linux-kernel - Re: [PATCH] Add vulnerable commits for few CVEs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2025051059-knapsack-imbecile-9bb0@gregkh>
Date: Sat, 10 May 2025 18:47:21 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>
Cc: cve@...nel.org, linux-kernel@...r.kernel.org, vegard.nossum@...cle.com
Subject: Re: [PATCH] Add vulnerable commits for few CVEs

On Sat, May 10, 2025 at 09:10:43AM -0700, Harshit Mogalapalli wrote:
> CVE-2025-21872: Re-mapping the entire mokvar_table is the problem and
> the re-mapping is first done in this Fixes: 58c909022a5a ("efi: Support
> for MOK variable config table"), so this is the broken commit
> 
> CVE-2025-21833: The fix moves dev_pasid dereference inside
> WARN_ON_ONCE() as there is a possibility of dev_pasid being NULL, this
> dereference is first introduced while adding debugfs support per file in
> Fixes: d87731f60931 ("iommu/vt-d: debugfs: Create/remove debugfs file
> per {device, pasid}")
> 
> CVE-2025-21832E: The problem is that iov_iter_revert() is done before a

I don't think CVE entries have "E" on the end of them :)

I'll edit this when I apply it in a few minutes, thanks!

greg k-h