Security Vulnerabilities - CVEs Published In November 2024
In the Linux kernel, the following vulnerability has been resolved:
x86: fix user address masking non-canonical speculation issue
It turns out that AMD has a "Meltdown Lite(tm)" issue with non-canonical
accesses in kernel space. And so using just the high bit to decide
whether an access is in user space or kernel space ends up with the good
old "leak speculative data" if you have the right gadget using the
result:
CVE-2020-12965 “Transient Execution of Non-Canonical Accesses“
Now, the kernel surrounds the access with a STAC/CLAC pair, and those
instructions end up serializing execution on older Zen architectures,
which closes the speculation window.
But that was true only up until Zen 5, which renames the AC bit [1].
That improves performance of STAC/CLAC a lot, but also means that the
speculation window is now open.
Note that this affects not just the new address masking, but also the
regular valid_user_address() check used by access_ok(), and the asm
version of the sign bit check in the get_user() helpers.
It does not affect put_user() or clear_user() variants, since there's no
speculative result to be used in a gadget for those operations.
CVSS Score
5.5
EPSS Score
0.002
Published
2024-11-05
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
A devm_kzalloc() in asoc_qcom_lpass_cpu_platform_probe() could
possibly return NULL pointer. NULL Pointer Dereference may be
triggerred without addtional check.
Add a NULL check for the returned pointer.
CVSS Score
5.5
EPSS Score
0.002
Published
2024-11-05
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: sdm845: add missing soundwire runtime stream alloc
During the migration of Soundwire runtime stream allocation from
the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845
soundcard was forgotten.
At this point any playback attempt or audio daemon startup, for instance
on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer
NULL dereference:
Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000020
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101ecf000
[0000000000000020] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in: ...
CPU: 5 UID: 0 PID: 1198 Comm: aplay
Not tainted 6.12.0-rc2-qcomlt-arm64-00059-g9d78f315a362-dirty #18
Hardware name: Thundercomm Dragonboard 845c (DT)
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
lr : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
sp : ffff80008a2035c0
x29: ffff80008a2035c0 x28: ffff80008a203978 x27: 0000000000000000
x26: 00000000000000c0 x25: 0000000000000000 x24: ffff1676025f4800
x23: ffff167600ff1cb8 x22: ffff167600ff1c98 x21: 0000000000000003
x20: ffff167607316000 x19: ffff167604e64e80 x18: 0000000000000000
x17: 0000000000000000 x16: ffffcec265074160 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff167600ff1cec
x5 : ffffcec22cfa2010 x4 : 0000000000000000 x3 : 0000000000000003
x2 : ffff167613f836c0 x1 : 0000000000000000 x0 : ffff16761feb60b8
Call trace:
sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
wsa881x_hw_params+0x68/0x80 [snd_soc_wsa881x]
snd_soc_dai_hw_params+0x3c/0xa4
__soc_pcm_hw_params+0x230/0x660
dpcm_be_dai_hw_params+0x1d0/0x3f8
dpcm_fe_dai_hw_params+0x98/0x268
snd_pcm_hw_params+0x124/0x460
snd_pcm_common_ioctl+0x998/0x16e8
snd_pcm_ioctl+0x34/0x58
__arm64_sys_ioctl+0xac/0xf8
invoke_syscall+0x48/0x104
el0_svc_common.constprop.0+0x40/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x34/0xe0
el0t_64_sync_handler+0x120/0x12c
el0t_64_sync+0x190/0x194
Code: aa0403fb f9418400 9100e000 9400102f (f8420f22)
---[ end trace 0000000000000000 ]---
0000000000006108 <sdw_stream_add_slave>:
6108: d503233f paciasp
610c: a9b97bfd stp x29, x30, [sp, #-112]!
6110: 910003fd mov x29, sp
6114: a90153f3 stp x19, x20, [sp, #16]
6118: a9025bf5 stp x21, x22, [sp, #32]
611c: aa0103f6 mov x22, x1
6120: 2a0303f5 mov w21, w3
6124: a90363f7 stp x23, x24, [sp, #48]
6128: aa0003f8 mov x24, x0
612c: aa0203f7 mov x23, x2
6130: a9046bf9 stp x25, x26, [sp, #64]
6134: aa0403f9 mov x25, x4 <-- x4 copied to x25
6138: a90573fb stp x27, x28, [sp, #80]
613c: aa0403fb mov x27, x4
6140: f9418400 ldr x0, [x0, #776]
6144: 9100e000 add x0, x0, #0x38
6148: 94000000 bl 0 <mutex_lock>
614c: f8420f22 ldr x2, [x25, #32]! <-- offset 0x44
^^^
This is 0x6108 + offset 0x44 from the beginning of sdw_stream_add_slave()
where data abort happens.
wsa881x_hw_params() is called with stream = NULL and passes it further
in register x4 (5th argu
---truncated---
CVSS Score
5.5
EPSS Score
0.002
Published
2024-11-05
A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.
