Hulk Robot

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to the version that includes the fix for the race condition between ext4 write and ext4 convert inline data **Description** A race condition exists in the Linux kernel between ext4 write and ext4 convert inline data, which can lead to an error in the ext4 mb generate buddy function. This issue occurs due to concurrent access to the same data structure by multiple threads, specifically when the locks held by ext4 convert inline data (xattr sem) and generic perform write (i rwsem) are acquired in a way that allows for concurrent execution. The error manifests as an inconsistent block bitmap and bg descriptor in the ext4 file system, resulting in a kernel BUG. **Recommendations** To resolve this issue, apply the patch that adds inode lock() for ext4 convert inline data() and moves ext4 convert inline data() in front of ext4 punch hole(), removing similar handling from ext4 punch hole(). Note: The exact version that includes the fix is not specified, so it is recommended to update to the latest version of the Linux kernel that includes this fix.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A null pointer dereference issue has been identified in the Linux kernel, specifically in the `ufx usb probe()` function. This issue occurs when `fb alloc cmap()` fails, leading to a call to `fb destroy modelist()` before the modelist has been initialized, resulting in a null pointer dereference. The error handling path in `ufx usb probe()` is the source of the problem. **Recommendations** To resolve this issue, initialize the modelist before calling `fb alloc cmap()` in the `ufx usb probe()` function. This can be achieved by reordering the initialization and allocation calls to ensure that modelist is properly set up before attempting to allocate resources.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A issue in the Linux kernel has been identified where a refcount leak occurs due to a missing `of node put()` call. This happens when the node pointer is returned by `of find node by type()` or `of parse phandle()` with an incremented refcount. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.18.0-rc2 **Description** A slab-out-of-bounds read issue was discovered in the Linux kernel, specifically in the ` regmap init` function. This occurred when the `da9121` device was probed with an invalid Device Tree (DT) configuration, resulting in the `chip->subvariant id` being set to `-EINVAL`. Later, the `da9121 assign chip model` function accessed the `regmap` without initializing it, leading to the out-of-bounds read. The issue was identified through a KASAN report. **Recommendations** For Linux kernel versions prior to 5.18.0-rc2, consider updating to a newer version that includes the fix for the `da9121 assign chip model` function, which now returns `-EINVAL` if `chip->subvariant id` is invalid. As a temporary workaround, ensure that all Device Tree configurations for the `da9121` device are valid to prevent the `chip->subvariant id` from being set to `-EINVAL`.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A memory leak issue has been identified in the Linux kernel, specifically in the ` thermal cooling device register()` function. The leak occurs when `device register()` fails, and `thermal cooling device destroy sysfs()` is not called to free the allocated memory. This issue was discovered during a fault injection test, which revealed an unreferenced object. The backtrace indicates that the memory allocation occurs in `kmalloc order trace()` and ` kmalloc()`, and the leak is caused by the failure to call `thermal cooling device destroy sysfs()` to free the memory. **Recommendations** To resolve this issue, ensure that `thermal cooling device destroy sysfs()` is called when `device register()` fails to free the allocated memory. As a temporary workaround, consider reviewing the code to ensure proper memory management in the ` thermal cooling device register()` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a use-after-free vulnerability in the sata fsl component of the Linux kernel. This vulnerability can be triggered when the `rmmod sata fsl.ko` command is executed in the PPC64 GNU/Linux environment, leading to a bug report. The vulnerability is caused by the execution of the `iounmap` and `kfree` functions in the wrong order, resulting in a use-after-free condition. The vulnerability can potentially allow an attacker to elevate privileges in the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a possible memory leak in the Linux kernel, specifically in the kxcjk-1013 driver. When the ACPI type is ACPI SMO8500, the data->dready trig will not be set, and the memory allocated by iio triggered buffer setup() will not be freed, causing a memory leak. The memory leak can be identified by an unreferenced object, and a backtrace is provided to show the call stack leading to the leak. The issue can be fixed by removing the data->dready trig condition in the probe and remove functions. Recommendations: To resolve the issue, remove the data->dready trig condition in the probe and remove functions. As a temporary workaround, consider disabling the kxcjk1013 probe() function until a patch is available. Restrict access to the vulnerable module kxcjk 1013 to minimize the risk of exploitation. Avoid using the iio triggered buffer setup() function in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a possible double-free in the regcache rbtree exit() function. When 'present' realloc fails in regcache rbtree insert to block(), the 'blk' assigned to 'rbnode->block' will be freed, causing 'rbnode->block' to point to freed memory. In the error handling path of regcache rbtree init(), 'rbnode->block' will be freed again in regcache rbtree exit(), resulting in a double-free error reported by KASAN. The error occurs in the following call trace: slab free freelist hook, kfree, regcache rbtree exit, regcache rbtree init, regcache init, regmap init, devm regmap init, madera spi probe, spi probe, and really probe. To fix this, the assignment of rbnode->block is moved to immediately after the reallocation has succeeded, ensuring the data structure remains valid even if the second reallocation fails. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A bug has been identified in the Linux kernel, specifically in the ext4 file system. The issue occurs when the `ext4 mb use inode pa` function is called, leading to a BUG ON error at `fs/ext4/mballoc.c:3211`. This error can be triggered by a sequence of system calls, including `do fsync`, `vfs fsync range`, `ext4 sync file`, and `ext4 writepages`. The problem can be reproduced using the `fallocate`, `mkfs.ext4`, `mount`, and `fsstress` commands. The issue is related to the calculation of disk space usage and can occur when the size of an allocation is truncated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors. The vulnerability is related to the incorrect calculation of available space for storing attributes in the `ext4 xattr set entry()` function. Exploitation of the vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A bug in the Linux kernel's ext4 file system has been identified, which can cause a system panic due to an incorrect check for overlapping extents. The issue occurs when the `ext4 valid extent entries` function fails to return an error even if the logical block number (`lblock`) of an extent is less than or equal to the previous extent's logical block number. This can lead to a `BUG ON` condition in the ` es tree search` function, resulting in a system crash. The problem can happen when the `ext4 fill super` function is called, which enables quotas and checks for valid extent entries. **Recommendations** To resolve this issue, ensure that the `lblock` of the first extent is not less than 0, and the `lblock` of the next extent is not less than the next block of the previous extent. As a temporary workaround, consider disabling the quota functionality until a patch is available. However, since the provided information does not specify the exact versions affected or the fixed version, it is essential to consult the Linux kernel documentation for the latest updates and patches. