en nf_osf_find() nf_osf_find() devuelve verdadero incorrectamente en caso de discrepancia, esto lleva a copiar el \u00e1rea de memoria no inicializada en nft_osf que puede usarse para filtrar el kernel obsoleto apilar datos en el espacio de usuario."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48655.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Harden accesses to the reset domains\n\nAccessing reset domains descriptors by the index upon the SCMI drivers\nrequests through the SCMI reset operations interface can potentially\nlead to out-of-bound violations if the SCMI driver misbehave.\n\nAdd an internal consistency check before any such domains descriptors\naccesses."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_scmi: Refuerza los accesos a los dominios de reinicio. El acceso a los descriptores de dominios de reinicio por el \u00edndice ante las solicitudes de los controladores SCMI a trav\u00e9s de la interfaz de operaciones de reinicio de SCMI puede conducir potencialmente a violaciones fuera de los l\u00edmites. si el controlador SCMI se comporta mal. Agregue una verificaci\u00f3n de coherencia interna antes de que se acceda a dichos descriptores de dominio."
}
],
"metrics": {

6
CVE-2022/CVE-2022-486xx/CVE-2022-48656.json
View File

@ -3,11 +3,15 @@
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-04-28T13:15:07.663",
"lastModified": "2024-04-29T12:42:03.667",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get()\n\nWe should call of_node_put() for the reference returned by\nof_parse_phandle() in fail path or when it is not used anymore.\nHere we only need to move the of_node_put() before the check."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: ti: k3-udma-private: corrige el error de fuga de recuento en of_xudma_dev_get() Deber\u00edamos llamar a of_node_put() para la referencia devuelta por of_parse_phandle() en la ruta de error o cuando ya no se usa. Aqu\u00ed solo necesitamos mover of_node_put() antes de la verificaci\u00f3n."
}
],
"metrics": {},

6
CVE-2022/CVE-2022-486xx/CVE-2022-48657.json
View File

@ -3,11 +3,15 @@
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-04-28T13:15:07.717",
"lastModified": "2024-04-29T12:42:03.667",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: topology: fix possible overflow in amu_fie_setup()\n\ncpufreq_get_hw_max_freq() returns max frequency in kHz as *unsigned int*,\nwhile freq_inv_set_max_ratio() gets passed this frequency in Hz as 'u64'.\nMultiplying max frequency by 1000 can potentially result in overflow --\nmultiplying by 1000ULL instead should avoid that...\n\nFound by Linux Verification Center (linuxtesting.org) with the SVACE static\nanalysis tool."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: topolog\u00eda: corrige posible desbordamiento en amu_fie_setup() cpufreq_get_hw_max_freq() devuelve la frecuencia m\u00e1xima en kHz como *unsigned int*, mientras que freq_inv_set_max_ratio() pasa esta frecuencia en Hz como 'u64 '. Multiplicar la frecuencia m\u00e1xima por 1000 puede potencialmente resultar en un desbordamiento; multiplicar por 1000ULL deber\u00eda evitar eso... Encontrado por el Centro de verificaci\u00f3n de Linux (linuxtesting.org) con la herramienta de an\u00e1lisis est\u00e1tico SVACE."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48658.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context.\n\nCommit 5a836bf6b09f (\"mm: slub: move flush_cpu_slab() invocations\n__free_slab() invocations out of IRQ context\") moved all flush_cpu_slab()\ninvocations to the global workqueue to avoid a problem related\nwith deactivate_slab()/__free_slab() being called from an IRQ context\non PREEMPT_RT kernels.\n\nWhen the flush_all_cpu_locked() function is called from a task context\nit may happen that a workqueue with WQ_MEM_RECLAIM bit set ends up\nflushing the global workqueue, this will cause a dependency issue.\n\n workqueue: WQ_MEM_RECLAIM nvme-delete-wq:nvme_delete_ctrl_work [nvme_core]\n is flushing !WQ_MEM_RECLAIM events:flush_cpu_slab\n WARNING: CPU: 37 PID: 410 at kernel/workqueue.c:2637\n check_flush_dependency+0x10a/0x120\n Workqueue: nvme-delete-wq nvme_delete_ctrl_work [nvme_core]\n RIP: 0010:check_flush_dependency+0x10a/0x120[ 453.262125] Call Trace:\n __flush_work.isra.0+0xbf/0x220\n ? __queue_work+0x1dc/0x420\n flush_all_cpus_locked+0xfb/0x120\n __kmem_cache_shutdown+0x2b/0x320\n kmem_cache_destroy+0x49/0x100\n bioset_exit+0x143/0x190\n blk_release_queue+0xb9/0x100\n kobject_cleanup+0x37/0x130\n nvme_fc_ctrl_free+0xc6/0x150 [nvme_fc]\n nvme_free_ctrl+0x1ac/0x2b0 [nvme_core]\n\nFix this bug by creating a workqueue for the flush operation with\nthe WQ_MEM_RECLAIM bit set."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: slub: corrige las invocaciones de flu_cpu_slab()/__free_slab() en el contexto de la tarea. Commit 5a836bf6b09f (\"mm: slub: mover invocaciones de flu_cpu_slab() invocaciones de __free_slab() fuera del contexto IRQ\") movi\u00f3 todas las invocaciones de flu_cpu_slab() a la cola de trabajo global para evitar un problema relacionado con la llamada de desactivate_slab()/__free_slab() desde un Contexto IRQ en n\u00facleos PREEMPT_RT. Cuando se llama a la funci\u00f3n Flush_all_cpu_locked() desde un contexto de tarea, puede suceder que una cola de trabajo con el bit WQ_MEM_RECLAIM configurado termine vaciando la cola de trabajo global, esto causar\u00e1 un problema de dependencia. cola de trabajo: WQ_MEM_RECLAIM nvme-delete-wq:nvme_delete_ctrl_work [nvme_core] se est\u00e1 vaciando! Eventos WQ_MEM_RECLAIM:flush_cpu_slab ADVERTENCIA: CPU: 37 PID: 410 en kernel/workqueue.c:2637 check_flush_dependency+0x10a/0x120 Cola de trabajo: vme-delete-wq nvme_delete_ctrl_work [ nvme_core] RIP: 0010:check_flush_dependency+0x10a/0x120[ 453.262125] Seguimiento de llamadas: __flush_work.isra.0+0xbf/0x220? __queue_work+0x1dc/0x420 Flush_all_cpus_locked+0xfb/0x120 __kmem_cache_shutdown+0x2b/0x320 kmem_cache_destroy+0x49/0x100 bioset_exit+0x143/0x190 blk_release_queue+0xb9/0x100 kobject_cleanup+0 x37/0x130 nvme_fc_ctrl_free+0xc6/0x150 [nvme_fc] nvme_free_ctrl+0x1ac/0x2b0 [nvme_core ] Corrija este error creando una cola de trabajo para la operaci\u00f3n de vaciado con el bit WQ_MEM_RECLAIM establecido."
}
],
"metrics": {

