# Vulnerabilities published in 2024


- [CVE-2024-53105](https://insights.sbomify.com/CVE-2024-53105/): mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (medium 5.5)
- [CVE-2024-53104](https://insights.sbomify.com/CVE-2024-53104/): Linux Kernel Out-of-Bounds Write (high 7.8, exploited in the wild)
- [CVE-2024-53103](https://insights.sbomify.com/CVE-2024-53103/): hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer (high 7.8)
- [CVE-2024-53101](https://insights.sbomify.com/CVE-2024-53101/): fs: Fix uninitialized value issue in from_kuid and from_kgid (medium 5.5)
- [CVE-2024-53100](https://insights.sbomify.com/CVE-2024-53100/): nvme: tcp: avoid race between queue_lock lock and destroy (high 7.8)
- [CVE-2024-5310](https://insights.sbomify.com/CVE-2024-5310/): JFinalCMS content cross site scripting (medium 5.1)
- [CVE-2024-53099](https://insights.sbomify.com/CVE-2024-53099/): bpf: Check validity of link->type in bpf_link_show_fdinfo() (high 7.1)
- [CVE-2024-53098](https://insights.sbomify.com/CVE-2024-53098/): drm/xe/ufence: Prefetch ufence addr to catch bogus address (high 7.8)
- [CVE-2024-53097](https://insights.sbomify.com/CVE-2024-53097/): mm: krealloc: Fix MTE false alarm in __do_krealloc (medium 5.5)
- [CVE-2024-53096](https://insights.sbomify.com/CVE-2024-53096/): mm: resolve faulty mmap_region() error path behaviour (high 7.8)
- [CVE-2024-53095](https://insights.sbomify.com/CVE-2024-53095/): smb: client: Fix use-after-free of network namespace. (critical 9.8)
- [CVE-2024-53094](https://insights.sbomify.com/CVE-2024-53094/): RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES (critical 9.8)
- [CVE-2024-53093](https://insights.sbomify.com/CVE-2024-53093/): nvme-multipath: defer partition scanning (high 7.5)
- [CVE-2024-53092](https://insights.sbomify.com/CVE-2024-53092/): virtio_pci: Fix admin vq cleanup by using correct info pointer (high 8.4)
- [CVE-2024-53091](https://insights.sbomify.com/CVE-2024-53091/): bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (high 7.8)
- [CVE-2024-53090](https://insights.sbomify.com/CVE-2024-53090/): afs: Fix lock recursion (high 7.5)
- [CVE-2024-5309](https://insights.sbomify.com/CVE-2024-5309/): Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions (medium 5.4)
- [CVE-2024-53089](https://insights.sbomify.com/CVE-2024-53089/): LoongArch: KVM: Mark hrtimer to expire in hard interrupt context (medium 5.5)
- [CVE-2024-53088](https://insights.sbomify.com/CVE-2024-53088/): i40e: fix race condition by adding filter's intermediate sync state (high 7.8)
- [CVE-2024-53087](https://insights.sbomify.com/CVE-2024-53087/): drm/xe: Fix possible exec queue leak in exec IOCTL (medium 5.5)
- [CVE-2024-53086](https://insights.sbomify.com/CVE-2024-53086/): drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL (medium 5.5)
- [CVE-2024-53085](https://insights.sbomify.com/CVE-2024-53085/): tpm: Lock TPM chip in tpm_pm_suspend() first (medium 5.5)
- [CVE-2024-53084](https://insights.sbomify.com/CVE-2024-53084/): drm/imagination: Break an object reference loop (medium 5.5)
- [CVE-2024-53083](https://insights.sbomify.com/CVE-2024-53083/): usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier (medium 5.5)
- [CVE-2024-53082](https://insights.sbomify.com/CVE-2024-53082/): virtio_net: Add hash_key_length check (high 8.4)
- [CVE-2024-53081](https://insights.sbomify.com/CVE-2024-53081/): media: ar0521: don't overflow when checking PLL values (medium 5.5)
- [CVE-2024-53080](https://insights.sbomify.com/CVE-2024-53080/): drm/panthor: Lock XArray when getting entries for the VM (high 7.8)
- [CVE-2024-53079](https://insights.sbomify.com/CVE-2024-53079/): mm/thp: fix deferred split unqueue naming and locking (high 7.8)
- [CVE-2024-53078](https://insights.sbomify.com/CVE-2024-53078/): drm/tegra: Fix NULL vs IS_ERR() check in probe() (medium 5.5)
- [CVE-2024-53077](https://insights.sbomify.com/CVE-2024-53077/): rpcrdma: Always release the rpcrdma_device's xa_array (medium 5.5)
- [CVE-2024-53076](https://insights.sbomify.com/CVE-2024-53076/): iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table() (high 7.8)
- [CVE-2024-53075](https://insights.sbomify.com/CVE-2024-53075/): riscv: Prevent a bad reference count on CPU nodes (medium 5.5)
- [CVE-2024-53074](https://insights.sbomify.com/CVE-2024-53074/): wifi: iwlwifi: mvm: don't leak a link on AP removal (medium 5.5)