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free issue has been identified in the jffs2 file system. The problem occurs when mounting a jffs2 image with abnormal blocks, leading to an error in `jffs2 scan eraseblock()`. This error triggers the execution of `jffs2 clear xattr subsystem()` twice, resulting in a use-after-free condition. The issue is related to the `jffs2 clear xattr subsystem()` function being called in `jffs2 build filesystem()` and again in `jffs2 do fill super()`. The estimated number of potentially affected devices and real-world incidents are not provided. **Recommendations** To resolve the issue, move the `jffs2 clear xattr subsystem()` function from 'out inohash' to 'out root' to prevent the use-after-free condition. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A race condition exists between `ctrl cdev ioctl` and `ubi cdev ioctl` in the Linux kernel. This issue is caused by the locks held by these two functions, `ubi devices mutex` and `ubi->device mutex`, which can be concurrent. The problem arises in `ubi attach` when `uif init` and `uif close` may race with `ubi cdev ioctl`, potentially leading to a use-after-free error. This error occurs because a device is made "available" before it becomes accessible via sysfs, allowing for concurrent access and deletion. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** To resolve this issue, the modification made by commit 714fb87e8bc0 should be rolled back. The race condition between ubi device creation and udev can be fixed by removing `ubi get device` in `vol attribute show` and `dev attribute show`. This change avoids accessing uninitialized `ubi devices[ubi num]`. As a temporary workaround, consider disabling the `ubi cdev ioctl` function until a patch is available. Restrict access to the vulnerable `ubi` module to minimize the risk of exploitation. Avoid using the `device del` function in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.16.0 **Description** A signed integer overflow issue has been identified in the Linux kernel, specifically in the ` ip6 append data` function. This issue arises when the `length` variable exceeds the maximum value that can be represented by an integer, causing an overflow. The problem is resolved by changing the type of the `length` variable to `size t`, which is an unsigned type. The issue was detected by the UBSAN (Undefined Behavior Sanitizer) tool, which reported a warning for the signed integer overflow. **Recommendations** For Linux kernel versions prior to 5.16.0, update to version 5.16.0 or later to resolve the issue. As a temporary workaround, consider applying the patch that changes the `length` variable type to `size t` to prevent the signed integer overflow.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a memory leak in the Linux kernel's NFC component, specifically in the st21nfca module. The memory leak occurs when the `phy->pending skb` is allocated during device probe but not freed in the error handling path and remove path. This causes an unreferenced object, leading to a memory leak. The backtrace indicates the involvement of functions such as ` kmalloc node track caller`, `kmalloc reserve`, ` alloc skb`, and `st21nfca hci i2c probe`. The memory leak can be fixed by freeing the `pending skb` in error and remove. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.16.0-rc6-dirty #373 **Description** The issue is related to the mm/hwpoison component of the Linux kernel, where an error in resource management can cause a panic when testing madvise() with MADV SOFT OFFLINE. The BUG() is triggered when retrying get any page() due to the MF COUNT INCREASED flag being kept in the second try, but the refcnt is not increased. This results in a kernel BUG at include/linux/mm.h:737 and an invalid opcode. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The vulnerability is related to a memory leak in the Linux kernel's kfence component when using cat kfence objects. This issue can be reproduced with specific commands, including cat /sys/kernel/debug/kfence/objects, echo scan > /sys/kernel/debug/kmemleak, and cat /sys/kernel/debug/kmemleak. The leaked memory is allocated in the stack during the do syscall 64 and vfs read processes but is not released properly due to the lack of a release function corresponding to file operations in kfence. This results in a memory leak, which can potentially lead to a denial of service. The solution involves implementing the corresponding release function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A possible memory leak in the `ptp clock register()` function has been resolved. The memory leak occurs when `posix clock register()` returns an error, causing the name allocated in `dev set name()` to be leaked. To fix this issue, the `put device()` function should be used to give up the device reference, allowing the name to be freed in `kobject cleanup()` and other memory to be freed in `ptp clock release()`. The leak was identified through a fault injection test, which revealed an unreferenced object. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.15.0-rc2-00142-g9978db750e31-dirty #11 **Description** The vulnerability is related to the `devm regmap init encx24j600` function in the Linux kernel, which may return an error due to out-of-memory conditions, resulting in a null pointer dereference when reading or writing registers. This can cause a general protection fault in the `encx24j600 spi probe` function. The issue is related to the `encx24j600` component of the Linux kernel. **Recommendations** To resolve the issue, add an error check in the `devm regmap init encx24j600` function to avoid the null pointer dereference situation. As a temporary workaround, consider disabling the `encx24j600` component until a patch is available. However, since the provided information does not specify a fixed version, it is essential to monitor for updates that include the necessary error check in `devm regmap init encx24j600`. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A memory leak issue has been resolved in the Linux kernel. The problem occurs when using `single open()` for opening, and `single release()` is not called, resulting in a memory leak of the 'op' allocated in `single open()`. This issue is related to the `drm/nouveau/kms/nv50-` component. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.