4
CVE-2022/CVE-2022-486xx/CVE-2022-48659.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: fix to return errno if kmalloc() fails\n\nIn create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to\nout-of-memory, if it fails, return errno correctly rather than\ntriggering panic via BUG_ON();\n\nkernel BUG at mm/slub.c:5893!\nInternal error: Oops - BUG: 0 [#1] PREEMPT SMP\n\nCall trace:\n sysfs_slab_add+0x258/0x260 mm/slub.c:5973\n __kmem_cache_create+0x60/0x118 mm/slub.c:4899\n create_cache mm/slab_common.c:229 [inline]\n kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335\n kmem_cache_create+0x1c/0x28 mm/slab_common.c:390\n f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline]\n f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808\n f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149\n mount_bdev+0x1b8/0x210 fs/super.c:1400\n f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512\n legacy_get_tree+0x30/0x74 fs/fs_context.c:610\n vfs_get_tree+0x40/0x140 fs/super.c:1530\n do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040\n path_mount+0x358/0x914 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/slub: correcci\u00f3n para devolver errno si kmalloc() falla. En create_unique_id(), kmalloc(, GFP_KERNEL) puede fallar debido a falta de memoria, si falla, regrese errno correctamente en lugar de provocar p\u00e1nico mediante BUG_ON(); \u00a1ERROR del kernel en mm/slub.c:5893! Error interno: Ups - ERROR: 0 [#1] Seguimiento de llamada SMP PREEMPT: sysfs_slab_add+0x258/0x260 mm/slub.c:5973 __kmem_cache_create+0x60/0x118 mm/slub.c:4899 create_cache mm/slab_common.c:229 [ en l\u00ednea] kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335 kmem_cache_create+0x1c/0x28 mm/slab_common.c:390 f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [en l\u00ednea] f2fs_init_xattr_caches+0x 78/0xb4 fs/f2fs/xattr. c:808 f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149 mount_bdev+0x1b8/0x210 fs/super.c:1400 f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512 Legacy_get_tree+0x30/0x74 fs/ fs_context.c:610 vfs_get_tree+0x40/0x140 fs/super.c:1530 do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040 path_mount+0x358/0x914 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [ en l\u00ednea] __do_sys_mount fs/namespace.c:3591 [en l\u00ednea] __se_sys_mount fs/namespace.c:3568 [en l\u00ednea] __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568"
}
],
"metrics": {

4
CVE-2022/CVE-2022-486xx/CVE-2022-48660.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpiolib: cdev: Set lineevent_state::irq after IRQ register successfully\n\nWhen running gpio test on nxp-ls1028 platform with below command\ngpiomon --num-events=3 --rising-edge gpiochip1 25\nThere will be a warning trace as below:\nCall trace:\nfree_irq+0x204/0x360\nlineevent_free+0x64/0x70\ngpio_ioctl+0x598/0x6a0\n__arm64_sys_ioctl+0xb4/0x100\ninvoke_syscall+0x5c/0x130\n......\nel0t_64_sync+0x1a0/0x1a4\nThe reason of this issue is that calling request_threaded_irq()\nfunction failed, and then lineevent_free() is invoked to release\nthe resource. Since the lineevent_state::irq was already set, so\nthe subsequent invocation of free_irq() would trigger the above\nwarning call trace. To fix this issue, set the lineevent_state::irq\nafter the IRQ register successfully."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: gpiolib: cdev: configure lineevent_state::irq despu\u00e9s del registro IRQ con \u00e9xito Al ejecutar la prueba gpio en la plataforma nxp-ls1028 con el siguiente comando gpiomon --num-events=3 --rising-edge gpiochip1 25 Habr\u00e1 un seguimiento de advertencia como se muestra a continuaci\u00f3n: Seguimiento de llamada: free_irq+0x204/0x360 lineevent_free+0x64/0x70 gpio_ioctl+0x598/0x6a0 __arm64_sys_ioctl+0xb4/0x100 invoke_syscall+0x5c/0x130 ...... 0x1a0/0x1a4 El motivo de este problema es que fall\u00f3 la llamada a la funci\u00f3n request_threaded_irq() y luego se invoca lineevent_free() para liberar el recurso. Dado que lineevent_state::irq ya estaba configurado, la invocaci\u00f3n posterior de free_irq() activar\u00eda el seguimiento de llamada de advertencia anterior. Para solucionar este problema, configure lineevent_state::irq despu\u00e9s del registro IRQ correctamente."
}
],
"metrics": {

4
CVE-2022/CVE-2022-486xx/CVE-2022-48661.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mockup: Fix potential resource leakage when register a chip\n\nIf creation of software node fails, the locally allocated string\narray is left unfreed. Free it on error path."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: gpio: maqueta: corrige una posible fuga de recursos al registrar un chip. Si falla la creaci\u00f3n del nodo de software, la matriz de cadenas asignada localmente queda sin liberar. Lib\u00e9relo en la ruta de error."
}
],
"metrics": {

