# Vulnerabilities published in 2024


- [CVE-2024-53199](https://insights.sbomify.com/CVE-2024-53199/): ASoC: imx-audmix: Add NULL check in imx_audmix_probe (medium 5.5)
- [CVE-2024-53198](https://insights.sbomify.com/CVE-2024-53198/): xen: Fix the issue of resource not being properly released in xenbus_dev_probe() (high 7.8)
- [CVE-2024-53197](https://insights.sbomify.com/CVE-2024-53197/): Linux Kernel Out-of-Bounds Access (high 7.8, exploited in the wild)
- [CVE-2024-53196](https://insights.sbomify.com/CVE-2024-53196/): KVM: arm64: Don't retire aborted MMIO instruction (medium 5.5)
- [CVE-2024-53195](https://insights.sbomify.com/CVE-2024-53195/): KVM: arm64: Get rid of userspace_irqchip_in_use (medium 5.5)
- [CVE-2024-53194](https://insights.sbomify.com/CVE-2024-53194/): PCI: Fix use-after-free of slot->bus on hot remove (high 7.8)
- [CVE-2024-53193](https://insights.sbomify.com/CVE-2024-53193/): clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider (high 7.8)
- [CVE-2024-53192](https://insights.sbomify.com/CVE-2024-53192/): clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access (high 7.8)
- [CVE-2024-53191](https://insights.sbomify.com/CVE-2024-53191/): wifi: ath12k: fix warning when unbinding (high 7.8)
- [CVE-2024-53190](https://insights.sbomify.com/CVE-2024-53190/): wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (medium 5.5)
- [CVE-2024-53189](https://insights.sbomify.com/CVE-2024-53189/): wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan (medium 5.5)
- [CVE-2024-53188](https://insights.sbomify.com/CVE-2024-53188/): wifi: ath12k: fix crash when unbinding (high 7.8)
- [CVE-2024-53187](https://insights.sbomify.com/CVE-2024-53187/): io_uring: check for overflows in io_pin_pages (medium 5.5)
- [CVE-2024-53186](https://insights.sbomify.com/CVE-2024-53186/): ksmbd: fix use-after-free in SMB request handling (critical 9.8)
- [CVE-2024-53185](https://insights.sbomify.com/CVE-2024-53185/): smb: client: fix NULL ptr deref in crypto_aead_setkey() (high 7.5)
- [CVE-2024-53184](https://insights.sbomify.com/CVE-2024-53184/): um: ubd: Do not use drvdata in release (medium 5.5)
- [CVE-2024-53183](https://insights.sbomify.com/CVE-2024-53183/): um: net: Do not use drvdata in release (medium 5.5)
- [CVE-2024-53182](https://insights.sbomify.com/CVE-2024-53182/): Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()" (high 7.8)
- [CVE-2024-53181](https://insights.sbomify.com/CVE-2024-53181/): um: vector: Do not use drvdata in release (medium 5.5)
- [CVE-2024-53180](https://insights.sbomify.com/CVE-2024-53180/): ALSA: pcm: Add sanity NULL check for the default mmap fault handler (medium 5.5)
- [CVE-2024-5318](https://insights.sbomify.com/CVE-2024-5318/): Missing Authorization in GitLab (medium 4.0)
- [CVE-2024-53179](https://insights.sbomify.com/CVE-2024-53179/): smb: client: fix use-after-free of signing key (critical 9.8)
- [CVE-2024-53178](https://insights.sbomify.com/CVE-2024-53178/): smb: Don't leak cfid when reconnect races with open_cached_dir (high 7.5)
- [CVE-2024-53177](https://insights.sbomify.com/CVE-2024-53177/): smb: prevent use-after-free due to open_cached_dir error paths (critical 9.8)
- [CVE-2024-53176](https://insights.sbomify.com/CVE-2024-53176/): smb: During unmount, ensure all cached dir instances drop their dentry (critical 9.8)
- [CVE-2024-53175](https://insights.sbomify.com/CVE-2024-53175/): ipc: fix memleak if msg_init_ns failed in create_ipc_ns (medium 5.5)
- [CVE-2024-53174](https://insights.sbomify.com/CVE-2024-53174/): SUNRPC: make sure cache entry active before cache_show (high 7.8)
- [CVE-2024-53173](https://insights.sbomify.com/CVE-2024-53173/): NFSv4.0: Fix a use-after-free problem in the asynchronous open() (high 7.8)
- [CVE-2024-53172](https://insights.sbomify.com/CVE-2024-53172/): ubi: fastmap: Fix duplicate slab cache names while attaching (medium 5.5)
- [CVE-2024-53171](https://insights.sbomify.com/CVE-2024-53171/): ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit (high 7.8)
- [CVE-2024-53170](https://insights.sbomify.com/CVE-2024-53170/): block: fix uaf for flush rq while iterating tags (high 7.8)
- [CVE-2024-5317](https://insights.sbomify.com/CVE-2024-5317/): Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1 (medium 6.4)
- [CVE-2024-53169](https://insights.sbomify.com/CVE-2024-53169/): nvme-fabrics: fix kernel crash while shutting down controller (critical 9.8)