- [CVE-2024-53073](https://insights.sbomify.com/CVE-2024-53073/): NFSD: Never decrement pending_async_copies on error (high 7.5)
- [CVE-2024-53072](https://insights.sbomify.com/CVE-2024-53072/): platform/x86/amd/pmc: Detect when STB is not available (medium 5.5)
- [CVE-2024-53071](https://insights.sbomify.com/CVE-2024-53071/): drm/panthor: Be stricter about IO mapping flags (medium 5.5)
- [CVE-2024-53070](https://insights.sbomify.com/CVE-2024-53070/): usb: dwc3: fix fault at system suspend if device was already runtime suspended (medium 5.5)
- [CVE-2024-5307](https://insights.sbomify.com/CVE-2024-5307/): Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-53069](https://insights.sbomify.com/CVE-2024-53069/): firmware: qcom: scm: fix a NULL-pointer dereference (medium 5.5)
- [CVE-2024-53068](https://insights.sbomify.com/CVE-2024-53068/): firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() (high 7.8)
- [CVE-2024-53067](https://insights.sbomify.com/CVE-2024-53067/): scsi: ufs: core: Start the RTC update work later (medium 5.5)
- [CVE-2024-53066](https://insights.sbomify.com/CVE-2024-53066/): nfs: Fix KMSAN warning in decode_getfattr_attrs() (critical 9.8)
- [CVE-2024-53065](https://insights.sbomify.com/CVE-2024-53065/): mm/slab: fix warning caused by duplicate kmem_cache creation in kmem_buckets_create (medium 5.5)
- [CVE-2024-53064](https://insights.sbomify.com/CVE-2024-53064/): idpf: fix idpf_vc_core_init error path (medium 5.5)
- [CVE-2024-53063](https://insights.sbomify.com/CVE-2024-53063/): media: dvbdev: prevent the risk of out of memory access (high 7.8)
- [CVE-2024-53062](https://insights.sbomify.com/CVE-2024-53062/): media: mgb4: protect driver against spectre (high 7.1)
- [CVE-2024-53061](https://insights.sbomify.com/CVE-2024-53061/): media: s5p-jpeg: prevent buffer overflows (high 7.3)
- [CVE-2024-53060](https://insights.sbomify.com/CVE-2024-53060/): drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported (medium 5.5)
- [CVE-2024-5306](https://insights.sbomify.com/CVE-2024-5306/): Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-53059](https://insights.sbomify.com/CVE-2024-53059/): wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() (high 7.1)
- [CVE-2024-53058](https://insights.sbomify.com/CVE-2024-53058/): net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (critical 9.4)
- [CVE-2024-53057](https://insights.sbomify.com/CVE-2024-53057/): net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (high 7.8)
- [CVE-2024-53056](https://insights.sbomify.com/CVE-2024-53056/): drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (medium 5.5)
- [CVE-2024-53055](https://insights.sbomify.com/CVE-2024-53055/): wifi: iwlwifi: mvm: fix 6 GHz scan construction (medium 5.5)
- [CVE-2024-53053](https://insights.sbomify.com/CVE-2024-53053/): scsi: ufs: core: Fix another deadlock during RTC update (medium 5.5)
- [CVE-2024-53052](https://insights.sbomify.com/CVE-2024-53052/): io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (medium 4.4)
- [CVE-2024-53051](https://insights.sbomify.com/CVE-2024-53051/): drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (medium 5.5)
- [CVE-2024-53050](https://insights.sbomify.com/CVE-2024-53050/): drm/i915/hdcp: Add encoder check in hdcp2_get_capability (medium 5.5)
- [CVE-2024-5305](https://insights.sbomify.com/CVE-2024-5305/): Kofax Power PDF PDF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-53049](https://insights.sbomify.com/CVE-2024-53049/): slub/kunit: fix a WARNING due to unwrapped __kmalloc_cache_noprof (medium 5.5)
- [CVE-2024-53048](https://insights.sbomify.com/CVE-2024-53048/): ice: fix crash on probe for DPLL enabled E810 LOM (medium 5.5)
- [CVE-2024-53047](https://insights.sbomify.com/CVE-2024-53047/): mptcp: init: protect sched with rcu_read_lock (medium 5.5)
- [CVE-2024-53046](https://insights.sbomify.com/CVE-2024-53046/): arm64: dts: imx8ulp: correct the flexspi compatible string (medium 5.5)
- [CVE-2024-53045](https://insights.sbomify.com/CVE-2024-53045/): ASoC: dapm: fix bounds checker error in dapm_widget_list_create (medium 5.5)
- [CVE-2024-53044](https://insights.sbomify.com/CVE-2024-53044/): net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext() (high 7.8)
- [CVE-2024-53043](https://insights.sbomify.com/CVE-2024-53043/): mctp i2c: handle NULL header address (medium 5.5)