4
CVE-2022/CVE-2022-486xx/CVE-2022-48662.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Really move i915_gem_context.link under ref protection\n\ni915_perf assumes that it can use the i915_gem_context reference to\nprotect its i915->gem.contexts.list iteration. However, this requires\nthat we do not remove the context from the list until after we drop the\nfinal reference and release the struct. If, as currently, we remove the\ncontext from the list during context_close(), the link.next pointer may\nbe poisoned while we are holding the context reference and cause a GPF:\n\n[ 4070.573157] i915 0000:00:02.0: [drm:i915_perf_open_ioctl [i915]] filtering on ctx_id=0x1fffff ctx_id_mask=0x1fffff\n[ 4070.574881] general protection fault, probably for non-canonical address 0xdead000000000100: 0000 [#1] PREEMPT SMP\n[ 4070.574897] CPU: 1 PID: 284392 Comm: amd_performance Tainted: G E 5.17.9 #180\n[ 4070.574903] Hardware name: Intel Corporation NUC7i5BNK/NUC7i5BNB, BIOS BNKBL357.86A.0052.2017.0918.1346 09/18/2017\n[ 4070.574907] RIP: 0010:oa_configure_all_contexts.isra.0+0x222/0x350 [i915]\n[ 4070.574982] Code: 08 e8 32 6e 10 e1 4d 8b 6d 50 b8 ff ff ff ff 49 83 ed 50 f0 41 0f c1 04 24 83 f8 01 0f 84 e3 00 00 00 85 c0 0f 8e fa 00 00 00 <49> 8b 45 50 48 8d 70 b0 49 8d 45 50 48 39 44 24 10 0f 85 34 fe ff\n[ 4070.574990] RSP: 0018:ffffc90002077b78 EFLAGS: 00010202\n[ 4070.574995] RAX: 0000000000000002 RBX: 0000000000000002 RCX: 0000000000000000\n[ 4070.575000] RDX: 0000000000000001 RSI: ffffc90002077b20 RDI: ffff88810ddc7c68\n[ 4070.575004] RBP: 0000000000000001 R08: ffff888103242648 R09: fffffffffffffffc\n[ 4070.575008] R10: ffffffff82c50bc0 R11: 0000000000025c80 R12: ffff888101bf1860\n[ 4070.575012] R13: dead0000000000b0 R14: ffffc90002077c04 R15: ffff88810be5cabc\n[ 4070.575016] FS: 00007f1ed50c0780(0000) GS:ffff88885ec80000(0000) knlGS:0000000000000000\n[ 4070.575021] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 4070.575025] CR2: 00007f1ed5590280 CR3: 000000010ef6f005 CR4: 00000000003706e0\n[ 4070.575029] Call Trace:\n[ 4070.575033] <TASK>\n[ 4070.575037] lrc_configure_all_contexts+0x13e/0x150 [i915]\n[ 4070.575103] gen8_enable_metric_set+0x4d/0x90 [i915]\n[ 4070.575164] i915_perf_open_ioctl+0xbc0/0x1500 [i915]\n[ 4070.575224] ? asm_common_interrupt+0x1e/0x40\n[ 4070.575232] ? i915_oa_init_reg_state+0x110/0x110 [i915]\n[ 4070.575290] drm_ioctl_kernel+0x85/0x110\n[ 4070.575296] ? update_load_avg+0x5f/0x5e0\n[ 4070.575302] drm_ioctl+0x1d3/0x370\n[ 4070.575307] ? i915_oa_init_reg_state+0x110/0x110 [i915]\n[ 4070.575382] ? gen8_gt_irq_handler+0x46/0x130 [i915]\n[ 4070.575445] __x64_sys_ioctl+0x3c4/0x8d0\n[ 4070.575451] ? __do_softirq+0xaa/0x1d2\n[ 4070.575456] do_syscall_64+0x35/0x80\n[ 4070.575461] entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 4070.575467] RIP: 0033:0x7f1ed5c10397\n[ 4070.575471] Code: 3c 1c e8 1c ff ff ff 85 c0 79 87 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a9 da 0d 00 f7 d8 64 89 01 48\n[ 4070.575478] RSP: 002b:00007ffd65c8d7a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n[ 4070.575484] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f1ed5c10397\n[ 4070.575488] RDX: 00007ffd65c8d7c0 RSI: 0000000040106476 RDI: 0000000000000006\n[ 4070.575492] RBP: 00005620972f9c60 R08: 000000000000000a R09: 0000000000000005\n[ 4070.575496] R10: 000000000000000d R11: 0000000000000246 R12: 000000000000000a\n[ 4070.575500] R13: 000000000000000d R14: 0000000000000000 R15: 00007ffd65c8d7c0\n[ 4070.575505] </TASK>\n[ 4070.575507] Modules linked in: nls_ascii(E) nls_cp437(E) vfat(E) fat(E) i915(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) crct10dif_pclmul(E) crc32_pclmul(E) crc32c_intel(E) aesni_intel(E) crypto_simd(E) intel_gtt(E) cryptd(E) ttm(E) rapl(E) intel_cstate(E) drm_kms_helper(E) cfbfillrect(E) syscopyarea(E) cfbimgblt(E) intel_uncore(E) sysfillrect(E) mei_me(E) sysimgblt(E) i2c_i801(E) fb_sys_fops(E) mei(E) intel_pch_thermal(E) i2c_smbus\n---truncated---"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/i915/gem: realmente mueva i915_gem_context.link bajo protecci\u00f3n de referencia. i915_perf supone que puede usar la referencia i915_gem_context para proteger su iteraci\u00f3n i915-&gt;gem.contexts.list. Sin embargo, esto requiere que no eliminemos el contexto de la lista hasta que eliminemos la referencia final y liberemos la estructura. Si, como actualmente, eliminamos el contexto de la lista durante context_close(), el puntero link.next puede envenenarse mientras mantenemos la referencia de contexto y provocar un GPF: [ 4070.573157] i915 0000:00:02.0: [drm: i915_perf_open_ioctl [i915]] filtrado en ctx_id=0x1fffff ctx_id_mask=0x1fffff [4070.574881] falla de protecci\u00f3n general, probablemente para direcci\u00f3n no can\u00f3nica 0xdead000000000100: 0000 [#1] PREEMPT SMP [ 4070.574897] : 1 PID: 284392 Comunicaciones: AMD_Performance Contaminado: GE 5.17.9 #180 [ 4070.574903] Nombre del hardware: Intel Corporation NUC7i5BNK/NUC7i5BNB, BIOS BNKBL357.86A.0052.2017.0918.1346 18/09/2017 [ 4070.574907] RIP: oa_configure_all_contexts.is ra.0+0x222/0x350 [i915] [ 4070.574982] C\u00f3digo: 08 e8 32 6e 10 e1 4d 8b 6d 50 b8 ff ff ff ff 49 83 ed 50 f0 41 0f c1 04 24 83 f8 01 0f 84 e3 00 00 00 85 c0 0f 8e fa 00 00 &lt;49&gt; 8b 45 50 48 8d 70 b0 49 8d 45 50 48 39 44 24 10 0f 85 34 fe ff [ 4070.574990] RSP: 0018:ffffc90002077b78 EFLAGS: 00010202 [ 4070.574995] : 0000000000000002 RBX: 0000000000000002 RCX: 0000000000000000 [ 4070.575000] RDX: 0000000000000001 RSI : ffffc90002077b20 RDI: ffff88810ddc7c68 [ 4070.575004] RBP: 0000000000000001 R08: ffff888103242648 R09: ffffffffffffffc [ 4070.575008] R10: 2c50bc0 R11: 0000000000025c80 R12: ffff888101bf1860 [ 4070.575012] R13: muerto0000000000b0 R14: ffffc90002077c04 R15: ffff88810be5cabc [ 4070.57501 6]FS: 00007f1ed50c0780(0000) GS:ffff88885ec80000(0000) knlGS:0000000000000000 [ 4070.575021] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4070.575025] CR2: 5590280 CR3: 000000010ef6f005 CR4: 00000000003706e0 [ 4070.575029] Seguimiento de llamadas: [ 4070.575033] [ 4070.575037 ] lrc_configure_all_contexts+0x13e/0x150 [i915] [ 4070.575103] gen8_enable_metric_set+0x4d/0x90 [i915] [ 4070.575164] i915_perf_open_ioctl+0xbc0/0x1500 [i915] [ 4070.5 75224] ? asm_common_interrupt+0x1e/0x40 [4070.575232]? i915_oa_init_reg_state+0x110/0x110 [i915] [ 4070.575290] drm_ioctl_kernel+0x85/0x110 [ 4070.575296] ? update_load_avg+0x5f/0x5e0 [ 4070.575302] drm_ioctl+0x1d3/0x370 [ 4070.575307] ? i915_oa_init_reg_state+0x110/0x110 [i915] [4070.575382]? gen8_gt_irq_handler+0x46/0x130 [i915] [ 4070.575445] __x64_sys_ioctl+0x3c4/0x8d0 [ 4070.575451] ? __do_softirq+0xaa/0x1d2 [ 4070.575456] do_syscall_64+0x35/0x80 [ 4070.575461] Entry_SYSCALL_64_after_hwframe+0x44/0xae [ 4070.575467] RIP: 0x7f1ed5c10397 [ 4070.575471] C\u00f3digo: 3c 1c e8 1c ff ff ff 85 c0 79 87 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 &lt;48&gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d a9 da 0d 00 f7 d8 64 89 01 48 [ 4070.575478] RSP: 002b:00007ffd65c8d7a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 4070.575484] RAX: ffffffffffffffda RBX: 0000000000000006 X: 00007f1ed5c10397 [ 4070.575488] RDX: 00007ffd65c8d7c0 RSI: 0000000040106476 RDI: 0000000000000006 [ 4070.575492] RBP: 00005620972f9c 60 R08: 000000000000000a R09: 0000000000000005 [ 4070.575496] R10: 000000000000000d R11: 0000000000000246 R12: 000000000000000a [ 4070.575500] R13: 000000000000000d R14: 0000000000 R15: 00007ffd65c8d7c0 [ 4070.575505] [ 4070.575507] M\u00f3dulos vinculados en: nls_ascii(E) nls_cp437(E) vfat(E) fat(E) i915(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) crct10dif_pclmul(E) crc32_pclmul(E) crc32c_intel(E) aesni_intel(E) crypto_simd(E) intel_gtt(E) cryptd(E) ttm(E) rapl( E) intel_cstate(E) drm_kms_helper(E) cfbfillrect(E) syscopyarea(E) cfbimgblt(E) intel_uncore(E) sysfillrect(E) mei_me(E) sysimgblt(E) i2c_i801(E) fb_sys_fops(E) mei(E) intel_pch_thermal(E) i2c_smbus ---truncado---"
}
],
"metrics": {

