# Vulnerabilities published in 2024


- [CVE-2024-50298](https://insights.sbomify.com/CVE-2024-50298/): net: enetc: allocate vf_state during PF probes (medium 5.5)
- [CVE-2024-50297](https://insights.sbomify.com/CVE-2024-50297/): net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts (high 7.5)
- [CVE-2024-50296](https://insights.sbomify.com/CVE-2024-50296/): net: hns3: fix kernel crash when uninstalling driver (medium 5.5)
- [CVE-2024-50295](https://insights.sbomify.com/CVE-2024-50295/): net: arc: fix the device for dma_map_single/dma_unmap_single (medium 5.5)
- [CVE-2024-50294](https://insights.sbomify.com/CVE-2024-50294/): rxrpc: Fix missing locking causing hanging calls (high 7.8)
- [CVE-2024-50293](https://insights.sbomify.com/CVE-2024-50293/): net/smc: do not leave a dangling sk pointer in __smc_create() (high 7.8)
- [CVE-2024-50292](https://insights.sbomify.com/CVE-2024-50292/): ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove (medium 5.5)
- [CVE-2024-50291](https://insights.sbomify.com/CVE-2024-50291/): media: dvb-core: add missing buffer index check (high 7.8)
- [CVE-2024-50290](https://insights.sbomify.com/CVE-2024-50290/): media: cx24116: prevent overflows on SNR calculus (medium 5.5)
- [CVE-2024-5029](https://insights.sbomify.com/CVE-2024-5029/): CM Table Of Contents – WordPress TOC Plugin < 1.2.4 - Stored XSS via CSRF (medium 4.8)
- [CVE-2024-50289](https://insights.sbomify.com/CVE-2024-50289/): media: av7110: fix a spectre vulnerability (medium 5.5)
- [CVE-2024-50288](https://insights.sbomify.com/CVE-2024-50288/): media: vivid: fix buffer overwrite when using > 32 buffers (high 7.8)
- [CVE-2024-50287](https://insights.sbomify.com/CVE-2024-50287/): media: v4l2-tpg: prevent the risk of a division by zero (medium 5.5)
- [CVE-2024-50286](https://insights.sbomify.com/CVE-2024-50286/): ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create (critical 9.8)
- [CVE-2024-50285](https://insights.sbomify.com/CVE-2024-50285/): ksmbd: check outstanding simultaneous SMB operations (high 7.5)
- [CVE-2024-50284](https://insights.sbomify.com/CVE-2024-50284/): ksmbd: Fix the missing xa_store error check (high 7.5)
- [CVE-2024-50283](https://insights.sbomify.com/CVE-2024-50283/): ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp (critical 9.8)
- [CVE-2024-50282](https://insights.sbomify.com/CVE-2024-50282/): drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() (high 7.8)
- [CVE-2024-50281](https://insights.sbomify.com/CVE-2024-50281/): KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation (high 7.8)
- [CVE-2024-50280](https://insights.sbomify.com/CVE-2024-50280/): dm cache: fix flushing uninitialized delayed_work on cache_ctr error (high 7.8)
- [CVE-2024-5028](https://insights.sbomify.com/CVE-2024-5028/): CM WordPress Search And Replace Plugin < 1.3.9 - Plugin Reset via CSRF (medium 6.5)
- [CVE-2024-50279](https://insights.sbomify.com/CVE-2024-50279/): dm cache: fix out-of-bounds access to the dirty bitset when resizing (high 7.1)
- [CVE-2024-50278](https://insights.sbomify.com/CVE-2024-50278/): dm cache: fix potential out-of-bounds access on the first resume (high 7.1)
- [CVE-2024-50277](https://insights.sbomify.com/CVE-2024-50277/): dm: fix a crash if blk_alloc_disk fails (medium 4.7)
- [CVE-2024-50276](https://insights.sbomify.com/CVE-2024-50276/): net: vertexcom: mse102x: Fix possible double free of TX skb (critical 9.8)