- [CVE-2024-53042](https://insights.sbomify.com/CVE-2024-53042/): ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() (medium 5.5)
- [CVE-2024-53041](https://insights.sbomify.com/CVE-2024-53041/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-5304](https://insights.sbomify.com/CVE-2024-5304/): Kofax Power PDF TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-53034](https://insights.sbomify.com/CVE-2024-53034/): Untrusted Pointer Dereference in DSP_Services (high 7.8)
- [CVE-2024-53033](https://insights.sbomify.com/CVE-2024-53033/): Untrusted Pointer Dereference in DSP_Services (high 7.8)
- [CVE-2024-53032](https://insights.sbomify.com/CVE-2024-53032/): Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform (high 7.8)
- [CVE-2024-53031](https://insights.sbomify.com/CVE-2024-53031/): Improper Input Validation in Automotive OS Platform (high 7.8)
- [CVE-2024-53030](https://insights.sbomify.com/CVE-2024-53030/): Improper Input Validation in Automotive OS Platform (high 7.8)
- [CVE-2024-5303](https://insights.sbomify.com/CVE-2024-5303/): Kofax Power PDF PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-53029](https://insights.sbomify.com/CVE-2024-53029/): Improper Input Validation in Automotive OS Platform (high 7.8)
- [CVE-2024-53028](https://insights.sbomify.com/CVE-2024-53028/): Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Vehicle Networks (high 7.8)
- [CVE-2024-53027](https://insights.sbomify.com/CVE-2024-53027/): Buffer Copy Without Checking Size of Input in WLAN Host (high 7.5)
- [CVE-2024-53026](https://insights.sbomify.com/CVE-2024-53026/): Buffer Over-read in Data Network Stack & Connectivity (high 8.2)
- [CVE-2024-53025](https://insights.sbomify.com/CVE-2024-53025/): Integer Overflow or Wraparound in BT Controller (medium 5.5)
- [CVE-2024-53024](https://insights.sbomify.com/CVE-2024-53024/): NULL Pointer Dereference in Display (high 7.8)
- [CVE-2024-53023](https://insights.sbomify.com/CVE-2024-53023/): Use After Free in Automotive Android OS (high 7.8)
- [CVE-2024-53022](https://insights.sbomify.com/CVE-2024-53022/): Improper Input Validation in Automotive OS Platform (high 7.8)
- [CVE-2024-53021](https://insights.sbomify.com/CVE-2024-53021/): Buffer Over-read in Data Network Stack & Connectivity (high 8.2)
- [CVE-2024-53020](https://insights.sbomify.com/CVE-2024-53020/): Buffer Over-read in Data Network Stack & Connectivity (high 8.2)
- [CVE-2024-5302](https://insights.sbomify.com/CVE-2024-5302/): Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-53019](https://insights.sbomify.com/CVE-2024-53019/): Buffer Over-read in Data Network Stack & Connectivity (high 8.2)
- [CVE-2024-53018](https://insights.sbomify.com/CVE-2024-53018/): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver (medium 6.6)
- [CVE-2024-53017](https://insights.sbomify.com/CVE-2024-53017/): Use of Out-of-range Pointer Offset in Camera Driver (medium 6.6)
- [CVE-2024-53016](https://insights.sbomify.com/CVE-2024-53016/): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver (medium 6.6)
- [CVE-2024-53015](https://insights.sbomify.com/CVE-2024-53015/): Use After Free in Computer Vision (medium 6.6)
- [CVE-2024-53014](https://insights.sbomify.com/CVE-2024-53014/): Improper Validation of Array Index in Audio (high 7.8)
- [CVE-2024-53013](https://insights.sbomify.com/CVE-2024-53013/): Buffer Copy Without Checking Size of Input in Audio (medium 6.6)
- [CVE-2024-53012](https://insights.sbomify.com/CVE-2024-53012/): Improper Input Validation in Automotive OS Platform (high 7.8)
- [CVE-2024-53011](https://insights.sbomify.com/CVE-2024-53011/): Permissions, Privileges, and Access Controls in Video Analytics and Processing (high 7.9)
- [CVE-2024-53010](https://insights.sbomify.com/CVE-2024-53010/): Improper Access Control in Core (high 7.8)
- [CVE-2024-5301](https://insights.sbomify.com/CVE-2024-5301/): Kofax Power PDF PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-53009](https://insights.sbomify.com/CVE-2024-53009/): Improper Validation of Array Index in Automotive Autonomy (medium 5.3)
- [CVE-2024-53008](https://insights.sbomify.com/CVE-2024-53008/): Security feature bypass in HAProxy 2.6 (medium 5.3)
- [CVE-2024-53007](https://insights.sbomify.com/CVE-2024-53007/): SQL injection in ProjectWise Integration Server (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/209/