CVSS Score
7.5
EPSS Score
0.004
Published
2024-11-05
Substance3D - Painter versions 10.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score
7.8
EPSS Score
0.003
Published
2024-11-05
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Fix overflow in oa batch buffer
By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch
buffer, this is not a problem if batch buffer is only used once but
oa reuses the batch buffer for the same metric and at each call
it appends a MI_BATCH_BUFFER_END, printing the warning below and then
overflowing.
[ 381.072016] ------------[ cut here ]------------
[ 381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!
platform: LUNARLAKE subplatform: 1
graphics: Xe2_LPG / Xe2_HPG 20.04 step B0
media: Xe2_LPM / Xe2_HPM 20.00 step B0
tile: 0 VRAM 0 B
GT: 0 type 1
So here checking if batch buffer already have MI_BATCH_BUFFER_END if
not append it.
v2:
- simply fix, suggestion from Ashutosh
(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)
CVSS Score
7.8
EPSS Score
0.002
Published
2024-11-05
In the Linux kernel, the following vulnerability has been resolved:
dm vdo: don't refer to dedupe_context after releasing it
Clear the dedupe_context pointer in a data_vio whenever ownership of
the context is lost, so that vdo can't examine it accidentally.
CVSS Score
7.8
EPSS Score
0.002
Published
2024-11-05
In the Linux kernel, the following vulnerability has been resolved:
net: netconsole: fix wrong warning
A warning is triggered when there is insufficient space in the buffer
for userdata. However, this is not an issue since userdata will be sent
in the next iteration.
Current warning message:
------------[ cut here ]------------
WARNING: CPU: 13 PID: 3013042 at drivers/net/netconsole.c:1122 write_ext_msg+0x3b6/0x3d0
? write_ext_msg+0x3b6/0x3d0
console_flush_all+0x1e9/0x330
The code incorrectly issues a warning when this_chunk is zero, which is
a valid scenario. The warning should only be triggered when this_chunk
is negative.
CVSS Score
3.3
EPSS Score
0.002
Published
2024-11-05
In the Linux kernel, the following vulnerability has been resolved:
thermal: intel: int340x: processor: Fix warning during module unload
The processor_thermal driver uses pcim_device_enable() to enable a PCI
device, which means the device will be automatically disabled on driver
detach. Thus there is no need to call pci_disable_device() again on it.
With recent PCI device resource management improvements, e.g. commit
f748a07a0b64 ("PCI: Remove legacy pcim_release()"), this problem is
exposed and triggers the warining below.
[ 224.010735] proc_thermal_pci 0000:00:04.0: disabling already-disabled device
[ 224.010747] WARNING: CPU: 8 PID: 4442 at drivers/pci/pci.c:2250 pci_disable_device+0xe5/0x100
...
[ 224.010844] Call Trace:
[ 224.010845] <TASK>
[ 224.010847] ? show_regs+0x6d/0x80
[ 224.010851] ? __warn+0x8c/0x140
[ 224.010854] ? pci_disable_device+0xe5/0x100
[ 224.010856] ? report_bug+0x1c9/0x1e0
[ 224.010859] ? handle_bug+0x46/0x80
[ 224.010862] ? exc_invalid_op+0x1d/0x80
[ 224.010863] ? asm_exc_invalid_op+0x1f/0x30
[ 224.010867] ? pci_disable_device+0xe5/0x100
[ 224.010869] ? pci_disable_device+0xe5/0x100
[ 224.010871] ? kfree+0x21a/0x2b0
[ 224.010873] pcim_disable_device+0x20/0x30
[ 224.010875] devm_action_release+0x16/0x20
[ 224.010878] release_nodes+0x47/0xc0
[ 224.010880] devres_release_all+0x9f/0xe0
[ 224.010883] device_unbind_cleanup+0x12/0x80
[ 224.010885] device_release_driver_internal+0x1ca/0x210
[ 224.010887] driver_detach+0x4e/0xa0
[ 224.010889] bus_remove_driver+0x6f/0xf0
[ 224.010890] driver_unregister+0x35/0x60
[ 224.010892] pci_unregister_driver+0x44/0x90
[ 224.010894] proc_thermal_pci_driver_exit+0x14/0x5f0 [processor_thermal_device_pci]
...
[ 224.010921] ---[ end trace 0000000000000000 ]---
Remove the excess pci_disable_device() calls.
[ rjw: Subject and changelog edits ]
CVSS Score
5.5
EPSS Score
0.002
Published
2024-11-05
In the Linux kernel, the following vulnerability has been resolved:
sfc: Don't invoke xdp_do_flush() from netpoll.
Yury reported a crash in the sfc driver originated from
netpoll_send_udp(). The netconsole sends a message and then netpoll
invokes the driver's NAPI function with a budget of zero. It is
dedicated to allow driver to free TX resources, that it may have used
while sending the packet.
In the netpoll case the driver invokes xdp_do_flush() unconditionally,
leading to crash because bpf_net_context was never assigned.
Invoke xdp_do_flush() only if budget is not zero.
CVSS Score
7.5
EPSS Score
0.005
Published
2024-11-05