4
CVE-2022/CVE-2022-486xx/CVE-2022-48663.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mockup: fix NULL pointer dereference when removing debugfs\n\nWe now remove the device's debugfs entries when unbinding the driver.\nThis now causes a NULL-pointer dereference on module exit because the\nplatform devices are unregistered *after* the global debugfs directory\nhas been recursively removed. Fix it by unregistering the devices first."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: gpio: maqueta: corrige la desreferencia del puntero NULL al eliminar debugfs Ahora eliminamos las entradas debugfs del dispositivo al desvincular el controlador. Esto ahora provoca una desreferencia del puntero NULL al salir del m\u00f3dulo porque los dispositivos de la plataforma no est\u00e1n registrados *despu\u00e9s* de que el directorio global debugfs se haya eliminado de forma recursiva. Solucionarlo cancelando el registro de los dispositivos primero."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48664.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix hang during unmount when stopping a space reclaim worker\n\nOften when running generic/562 from fstests we can hang during unmount,\nresulting in a trace like this:\n\n Sep 07 11:52:00 debian9 unknown: run fstests generic/562 at 2022-09-07 11:52:00\n Sep 07 11:55:32 debian9 kernel: INFO: task umount:49438 blocked for more than 120 seconds.\n Sep 07 11:55:32 debian9 kernel: Not tainted 6.0.0-rc2-btrfs-next-122 #1\n Sep 07 11:55:32 debian9 kernel: \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n Sep 07 11:55:32 debian9 kernel: task:umount state:D stack: 0 pid:49438 ppid: 25683 flags:0x00004000\n Sep 07 11:55:32 debian9 kernel: Call Trace:\n Sep 07 11:55:32 debian9 kernel: <TASK>\n Sep 07 11:55:32 debian9 kernel: __schedule+0x3c8/0xec0\n Sep 07 11:55:32 debian9 kernel: ? rcu_read_lock_sched_held+0x12/0x70\n Sep 07 11:55:32 debian9 kernel: schedule+0x5d/0xf0\n Sep 07 11:55:32 debian9 kernel: schedule_timeout+0xf1/0x130\n Sep 07 11:55:32 debian9 kernel: ? lock_release+0x224/0x4a0\n Sep 07 11:55:32 debian9 kernel: ? lock_acquired+0x1a0/0x420\n Sep 07 11:55:32 debian9 kernel: ? trace_hardirqs_on+0x2c/0xd0\n Sep 07 11:55:32 debian9 kernel: __wait_for_common+0xac/0x200\n Sep 07 11:55:32 debian9 kernel: ? usleep_range_state+0xb0/0xb0\n Sep 07 11:55:32 debian9 kernel: __flush_work+0x26d/0x530\n Sep 07 11:55:32 debian9 kernel: ? flush_workqueue_prep_pwqs+0x140/0x140\n Sep 07 11:55:32 debian9 kernel: ? trace_clock_local+0xc/0x30\n Sep 07 11:55:32 debian9 kernel: __cancel_work_timer+0x11f/0x1b0\n Sep 07 11:55:32 debian9 kernel: ? close_ctree+0x12b/0x5b3 [btrfs]\n Sep 07 11:55:32 debian9 kernel: ? __trace_bputs+0x10b/0x170\n Sep 07 11:55:32 debian9 kernel: close_ctree+0x152/0x5b3 [btrfs]\n Sep 07 11:55:32 debian9 kernel: ? evict_inodes+0x166/0x1c0\n Sep 07 11:55:32 debian9 kernel: generic_shutdown_super+0x71/0x120\n Sep 07 11:55:32 debian9 kernel: kill_anon_super+0x14/0x30\n Sep 07 11:55:32 debian9 kernel: btrfs_kill_super+0x12/0x20 [btrfs]\n Sep 07 11:55:32 debian9 kernel: deactivate_locked_super+0x2e/0xa0\n Sep 07 11:55:32 debian9 kernel: cleanup_mnt+0x100/0x160\n Sep 07 11:55:32 debian9 kernel: task_work_run+0x59/0xa0\n Sep 07 11:55:32 debian9 kernel: exit_to_user_mode_prepare+0x1a6/0x1b0\n Sep 07 11:55:32 debian9 kernel: syscall_exit_to_user_mode+0x16/0x40\n Sep 07 11:55:32 debian9 kernel: do_syscall_64+0x48/0x90\n Sep 07 11:55:32 debian9 kernel: entry_SYSCALL_64_after_hwframe+0x63/0xcd\n Sep 07 11:55:32 debian9 kernel: RIP: 0033:0x7fcde59a57a7\n Sep 07 11:55:32 debian9 kernel: RSP: 002b:00007ffe914217c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6\n Sep 07 11:55:32 debian9 kernel: RAX: 0000000000000000 RBX: 00007fcde5ae8264 RCX: 00007fcde59a57a7\n Sep 07 11:55:32 debian9 kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000055b57556cdd0\n Sep 07 11:55:32 debian9 kernel: RBP: 000055b57556cba0 R08: 0000000000000000 R09: 00007ffe91420570\n Sep 07 11:55:32 debian9 kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n Sep 07 11:55:32 debian9 kernel: R13: 000055b57556cdd0 R14: 000055b57556ccb8 R15: 0000000000000000\n Sep 07 11:55:32 debian9 kernel: </TASK>\n\nWhat happens is the following:\n\n1) The cleaner kthread tries to start a transaction to delete an unused\n block group, but the metadata reservation can not be satisfied right\n away, so a reservation ticket is created and it starts the async\n metadata reclaim task (fs_info->async_reclaim_work);\n\n2) Writeback for all the filler inodes with an i_size of 2K starts\n (generic/562 creates a lot of 2K files with the goal of filling\n metadata space). We try to create an inline extent for them, but we\n fail when trying to insert the inline extent with -ENOSPC (at\n cow_file_range_inline()) - since this is not critical, we fallback\n to non-inline mode (back to cow_file_range()), reserve extents\n---truncated---"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige el bloqueo durante el desmontaje al detener un trabajador de recuperaci\u00f3n de espacio. A menudo, cuando ejecutamos generic/562 desde fstests, podemos bloquearnos durante el desmontaje, lo que resulta en un rastro como este: 07 de septiembre 11:52 :00 debian9 desconocido: ejecute fstests generic/562 el 07/09/2022 11:52:00 07 de septiembre 11:55:32 kernel debian9: INFORMACI\u00d3N: tarea umount:49438 bloqueada durante m\u00e1s de 120 segundos. 07 de septiembre 11:55:32 kernel debian9: no contaminado 6.0.0-rc2-btrfs-next-122 #1 07 de septiembre 11:55:32 kernel debian9: \"echo 0 &gt; /proc/sys/kernel/hung_task_timeout_secs\" desactiva esto mensaje. 07 de septiembre 11:55:32 kernel debian9: tarea: estado de montaje: D pila: 0 pid:49438 ppid: 25683 banderas:0x00004000 07 de septiembre 11:55:32 kernel de debian9: Seguimiento de llamadas: 07 de septiembre 11:55:32 kernel de debian9 : 07 de septiembre 11:55:32 kernel debian9: __schedule+0x3c8/0xec0 07 de septiembre 11:55:32 kernel debian9: ? rcu_read_lock_sched_held+0x12/0x70 07 de septiembre 11:55:32 kernel debian9: horario+0x5d/0xf0 07 de septiembre 11:55:32 kernel debian9: Schedule_timeout+0xf1/0x130 07 de septiembre 11:55:32 kernel debian9:? lock_release+0x224/0x4a0 7 de septiembre 11:55:32 kernel debian9:? lock_acquired+0x1a0/0x420 7 de septiembre 11:55:32 kernel debian9:? trace_hardirqs_on+0x2c/0xd0 07 de septiembre 11:55:32 kernel debian9: __wait_for_common+0xac/0x200 07 de septiembre 11:55:32 kernel debian9:? usleep_range_state+0xb0/0xb0 07 de septiembre 11:55:32 kernel debian9: __flush_work+0x26d/0x530 07 de septiembre 11:55:32 kernel debian9:? Flush_workqueue_prep_pwqs+0x140/0x140 7 de septiembre 11:55:32 kernel debian9:? trace_clock_local+0xc/0x30 7 de septiembre 11:55:32 kernel debian9: __cancel_work_timer+0x11f/0x1b0 7 de septiembre 11:55:32 kernel debian9:? close_ctree+0x12b/0x5b3 [btrfs] 07 de septiembre 11:55:32 kernel debian9:? __trace_bputs+0x10b/0x170 07 de septiembre 11:55:32 kernel debian9: close_ctree+0x152/0x5b3 [btrfs] 07 de septiembre 11:55:32 kernel debian9:? evict_inodes+0x166/0x1c0 07 de septiembre 11:55:32 kernel debian9: generic_shutdown_super+0x71/0x120 07 de septiembre 11:55:32 kernel debian9: kill_anon_super+0x14/0x30 07 de septiembre 11:55:32 kernel debian9: 0 [btrfs] 07 de septiembre 11:55:32 kernel debian9: desactivar_locked_super+0x2e/0xa0 07 de septiembre 11:55:32 kernel debian9: cleanup_mnt+0x100/0x160 07 de septiembre 11:55:32 kernel de debian9: task_work_run+0x59/0xa0 07 de septiembre 11:55:32 kernel debian9: exit_to_user_mode_prepare+0x1a6/0x1b0 07 de septiembre 11:55:32 kernel debian9: syscall_exit_to_user_mode+0x16/0x40 07 de septiembre 11:55:32 kernel de debian9: do_syscall_64+0x48/0x90 07 de septiembre: 55:32 kernel debian9: Entry_SYSCALL_64_after_hwframe+0x63/0xcd 07 de septiembre 11:55:32 kernel debian9: RIP: 0033:0x7fcde59a57a7 07 de septiembre 11:55:32 kernel debian9: RSP: 002b:00007ffe914217c8 EFLAGS: ORIG_RAX: 00000000000000a6 07 de septiembre 11:55: 32 kernel debian9: RAX: 0000000000000000 RBX: 00007fcde5ae8264 RCX: 00007fcde59a57a7 07 de septiembre 11:55:32 kernel debian9: RDX: 0000000000000000 RSI: 00 RDI: 000055b57556cdd0 07 de septiembre 11:55:32 kernel debian9: RBP: 000055b57556cba0 R08: 0000000000000000 R09: 00007ffe91420570 07 de septiembre 11:55:32 kernel debian9: R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000000000 07 de septiembre 11:55:32 kernel debian9: R13: 55b57556cdd0 R14: 000055b57556ccb8 R15: 0000000000000000 7 de septiembre 11:55:32 kernel debian9: &lt; /TASK&gt; Lo que sucede es lo siguiente: 1) El kthread limpiador intenta iniciar una transacci\u00f3n para eliminar un grupo de bloques no utilizado, pero la reserva de metadatos no se puede satisfacer de inmediato, por lo que se crea un ticket de reserva e inicia la recuperaci\u00f3n as\u00edncrona de metadatos---truncadas---"
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48665.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix overflow for large capacity partition\n\nUsing int type for sector index, there will be overflow in a large\ncapacity partition.\n\nFor example, if storage with sector size of 512 bytes and partition\ncapacity is larger than 2TB, there will be overflow."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: exfat: corrige el desbordamiento de una partici\u00f3n de gran capacidad. Al usar el tipo int para el \u00edndice del sector, habr\u00e1 un desbordamiento en una partici\u00f3n de gran capacidad. Por ejemplo, si el almacenamiento con un tama\u00f1o de sector de 512 bytes y una capacidad de partici\u00f3n es superior a 2 TB, se producir\u00e1 un desbordamiento."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48666.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix a use-after-free\n\nThere are two .exit_cmd_priv implementations. Both implementations use\nresources associated with the SCSI host. Make sure that these resources are\nstill available when .exit_cmd_priv is called by waiting inside\nscsi_remove_host() until the tag set has been freed.\n\nThis commit fixes the following use-after-free:\n\n==================================================================\nBUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp]\nRead of size 8 at addr ffff888100337000 by task multipathd/16727\nCall Trace:\n <TASK>\n dump_stack_lvl+0x34/0x44\n print_report.cold+0x5e/0x5db\n kasan_report+0xab/0x120\n srp_exit_cmd_priv+0x27/0xd0 [ib_srp]\n scsi_mq_exit_request+0x4d/0x70\n blk_mq_free_rqs+0x143/0x410\n __blk_mq_free_map_and_rqs+0x6e/0x100\n blk_mq_free_tag_set+0x2b/0x160\n scsi_host_dev_release+0xf3/0x1a0\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n scsi_device_dev_release_usercontext+0x4c1/0x4e0\n execute_in_process_context+0x23/0x90\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n scsi_disk_release+0x3f/0x50\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n disk_release+0x17f/0x1b0\n device_release+0x54/0xe0\n kobject_put+0xa5/0x120\n dm_put_table_device+0xa3/0x160 [dm_mod]\n dm_put_device+0xd0/0x140 [dm_mod]\n free_priority_group+0xd8/0x110 [dm_multipath]\n free_multipath+0x94/0xe0 [dm_multipath]\n dm_table_destroy+0xa2/0x1e0 [dm_mod]\n __dm_destroy+0x196/0x350 [dm_mod]\n dev_remove+0x10c/0x160 [dm_mod]\n ctl_ioctl+0x2c2/0x590 [dm_mod]\n dm_ctl_ioctl+0x5/0x10 [dm_mod]\n __x64_sys_ioctl+0xb4/0xf0\n dm_ctl_ioctl+0x5/0x10 [dm_mod]\n __x64_sys_ioctl+0xb4/0xf0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x46/0xb0"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: core: corrige un use-after-free Hay dos implementaciones de .exit_cmd_priv. Ambas implementaciones utilizan recursos asociados con el host SCSI. Aseg\u00farese de que estos recursos todav\u00eda est\u00e9n disponibles cuando se llame a .exit_cmd_priv esperando dentro de scsi_remove_host() hasta que se haya liberado el conjunto de etiquetas. Esta confirmaci\u00f3n corrige el siguiente use-after-free: ======================================== =========================== ERROR: KASAN: use-after-free en srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Lectura de tama\u00f1o 8 en addr ffff888100337000 por tarea multipathd/16727 Rastreo de llamadas: dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] +0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+ 0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 dispositivo_release+0x54/0xe0 kobject_put+0xa5/0x120 dispositivo_release+0x54/0xe0 kobject_put+0xa5/0x120 +0x4c1/0x4e0 ejecutar_en_contexto_de_proceso+0x23/0x90 liberaci\u00f3n_de_dispositivo+0x54/0xe0 kobject_put+ 0xa5/0x120 scsi_disk_release+0x3f/0x50 dispositivo_liberaci\u00f3n+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 dispositivo_liberaci\u00f3n+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] grupo_prioridad_libre +0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] 2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5 /0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entrada_SYSCALL_64_after_hwframe+0x46/0xb 0"
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48667.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix temporary data corruption in insert range\n\ninsert range doesn't discard the affected cached region\nso can risk temporarily corrupting file data.\n\nAlso includes some minor cleanup (avoiding rereading\ninode size repeatedly unnecessarily) to make it clearer."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: smb3: corrige la corrupci\u00f3n de datos temporales en el rango de inserci\u00f3n. El rango de inserci\u00f3n no descarta la regi\u00f3n en cach\u00e9 afectada, por lo que puede correr el riesgo de da\u00f1ar temporalmente los datos del archivo. Tambi\u00e9n incluye una limpieza menor (evitando volver a leer el tama\u00f1o del inodo repetidamente innecesariamente) para hacerlo m\u00e1s claro."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48668.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix temporary data corruption in collapse range\n\ncollapse range doesn't discard the affected cached region\nso can risk temporarily corrupting the file data. This\nfixes xfstest generic/031\n\nI also decided to merge a minor cleanup to this into the same patch\n(avoiding rereading inode size repeatedly unnecessarily) to make it\nclearer."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: smb3: corrige la corrupci\u00f3n temporal de datos en el rango de contracci\u00f3n el rango de contracci\u00f3n no descarta la regi\u00f3n en cach\u00e9 afectada, por lo que puede correr el riesgo de corromper temporalmente los datos del archivo. Esto corrige xfstest generic/031. Tambi\u00e9n decid\u00ed fusionar una limpieza menor en el mismo parche (evitando volver a leer el tama\u00f1o del inodo repetidamente innecesariamente) para que quede m\u00e1s claro."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48669.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Fix potential memleak in papr_get_attr()\n\n`buf` is allocated in papr_get_attr(), and krealloc() of `buf`\ncould fail. We need to free the original `buf` in the case of failure."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: powerpc/pseries: corrija una posible fuga de mem en papr_get_attr() `buf` est\u00e1 asignado en papr_get_attr(), y krealloc() de `buf` podr\u00eda fallar. Necesitamos liberar el \"buf\" original en caso de falla."
}
],
"metrics": {},