- [CVE-2024-50275](https://insights.sbomify.com/CVE-2024-50275/): arm64/sve: Discard stale CPU state when handling SVE traps (high 7.3)
- [CVE-2024-50274](https://insights.sbomify.com/CVE-2024-50274/): idpf: avoid vport access in idpf_get_link_ksettings (high 7.8)
- [CVE-2024-50273](https://insights.sbomify.com/CVE-2024-50273/): btrfs: reinitialize delayed ref list after deleting it from the list (high 7.8)
- [CVE-2024-50272](https://insights.sbomify.com/CVE-2024-50272/): filemap: Fix bounds checking in filemap_read() (medium 5.5)
- [CVE-2024-50271](https://insights.sbomify.com/CVE-2024-50271/): signal: restore the override_rlimit logic (medium 5.5)
- [CVE-2024-50270](https://insights.sbomify.com/CVE-2024-50270/): mm/damon/core: avoid overflow in damon_feed_loop_next_input() (medium 5.5)
- [CVE-2024-50269](https://insights.sbomify.com/CVE-2024-50269/): usb: musb: sunxi: Fix accessing an released usb phy (high 7.8)
- [CVE-2024-50268](https://insights.sbomify.com/CVE-2024-50268/): usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() (high 7.8)
- [CVE-2024-50267](https://insights.sbomify.com/CVE-2024-50267/): USB: serial: io_edgeport: fix use after free in debug printk (high 7.8)
- [CVE-2024-50266](https://insights.sbomify.com/CVE-2024-50266/): clk: qcom: videocc-sm8350: use HW_CTRL_TRIGGER for vcodec GDSCs (medium 5.5)
- [CVE-2024-50265](https://insights.sbomify.com/CVE-2024-50265/): ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() (medium 5.5)
- [CVE-2024-50264](https://insights.sbomify.com/CVE-2024-50264/): vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (high 7.8)
- [CVE-2024-50263](https://insights.sbomify.com/CVE-2024-50263/): fork: only invoke khugepaged, ksm hooks if no error (high 7.8)
- [CVE-2024-50262](https://insights.sbomify.com/CVE-2024-50262/): bpf: Fix out-of-bounds write in trie_get_next_key() (high 7.8)
- [CVE-2024-50261](https://insights.sbomify.com/CVE-2024-50261/): macsec: Fix use-after-free while sending the offloading packet (high 7.8)
- [CVE-2024-50260](https://insights.sbomify.com/CVE-2024-50260/): sock_map: fix a NULL pointer dereference in sock_map_link_update_prog() (medium 4.7)
- [CVE-2024-5026](https://insights.sbomify.com/CVE-2024-5026/): CM Tooltip Glossary < 4.3.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-50259](https://insights.sbomify.com/CVE-2024-50259/): netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (medium 5.5)
- [CVE-2024-50258](https://insights.sbomify.com/CVE-2024-50258/): net: fix crash when config small gso_max_size/gso_ipv4_max_size (medium 5.5)
- [CVE-2024-50257](https://insights.sbomify.com/CVE-2024-50257/): netfilter: Fix use-after-free in get_info() (high 7.0)
- [CVE-2024-50256](https://insights.sbomify.com/CVE-2024-50256/): netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (high 7.5)
- [CVE-2024-50255](https://insights.sbomify.com/CVE-2024-50255/): Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs (medium 5.5)
- [CVE-2024-50254](https://insights.sbomify.com/CVE-2024-50254/): bpf: Free dynamically allocated bits in bpf_iter_bits_destroy() (medium 5.5)
- [CVE-2024-50253](https://insights.sbomify.com/CVE-2024-50253/): bpf: Check the validity of nr_words in bpf_iter_bits_new() (high 7.8)
- [CVE-2024-50252](https://insights.sbomify.com/CVE-2024-50252/): mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (medium 5.5)