- [CVE-2024-53168](https://insights.sbomify.com/CVE-2024-53168/): sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (high 7.8)
- [CVE-2024-53167](https://insights.sbomify.com/CVE-2024-53167/): nfs/blocklayout: Don't attempt unregister for invalid block device (high 7.5)
- [CVE-2024-53166](https://insights.sbomify.com/CVE-2024-53166/): block, bfq: fix bfqq uaf in bfq_limit_depth() (high 7.8)
- [CVE-2024-53165](https://insights.sbomify.com/CVE-2024-53165/): sh: intc: Fix use-after-free bug in register_intc_controller() (high 7.4)
- [CVE-2024-53164](https://insights.sbomify.com/CVE-2024-53164/): net: sched: fix ordering of qlen adjustment (high 7.8)
- [CVE-2024-53163](https://insights.sbomify.com/CVE-2024-53163/): crypto: qat/qat_420xx - fix off by one in uof_get_name() (medium 5.5)
- [CVE-2024-53162](https://insights.sbomify.com/CVE-2024-53162/): crypto: qat/qat_4xxx - fix off by one in uof_get_name() (high 7.1)
- [CVE-2024-53161](https://insights.sbomify.com/CVE-2024-53161/): EDAC/bluefield: Fix potential integer overflow (medium 5.5)
- [CVE-2024-53160](https://insights.sbomify.com/CVE-2024-53160/): rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (medium 4.7)
- [CVE-2024-53158](https://insights.sbomify.com/CVE-2024-53158/): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() (medium 5.5)
- [CVE-2024-53157](https://insights.sbomify.com/CVE-2024-53157/): firmware: arm_scpi: Check the DVFS OPP count returned by the firmware (medium 5.5)
- [CVE-2024-53156](https://insights.sbomify.com/CVE-2024-53156/): wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (high 7.8)
- [CVE-2024-53155](https://insights.sbomify.com/CVE-2024-53155/): ocfs2: fix uninitialized value in ocfs2_file_read_iter() (high 7.1)
- [CVE-2024-53154](https://insights.sbomify.com/CVE-2024-53154/): clk: clk-apple-nco: Add NULL check in applnco_probe (medium 5.5)
- [CVE-2024-53153](https://insights.sbomify.com/CVE-2024-53153/): PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() (medium 5.5)
- [CVE-2024-53152](https://insights.sbomify.com/CVE-2024-53152/): PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() (medium 5.5)
- [CVE-2024-53151](https://insights.sbomify.com/CVE-2024-53151/): svcrdma: Address an integer overflow (high 7.5)
- [CVE-2024-53150](https://insights.sbomify.com/CVE-2024-53150/): Linux Kernel Out-of-Bounds Read (high 7.1, exploited in the wild)
- [CVE-2024-5315](https://insights.sbomify.com/CVE-2024-5315/): Multiple vulnerabilities in DOLIBARR's ERP CMS (critical 9.1)
- [CVE-2024-53149](https://insights.sbomify.com/CVE-2024-53149/): usb: typec: ucsi: glink: fix off-by-one in connector_status (medium 4.6)
- [CVE-2024-53148](https://insights.sbomify.com/CVE-2024-53148/): comedi: Flush partial mappings in error case (high 7.8)
- [CVE-2024-53147](https://insights.sbomify.com/CVE-2024-53147/): exfat: fix out-of-bounds access of directory entries (high 7.8)
- [CVE-2024-53146](https://insights.sbomify.com/CVE-2024-53146/): NFSD: Prevent a potential integer overflow (critical 9.1)
- [CVE-2024-53145](https://insights.sbomify.com/CVE-2024-53145/): um: Fix potential integer overflow during physmem setup (medium 5.5)
- [CVE-2024-53144](https://insights.sbomify.com/CVE-2024-53144/): Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE (high 8.8)
- [CVE-2024-53143](https://insights.sbomify.com/CVE-2024-53143/): fsnotify: Fix ordering of iput() and watched_objects decrement (high 7.8)
- [CVE-2024-53142](https://insights.sbomify.com/CVE-2024-53142/): initramfs: avoid filename buffer overrun (high 7.8)
- [CVE-2024-53141](https://insights.sbomify.com/CVE-2024-53141/): netfilter: ipset: add missing range check in bitmap_ip_uadt (high 7.8)
- [CVE-2024-53140](https://insights.sbomify.com/CVE-2024-53140/): netlink: terminate outstanding dump on socket close (high 7.8)
- [CVE-2024-5314](https://insights.sbomify.com/CVE-2024-5314/): Multiple vulnerabilities in DOLIBARR's ERP CMS (critical 9.1)
- [CVE-2024-53139](https://insights.sbomify.com/CVE-2024-53139/): sctp: fix possible UAF in sctp_v6_available() (high 7.8)
- [CVE-2024-53138](https://insights.sbomify.com/CVE-2024-53138/): net/mlx5e: kTLS, Fix incorrect page refcounting (critical 9.8)
- [CVE-2024-53137](https://insights.sbomify.com/CVE-2024-53137/): ARM: fix cacheflush with PAN (medium 5.5)
- [CVE-2024-53136](https://insights.sbomify.com/CVE-2024-53136/): mm: revert "mm: shmem: fix data-race in shmem_getattr()" (high 7.5)