4
CVE-2022/CVE-2022-486xx/CVE-2022-48684.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An issue was discovered in Logpoint before 7.1.1. Template injection was seen in the search template. The search template uses jinja templating for generating dynamic data. This could be abused to achieve code execution. Any user with access to create a search template can leverage this to execute code as the loginspect user."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en Logpoint antes de la versi\u00f3n 7.1.1. Se observ\u00f3 inyecci\u00f3n de plantilla en la plantilla de b\u00fasqueda. La plantilla de b\u00fasqueda utiliza plantillas jinja para generar datos din\u00e1micos. Se podr\u00eda abusar de esto para lograr la ejecuci\u00f3n del c\u00f3digo. Cualquier usuario con acceso para crear una plantilla de b\u00fasqueda puede aprovechar esto para ejecutar c\u00f3digo como usuario de inicio de sesi\u00f3n."
}
],
"metrics": {

4
CVE-2022/CVE-2022-486xx/CVE-2022-48685.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An issue was discovered in Logpoint 7.1 before 7.1.2. The daily executed cron file clean_secbi_old_logs is writable by all users and is executed as root, leading to privilege escalation."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en Logpoint 7.1 anterior a 7.1.2. Todos los usuarios pueden escribir en el archivo cron ejecutado diariamente clean_secbi_old_logs y se ejecuta como root, lo que lleva a una escalada de privilegios."
}
],
"metrics": {

4
CVE-2023/CVE-2023-10xx/CVE-2023-1000.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is identified as b4021d784a97e25151a5353aa763a741e9a148f5. It is recommended to upgrade the affected component. VDB-262230 is the identifier assigned to this vulnerability."
},
{
"lang": "es",
"value": "Se encontr\u00f3 una vulnerabilidad en cyanomiko dcnnt-py hasta 0.9.0. Ha sido clasificada como cr\u00edtica. La funci\u00f3n main del archivo dcnnt/plugins/notifications.py del componente Notification Handler es afectada por esta vulnerabilidad. La manipulaci\u00f3n conduce a la inyecci\u00f3n de comandos. Es posible lanzar el ataque de forma remota. La actualizaci\u00f3n a la versi\u00f3n 0.9.1 puede solucionar este problema. El parche se identifica como b4021d784a97e25151a5353aa763a741e9a148f5. Se recomienda actualizar el componente afectado. VDB-262230 es el identificador asignado a esta vulnerabilidad."
}
],
"metrics": {

4
CVE-2023/CVE-2023-230xx/CVE-2023-23019.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Cross site scripting (XSS) vulnerability in file main.php in sourcecodester oretnom23 Blog Site 1.0 via the name and email parameters to function user_add.\\"
},
{
"lang": "es",
"value": "Vulnerabilidad de Cross Site Scripting (XSS) en el archivo main.php en sourcecodester oretnom23 Blog Site 1.0 a trav\u00e9s del nombre y los par\u00e1metros de correo electr\u00f3nico para funcionar user_add.\\"
}
],
"metrics": {},

4
CVE-2023/CVE-2023-230xx/CVE-2023-23021.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability in sourcecodester oretnom23 pos point sale system 1.0, allows attackers to execute arbitrary code via the code, name, and description inputs in file Main.php."
},
{
"lang": "es",
"value": "Vulnerabilidad de Cross Site Scripting (XSS) en sourcecodester oretnom23 pos point sale system 1.0, permite a atacantes ejecutar c\u00f3digo arbitrario a trav\u00e9s de las entradas de c\u00f3digo, nombre y descripci\u00f3n en el archivo Main.php."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-230xx/CVE-2023-23022.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 employee's payroll management system 1.0, allows attackers to execute arbitrary code via the code, title, from_date and to_date inputs in file Main.php."
},
{
"lang": "es",
"value": "Vulnerabilidad de Cross Site Scripting (XSS) en sourcecodester oretnom23 employee's payroll management system 1.0, permite a atacantes ejecutar c\u00f3digo arbitrario a trav\u00e9s de las entradas c\u00f3digo, t\u00edtulo, desde_fecha y hasta_fecha en el archivo Main.php."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-266xx/CVE-2023-26603.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions. This allows privilege escalation to SYSTEM via a repair action in the installer."
},
{
"lang": "es",
"value": "JumpCloud Agent anterior a 1.178.0 crea un archivo temporal en un directorio con permisos inseguros. Esto permite escalar privilegios al SYSTEM mediante una acci\u00f3n de reparaci\u00f3n en el instalador."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-267xx/CVE-2023-26793.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "libmodbus v3.1.10 has a heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c."
},
{
"lang": "es",
"value": "libmodbus v3.1.10 tiene una vulnerabilidad de desbordamiento de b\u00fafer de almacenamiento din\u00e1mico en la funci\u00f3n read_io_status en src/modbus.c."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-287xx/CVE-2023-28798.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An out-of-bounds write to heap in the pacparser library on Zscaler Client Connector on Mac may lead to arbitrary code execution."
},
{
"lang": "es",
"value": "Una escritura fuera de los l\u00edmites en el mont\u00f3n en la librer\u00eda pacparser en Zscaler Client Connector en Mac puede provocar la ejecuci\u00f3n de c\u00f3digo arbitrario."
}
],
"metrics": {

4
CVE-2023/CVE-2023-318xx/CVE-2023-31889.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service via crafted GET request."
},
{
"lang": "es",
"value": "Un problema descubierto en httpd en ASUS RT-AC51U con una versi\u00f3n de firmware hasta 3.0.0.4.380.8591 incluida permite a atacantes locales provocar una denegaci\u00f3n de servicio mediante una solicitud GET manipulada."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-362xx/CVE-2023-36268.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An issue in The Document Foundation Libreoffice v.7.4.7 allows a remote attacker to cause a denial of service via a crafted .ppt file."
},
{
"lang": "es",
"value": "Un problema en The Document Foundation Libreoffice v.7.4.7 permite que un atacante remoto provoque una denegaci\u00f3n de servicio a trav\u00e9s de un archivo .ppt manipulado."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-372xx/CVE-2023-37244.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\\ProgramData\\N-Able Technologies\\AutomationManager\\Temp, which could be leveraged by an attacker to manipulate the process into performing arbitrary file deletions. We recommend upgrading to version 2.91.0.0"
},
{
"lang": "es",
"value": "La aplicaci\u00f3n AutomationManager.AgentService.exe afectada contiene una vulnerabilidad de condici\u00f3n de ejecuci\u00f3n TOCTOU que permite a los usuarios est\u00e1ndar crear un pseudoenlace simb\u00f3lico en C:\\ProgramData\\N-Able Technologies\\AutomationManager\\Temp, que un atacante podr\u00eda aprovechar para manipular el proceso. realizar eliminaciones arbitrarias de archivos. Recomendamos actualizar a la versi\u00f3n 2.91.0.0"
}
],
"metrics": {

4
CVE-2023/CVE-2023-380xx/CVE-2023-38002.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system. IBM X-Force ID: 260208."
},
{
"lang": "es",
"value": "IBM Storage Scale 5.1.0.0 a 5.1.9.2 podr\u00eda permitir que un usuario autenticado robe o manipule una sesi\u00f3n activa para obtener acceso al sistema. ID de IBM X-Force: 260208."
}
],
"metrics": {

4
CVE-2023/CVE-2023-405xx/CVE-2023-40533.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An uninitialized memory use vulnerability exists in Tinyproxy 1.11.1 while parsing HTTP requests. In certain configurations, a specially crafted HTTP request can result in disclosure of data allocated on the heap, which could contain sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de uso de memoria no inicializada en Tinyproxy 1.11.1 al analizar solicitudes HTTP. En determinadas configuraciones, una solicitud HTTP especialmente manipulada puede dar lugar a la divulgaci\u00f3n de datos asignados en el mont\u00f3n, que podr\u00edan contener informaci\u00f3n confidencial. Un atacante puede realizar una solicitud HTTP no autenticada para desencadenar esta vulnerabilidad."
}
],
"metrics": {

4
CVE-2023/CVE-2023-412xx/CVE-2023-41290.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.\n\nWe have already fixed the vulnerability in the following version:\nQuFirewall 2.4.1 ( 2024/02/01 ) and later\n"
},
{
"lang": "es",
"value": "Se ha informado que una vulnerabilidad de path traversal afecta a QuFirewall. Si se explota, la vulnerabilidad podr\u00eda permitir a los administradores autenticados leer el contenido de archivos inesperados y exponer datos confidenciales a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en la siguiente versi\u00f3n: QuFirewall 2.4.1 (2024/02/01) y posteriores"
}
],
"metrics": {