- [CVE-2024-50251](https://insights.sbomify.com/CVE-2024-50251/): netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (medium 6.2)
- [CVE-2024-50250](https://insights.sbomify.com/CVE-2024-50250/): fsdax: dax_unshare_iter needs to copy entire blocks (high 7.8)
- [CVE-2024-5025](https://insights.sbomify.com/CVE-2024-5025/): MemberPress <= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter (medium 6.4)
- [CVE-2024-50249](https://insights.sbomify.com/CVE-2024-50249/): ACPI: CPPC: Make rmw_lock a raw_spin_lock (medium 5.5)
- [CVE-2024-50248](https://insights.sbomify.com/CVE-2024-50248/): ntfs3: Add bounds checking to mi_enum_attr() (high 7.1)
- [CVE-2024-50247](https://insights.sbomify.com/CVE-2024-50247/): fs/ntfs3: Check if more than chunk-size bytes are written (high 7.3)
- [CVE-2024-50246](https://insights.sbomify.com/CVE-2024-50246/): fs/ntfs3: Add rough attr alloc_size check (high 7.8)
- [CVE-2024-50245](https://insights.sbomify.com/CVE-2024-50245/): fs/ntfs3: Fix possible deadlock in mi_read (medium 5.5)
- [CVE-2024-50244](https://insights.sbomify.com/CVE-2024-50244/): fs/ntfs3: Additional check in ni_clear() (medium 5.5)
- [CVE-2024-50243](https://insights.sbomify.com/CVE-2024-50243/): fs/ntfs3: Fix general protection fault in run_is_mapped_full (medium 5.5)
- [CVE-2024-50242](https://insights.sbomify.com/CVE-2024-50242/): fs/ntfs3: Additional check in ntfs_file_release (high 7.8)
- [CVE-2024-50241](https://insights.sbomify.com/CVE-2024-50241/): NFSD: Initialize struct nfsd4_copy earlier (high 7.5)
- [CVE-2024-50240](https://insights.sbomify.com/CVE-2024-50240/): phy: qcom: qmp-usb: fix NULL-deref on runtime suspend (medium 5.5)
- [CVE-2024-5024](https://insights.sbomify.com/CVE-2024-5024/): MemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters (medium 6.1)
- [CVE-2024-50239](https://insights.sbomify.com/CVE-2024-50239/): phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend (medium 5.5)
- [CVE-2024-50238](https://insights.sbomify.com/CVE-2024-50238/): phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend (medium 5.5)
- [CVE-2024-50237](https://insights.sbomify.com/CVE-2024-50237/): wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (high 7.8)
- [CVE-2024-50236](https://insights.sbomify.com/CVE-2024-50236/): wifi: ath10k: Fix memory leak in management tx (medium 5.5)
- [CVE-2024-50235](https://insights.sbomify.com/CVE-2024-50235/): wifi: cfg80211: clear wdev->cqm_config pointer on free (high 7.8)
- [CVE-2024-50234](https://insights.sbomify.com/CVE-2024-50234/): wifi: iwlegacy: Clear stale interrupts before resuming device (high 7.0)
- [CVE-2024-50233](https://insights.sbomify.com/CVE-2024-50233/): staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() (medium 5.5)
- [CVE-2024-50232](https://insights.sbomify.com/CVE-2024-50232/): iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr() (medium 5.5)
- [CVE-2024-50231](https://insights.sbomify.com/CVE-2024-50231/): iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table() (medium 5.5)
- [CVE-2024-50230](https://insights.sbomify.com/CVE-2024-50230/): nilfs2: fix kernel bug due to missing clearing of checked flag (high 7.8)
- [CVE-2024-5023](https://insights.sbomify.com/CVE-2024-5023/): Arbitrary File Read Vulnerability in ConsoleMe via Limited Git command RCE (critical 9.3)