- [CVE-2024-53135](https://insights.sbomify.com/CVE-2024-53135/): KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (high 8.8)
- [CVE-2024-53134](https://insights.sbomify.com/CVE-2024-53134/): pmdomain: imx93-blk-ctrl: correct remove path (medium 5.5)
- [CVE-2024-53133](https://insights.sbomify.com/CVE-2024-53133/): drm/amd/display: Handle dml allocation failure to avoid crash (high 7.8)
- [CVE-2024-53132](https://insights.sbomify.com/CVE-2024-53132/): drm/xe/oa: Fix "Missing outer runtime PM protection" warning (medium 5.5)
- [CVE-2024-53131](https://insights.sbomify.com/CVE-2024-53131/): nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (medium 5.5)
- [CVE-2024-53130](https://insights.sbomify.com/CVE-2024-53130/): nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (medium 5.5)
- [CVE-2024-5313](https://insights.sbomify.com/CVE-2024-5313/): Misconfiguration in EVlink Home Smart (medium 6.5)
- [CVE-2024-53129](https://insights.sbomify.com/CVE-2024-53129/): drm/rockchip: vop: Fix a dereferenced before check warning (medium 5.5)
- [CVE-2024-53128](https://insights.sbomify.com/CVE-2024-53128/): sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers (medium 5.5)
- [CVE-2024-53127](https://insights.sbomify.com/CVE-2024-53127/): Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" (high 7.8)
- [CVE-2024-53126](https://insights.sbomify.com/CVE-2024-53126/): vdpa: solidrun: Fix UB bug with devres (high 7.1)
- [CVE-2024-53125](https://insights.sbomify.com/CVE-2024-53125/): bpf: sync_linked_regs() must preserve subreg_def (high 7.8)
- [CVE-2024-53124](https://insights.sbomify.com/CVE-2024-53124/): net: fix data-races around sk->sk_forward_alloc (high 7.5)
- [CVE-2024-53123](https://insights.sbomify.com/CVE-2024-53123/): mptcp: error out earlier on disconnect (medium 5.5)
- [CVE-2024-53122](https://insights.sbomify.com/CVE-2024-53122/): mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (high 7.5)
- [CVE-2024-53121](https://insights.sbomify.com/CVE-2024-53121/): net/mlx5: fs, lock FTE when checking if active (high 7.8)
- [CVE-2024-53120](https://insights.sbomify.com/CVE-2024-53120/): net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (high 7.5)
- [CVE-2024-5312](https://insights.sbomify.com/CVE-2024-5312/): Cross-Site Scripting vulnerability in PHP Server Monitor (medium 6.3)
- [CVE-2024-53119](https://insights.sbomify.com/CVE-2024-53119/): virtio/vsock: Fix accept_queue memory leak (medium 5.5)
- [CVE-2024-53118](https://insights.sbomify.com/CVE-2024-53118/): vsock: Fix sk_error_queue memory leak (medium 5.5)
- [CVE-2024-53117](https://insights.sbomify.com/CVE-2024-53117/): virtio/vsock: Improve MSG_ZEROCOPY error handling (medium 5.5)
- [CVE-2024-53116](https://insights.sbomify.com/CVE-2024-53116/): drm/panthor: Fix handling of partial GPU mapping of BOs (medium 5.5)
- [CVE-2024-53115](https://insights.sbomify.com/CVE-2024-53115/): drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle (medium 5.5)
- [CVE-2024-53114](https://insights.sbomify.com/CVE-2024-53114/): x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client (medium 5.5)
- [CVE-2024-53113](https://insights.sbomify.com/CVE-2024-53113/): mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (medium 5.5)
- [CVE-2024-53112](https://insights.sbomify.com/CVE-2024-53112/): ocfs2: uncache inode which has failed entering the group (medium 5.5)
- [CVE-2024-53111](https://insights.sbomify.com/CVE-2024-53111/): mm/mremap: fix address wraparound in move_page_tables() (high 7.1)
- [CVE-2024-53110](https://insights.sbomify.com/CVE-2024-53110/): vp_vdpa: fix id_table array not null terminated error (high 7.3)
- [CVE-2024-5311](https://insights.sbomify.com/CVE-2024-5311/): DigiWin EasyFlow .NET - SQL Injection (critical 9.8)
- [CVE-2024-53109](https://insights.sbomify.com/CVE-2024-53109/): nommu: pass NULL argument to vma_iter_prealloc() (high 7.8)
- [CVE-2024-53108](https://insights.sbomify.com/CVE-2024-53108/): drm/amd/display: Adjust VSDB parser for replay feature (high 7.3)
- [CVE-2024-53107](https://insights.sbomify.com/CVE-2024-53107/): fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args() (high 7.8)
- [CVE-2024-53106](https://insights.sbomify.com/CVE-2024-53106/): ima: fix buffer overrun in ima_eventdigest_init_common (high 7.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/208/