4
CVE-2023/CVE-2023-412xx/CVE-2023-41291.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.\n\nWe have already fixed the vulnerability in the following version:\nQuFirewall 2.4.1 ( 2024/02/01 ) and later\n"
},
{
"lang": "es",
"value": "Se ha informado que una vulnerabilidad de path traversal afecta a QuFirewall. Si se explota, la vulnerabilidad podr\u00eda permitir a los administradores autenticados leer el contenido de archivos inesperados y exponer datos confidenciales a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en la siguiente versi\u00f3n: QuFirewall 2.4.1 (2024/02/01) y posteriores "
}
],
"metrics": {

4
CVE-2023/CVE-2023-419xx/CVE-2023-41970.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on Windows during the Repair App functionality may allow Local Execution of Code.This issue affects Client Connector on Windows: before 4.1.0.62.\n\n"
},
{
"lang": "es",
"value": "Una vulnerabilidad de validaci\u00f3n incorrecta del valor de verificaci\u00f3n de integridad en Zscaler Client Connector en Windows durante la funcionalidad de la aplicaci\u00f3n de reparaci\u00f3n puede permitir la ejecuci\u00f3n local de c\u00f3digo. Este problema afecta a Client Connector en Windows: antes de 4.1.0.62."
}
],
"metrics": {

4
CVE-2023/CVE-2023-419xx/CVE-2023-41971.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7.\n\n"
},
{
"lang": "es",
"value": "Una vulnerabilidad de resoluci\u00f3n de enlace incorrecta antes del acceso al archivo (\"siguiente enlace\") en Zscaler Client Connector en Windows permite sobrescribir un archivo del sistema. Este problema afecta a Client Connector en Windows: versiones anteriores a 3.7."
}
],
"metrics": {

2
CVE-2023/CVE-2023-420xx/CVE-2023-42089.json
View File

@ -3,7 +3,7 @@
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"published": "2024-05-03T03:15:45.650",
"lastModified": "2024-05-03T12:49:24.027",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",

2
CVE-2023/CVE-2023-420xx/CVE-2023-42090.json
View File

@ -3,7 +3,7 @@
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"published": "2024-05-03T03:15:45.817",
"lastModified": "2024-05-03T12:49:24.027",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",

2
CVE-2023/CVE-2023-420xx/CVE-2023-42091.json
View File

@ -3,7 +3,7 @@
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"published": "2024-05-03T03:15:45.980",
"lastModified": "2024-05-03T12:49:24.027",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",

2
CVE-2023/CVE-2023-420xx/CVE-2023-42092.json
View File

@ -3,7 +3,7 @@
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"published": "2024-05-03T03:15:46.150",
"lastModified": "2024-05-03T12:49:24.027",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",

2
CVE-2023/CVE-2023-420xx/CVE-2023-42093.json
View File

@ -3,7 +3,7 @@
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"published": "2024-05-03T03:15:46.310",
"lastModified": "2024-05-03T12:49:24.027",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",

2
CVE-2023/CVE-2023-420xx/CVE-2023-42094.json
View File

@ -3,7 +3,7 @@
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"published": "2024-05-03T03:15:46.480",
"lastModified": "2024-05-03T12:49:24.027",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",

2
CVE-2023/CVE-2023-420xx/CVE-2023-42095.json
View File

@ -3,7 +3,7 @@
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"published": "2024-05-03T03:15:46.640",
"lastModified": "2024-05-03T12:49:24.027",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",

2
CVE-2023/CVE-2023-420xx/CVE-2023-42096.json
View File

@ -3,7 +3,7 @@
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"published": "2024-05-03T03:15:46.810",
"lastModified": "2024-05-03T12:49:24.027",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",

2
CVE-2023/CVE-2023-420xx/CVE-2023-42097.json
View File

@ -3,7 +3,7 @@
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"published": "2024-05-03T03:15:46.970",
"lastModified": "2024-05-03T12:49:24.027",
"vulnStatus": "Awaiting Analysis",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
"lang": "en",

4
CVE-2023/CVE-2023-453xx/CVE-2023-45385.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "ProQuality pqprintshippinglabels before v.4.15.0 is vulnerable to Directory Traversal via the pqprintshippinglabels module."
},
{
"lang": "es",
"value": "ProQuality pqprintshippinglabels anterior a v.4.15.0 es vulnerable a Directory Traversal a trav\u00e9s del m\u00f3dulo pqprintshippinglabels."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-462xx/CVE-2023-46270.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items."
},
{
"lang": "es",
"value": "MacPaw The Unarchiver anterior a 4.3.6 contiene una vulnerabilidad relacionada con atributos de cuarentena faltantes para elementos extra\u00eddos."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-463xx/CVE-2023-46304.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load)."
},
{
"lang": "es",
"value": "module/Users/models/Module.php en Vtiger CRM 7.5.0 permite que un atacante remoto autenticado ejecute c\u00f3digo PHP arbitrario porque un endpoint desprotegido le permite escribir este c\u00f3digo en el archivo config.inc.php (ejecutado en cada carga de p\u00e1gina) ."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-465xx/CVE-2023-46565.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go."
},
{
"lang": "es",
"value": "Vulnerabilidad de desbordamiento de b\u00fafer en osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 permite a un atacante remoto provocar una denegaci\u00f3n de servicio a trav\u00e9s de la funci\u00f3n handleError en pkg/server/fsm.go."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-465xx/CVE-2023-46566.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Buffer Overflow vulnerability in msoulier tftpy commit 467017b844bf6e31745138a30e2509145b0c529c allows a remote attacker to cause a denial of service via the parse function in the TftpPacketFactory class."
},
{
"lang": "es",
"value": "Vulnerabilidad de desbordamiento de b\u00fafer en el commit tftpy de msoulier 467017b844bf6e31745138a30e2509145b0c529c permite a un atacante remoto provocar una denegaci\u00f3n de servicio a trav\u00e9s de la funci\u00f3n de an\u00e1lisis en la clase TftpPacketFactory."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-469xx/CVE-2023-46960.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Buffer Overflow vulnerability in PyPXE v.1.8.4 allows a remote attacker to cause a denial of service via the handle function in the tftp module."
},
{
"lang": "es",
"value": "Vulnerabilidad de desbordamiento de b\u00fafer en PyPXE v.1.8.4 permite que un atacante remoto provoque una denegaci\u00f3n de servicio a trav\u00e9s de la funci\u00f3n de manejo en el m\u00f3dulo tftp."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-471xx/CVE-2023-47166.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network request to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de actualizaci\u00f3n de firmware en la funcionalidad de importaci\u00f3n de archivos luci2-io de Milesight UR32L v32.3.0.7-r2. Una solicitud de red especialmente manipulada puede provocar una actualizaci\u00f3n de firmware arbitraria. Un atacante puede enviar una solicitud de red para desencadenar esta vulnerabilidad."
}
],
"metrics": {

4
CVE-2023/CVE-2023-472xx/CVE-2023-47212.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "A heap-based buffer overflow vulnerability exists in the comment functionality of stb _vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer de almacenamiento din\u00e1mico en la funcionalidad de comentarios de stb _vorbis.c v1.22. Un archivo .ogg especialmente manipulado puede provocar una escritura fuera de los l\u00edmites. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad."
}
],
"metrics": {

4
CVE-2023/CVE-2023-472xx/CVE-2023-47222.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to compromise the security of the system via a network.\n\nWe have already fixed the vulnerability in the following version:\nMedia Streaming add-on 500.1.1.5 ( 2024/01/22 ) and later\n"
},
{
"lang": "es",
"value": "Se ha informado que una vulnerabilidad de exposici\u00f3n de informaci\u00f3n confidencial afecta al complemento Media Streaming. Si se explota, la vulnerabilidad podr\u00eda permitir a los usuarios comprometer la seguridad del sistema a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en la siguiente versi\u00f3n: complemento Media Streaming 500.1.1.5 (2024/01/22) y posteriores"
}
],
"metrics": {