- [CVE-2024-50229](https://insights.sbomify.com/CVE-2024-50229/): nilfs2: fix potential deadlock with newly created symlinks (medium 5.5)
- [CVE-2024-50227](https://insights.sbomify.com/CVE-2024-50227/): thunderbolt: Fix KASAN reported stack out-of-bounds read in tb_retimer_scan() (high 7.1)
- [CVE-2024-50226](https://insights.sbomify.com/CVE-2024-50226/): cxl/port: Fix use-after-free, permit out-of-order decoder shutdown (high 7.8)
- [CVE-2024-50225](https://insights.sbomify.com/CVE-2024-50225/): btrfs: fix error propagation of split bios (high 7.8)
- [CVE-2024-50224](https://insights.sbomify.com/CVE-2024-50224/): spi: spi-fsl-dspi: Fix crash when not using GPIO chip select (medium 5.5)
- [CVE-2024-50223](https://insights.sbomify.com/CVE-2024-50223/): sched/numa: Fix the potential null pointer dereference in task_numa_work() (medium 5.5)
- [CVE-2024-50222](https://insights.sbomify.com/CVE-2024-50222/): iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP (high 7.0)
- [CVE-2024-50221](https://insights.sbomify.com/CVE-2024-50221/): drm/amd/pm: Vangogh: Fix kernel memory out of bounds write (high 7.8)
- [CVE-2024-50220](https://insights.sbomify.com/CVE-2024-50220/): fork: do not invoke uffd on fork if error occurs (medium 4.7)
- [CVE-2024-5022](https://insights.sbomify.com/CVE-2024-5022/): Other in Focus for iOS (medium 4.4)
- [CVE-2024-50218](https://insights.sbomify.com/CVE-2024-50218/): ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow (medium 5.5)
- [CVE-2024-50217](https://insights.sbomify.com/CVE-2024-50217/): btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids() (high 7.8)
- [CVE-2024-50216](https://insights.sbomify.com/CVE-2024-50216/): xfs: fix finding a last resort AG in xfs_filestream_pick_ag (medium 5.5)
- [CVE-2024-50215](https://insights.sbomify.com/CVE-2024-50215/): nvmet-auth: assign dh_key to NULL after kfree_sensitive (high 8.1)
- [CVE-2024-50214](https://insights.sbomify.com/CVE-2024-50214/): drm/connector: hdmi: Fix memory leak in drm_display_mode_from_cea_vic() (medium 5.5)
- [CVE-2024-50213](https://insights.sbomify.com/CVE-2024-50213/): drm/tests: hdmi: Fix memory leaks in drm_display_mode_from_cea_vic() (medium 5.5)
- [CVE-2024-50212](https://insights.sbomify.com/CVE-2024-50212/): lib: alloc_tag_module_unload must wait for pending kfree_rcu calls (medium 5.5)
- [CVE-2024-50211](https://insights.sbomify.com/CVE-2024-50211/): udf: refactor inode_bmap() to handle error (high 7.8)
- [CVE-2024-50210](https://insights.sbomify.com/CVE-2024-50210/): posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() (medium 5.5)
- [CVE-2024-5021](https://insights.sbomify.com/CVE-2024-5021/): WordPress Picture / Portfolio / Media Gallery <= 3.0.1 - Unauthenticated Server-Side Request Forgery (critical 9.3)
- [CVE-2024-50209](https://insights.sbomify.com/CVE-2024-50209/): RDMA/bnxt_re: Add a check for memory allocation (high 7.8)
- [CVE-2024-50208](https://insights.sbomify.com/CVE-2024-50208/): RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (high 7.8)
- [CVE-2024-50207](https://insights.sbomify.com/CVE-2024-50207/): ring-buffer: Fix reader locking when changing the sub buffer order (high 7.8)
- [CVE-2024-50206](https://insights.sbomify.com/CVE-2024-50206/): net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init (critical 9.8)
- [CVE-2024-50205](https://insights.sbomify.com/CVE-2024-50205/): ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/230/