4
CVE-2023/CVE-2023-477xx/CVE-2023-47727.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.20.0 could allow an authenticated user to modify dashboard parameters due to improper input validation. IBM X-Force ID: 272089."
},
{
"lang": "es",
"value": "IBM Cloud Pak for Security 1.10.0.0 a 1.10.11.0 e IBM QRadar Suite Software 1.10.12.0 a 1.10.20.0 podr\u00edan permitir a un usuario autenticado modificar los par\u00e1metros del panel debido a una validaci\u00f3n de entrada incorrecta. ID de IBM X-Force: 272089."
}
],
"metrics": {

4
CVE-2023/CVE-2023-486xx/CVE-2023-48683.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 37758."
},
{
"lang": "es",
"value": "Divulgaci\u00f3n y manipulaci\u00f3n de informaci\u00f3n sensible por falta de autorizaci\u00f3n. Los siguientes productos se ven afectados: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) antes de la compilaci\u00f3n 37758."
}
],
"metrics": {

4
CVE-2023/CVE-2023-486xx/CVE-2023-48684.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 37758."
},
{
"lang": "es",
"value": "Divulgaci\u00f3n y manipulaci\u00f3n de informaci\u00f3n sensible por falta de autorizaci\u00f3n. Los siguientes productos se ven afectados: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) antes de la compilaci\u00f3n 37758."
}
],
"metrics": {

4
CVE-2023/CVE-2023-494xx/CVE-2023-49473.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "Shenzhen JF6000 Cloud Media Collaboration Processing Platform firmware version V1.2.0 and software version V2.0.0 build 6245 is vulnerable to Incorrect Access Control."
},
{
"lang": "es",
"value": "La versi\u00f3n de firmware V1.2.0 de Shenzhen JF6000 Cloud Media Collaboration Processing Platform V2.0.0 compilaci\u00f3n 6245 son vulnerables a un control de acceso incorrecto."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-496xx/CVE-2023-49606.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de use-after-free en el an\u00e1lisis de los encabezados de conexi\u00f3n HTTP en Tinyproxy 1.11.1 y Tinyproxy 1.10.0. Un encabezado HTTP especialmente manipulado puede provocar la reutilizaci\u00f3n de la memoria previamente liberada, lo que provoca da\u00f1os en la memoria y podr\u00eda provocar la ejecuci\u00f3n remota de c\u00f3digo. Un atacante necesita realizar una solicitud HTTP no autenticada para activar esta vulnerabilidad."
}
],
"metrics": {

4
CVE-2023/CVE-2023-500xx/CVE-2023-50053.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce (random number)"
},
{
"lang": "es",
"value": "Un problema en Foundation.app La plataforma Foundation 1.0 permite a un atacante remoto obtener informaci\u00f3n confidencial a trav\u00e9s del proceso de autenticaci\u00f3n Web3 de Foundation, el mensaje firmado carece de un nonce (n\u00famero aleatorio)"
}
],
"metrics": {},

4
CVE-2023/CVE-2023-500xx/CVE-2023-50059.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed message lacks a nonce (random number)"
},
{
"lang": "es",
"value": "Un problema ingalxe.com La plataforma Galxe 1.0 permite a un atacante remoto obtener informaci\u00f3n confidencial a trav\u00e9s del proceso de autenticaci\u00f3n Web3 de Galxe, el mensaje firmado carece de un nonce (n\u00famero aleatorio)"
}
],
"metrics": {},

4
CVE-2023/CVE-2023-503xx/CVE-2023-50361.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.6.2722 build 20240402 and later\nQuTS hero h5.1.6.2734 build 20240414 and later\n"
},
{
"lang": "es",
"value": "Se ha informado que una copia del b\u00fafer sin verificar el tama\u00f1o de la vulnerabilidad de entrada afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los usuarios autenticados ejecutar c\u00f3digo a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.6.2722 build 20240402 y posteriores QuTS hero h5.1.6.2734 build 20240414 y posteriores"
}
],
"metrics": {

4
CVE-2023/CVE-2023-503xx/CVE-2023-50362.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.6.2722 build 20240402 and later\nQuTS hero h5.1.6.2734 build 20240414 and later\n"
},
{
"lang": "es",
"value": "Se ha informado que una copia del b\u00fafer sin verificar el tama\u00f1o de la vulnerabilidad de entrada afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los usuarios autenticados ejecutar c\u00f3digo a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.6.2722 build 20240402 y posteriores QuTS hero h5.1.6.2734 build 20240414 y posteriores"
}
],
"metrics": {

4
CVE-2023/CVE-2023-503xx/CVE-2023-50363.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.6.2722 build 20240402 and later\nQuTS hero h5.1.6.2734 build 20240414 and later\n"
},
{
"lang": "es",
"value": "Se ha informado que una vulnerabilidad de autorizaci\u00f3n incorrecta afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los usuarios autenticados eludir las restricciones de acceso previstas a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.6.2722 build 20240402 y posteriores QuTS hero h5.1.6.2734 build 20240414 y posteriores"
}
],
"metrics": {

4
CVE-2023/CVE-2023-503xx/CVE-2023-50364.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.6.2722 build 20240402 and later\nQuTS hero h5.1.6.2734 build 20240414 and later\n"
},
{
"lang": "es",
"value": "Se ha informado que una copia del b\u00fafer sin verificar el tama\u00f1o de la vulnerabilidad de entrada afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podr\u00eda permitir a los administradores autenticados ejecutar c\u00f3digo a trav\u00e9s de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.6.2722 build 20240402 y posteriores QuTS hero h5.1.6.2734 build 20240414 y posteriores"
}
],
"metrics": {

4
CVE-2023/CVE-2023-504xx/CVE-2023-50432.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service (daemon crash) by sending a DHCP packet without any option fields, which causes free_packet in dhcp_packet.c to dereference a NULL pointer."
},
{
"lang": "es",
"value": "simple-dhcp-server a trav\u00e9s de ec976d2 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda del daemon) enviando un paquete DHCP sin ning\u00fan campo de opci\u00f3n, lo que provoca que free_packet en dhcp_packet.c elimine la referencia a un puntero NULL."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-504xx/CVE-2023-50433.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "marshall in dhcp_packet.c in simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service by sending a malicious DHCP packet. The crash is caused by a type confusion bug that results in a large memory allocation; when this memory allocation fails the DHCP server will crash."
},
{
"lang": "es",
"value": "marshall en dhcp_packet.c en simple-dhcp-server a trav\u00e9s de ec976d2 permite a atacantes remotos provocar una denegaci\u00f3n de servicio enviando un paquete DHCP malicioso. El bloqueo se debe a un error de confusi\u00f3n de tipos que da como resultado una gran asignaci\u00f3n de memoria; cuando esta asignaci\u00f3n de memoria falla, el servidor DHCP fallar\u00e1."
}
],
"metrics": {},

4
CVE-2023/CVE-2023-504xx/CVE-2023-50434.json
View File

@ -8,6 +8,10 @@
{
"lang": "en",
"value": "emdns_resolve_raw in emdns.c in emdns through fbd1eef calls strlen with an input that may not be '\\0' terminated, leading to a stack-based buffer over-read. This can be triggered by a remote adversary that can send DNS requests to the emdns server. The impact could vary depending on the system libraries, compiler, and processor architecture. Code before be565c3 is unaffected."
},
{
"lang": "es",
"value": "emdns_resolve_raw en emdns.c en emdns a trav\u00e9s de fbd1eef llama a strlen con una entrada que puede no estar terminada en '\\0', lo que provoca una sobrelectura del b\u00fafer basado en pila. Esto puede ser provocado por un adversario remoto que puede enviar solicitudes DNS al servidor emdns. El impacto podr\u00eda variar seg\u00fan las librer\u00edas del sistema, el compilador y la arquitectura del procesador. El c\u00f3digo anterior a be565c3 no se ve afectado."
}
],
"metrics": {},

Some files were not shown because too many files have changed in this diff Show More