# Vulnerabilities published in 2024


- [CVE-2024-35904](https://insights.sbomify.com/CVE-2024-35904/): selinux: avoid dereference of garbage after mount failure (medium 5.5)
- [CVE-2024-35903](https://insights.sbomify.com/CVE-2024-35903/): x86/bpf: Fix IP after emitting call depth accounting (medium 5.5)
- [CVE-2024-35902](https://insights.sbomify.com/CVE-2024-35902/): net/rds: fix possible cp null dereference (medium 5.5)
- [CVE-2024-35901](https://insights.sbomify.com/CVE-2024-35901/): net: mana: Fix Rx DMA datasize and skb_over_panic (high 7.5)
- [CVE-2024-35900](https://insights.sbomify.com/CVE-2024-35900/): netfilter: nf_tables: reject new basechain after table flag update (medium 5.5)
- [CVE-2024-3590](https://insights.sbomify.com/CVE-2024-3590/): LetterPress <= 1.2.2 - Subscriber Deletion via CSRF (medium 6.1)
- [CVE-2024-35899](https://insights.sbomify.com/CVE-2024-35899/): netfilter: nf_tables: flush pending destroy work before exit_net release (high 7.3)
- [CVE-2024-35898](https://insights.sbomify.com/CVE-2024-35898/): netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (high 7.0)
- [CVE-2024-35897](https://insights.sbomify.com/CVE-2024-35897/): netfilter: nf_tables: discard table flag update with pending basechain deletion (high 7.8)
- [CVE-2024-35896](https://insights.sbomify.com/CVE-2024-35896/): netfilter: validate user input for expected length (high 7.1)
- [CVE-2024-35895](https://insights.sbomify.com/CVE-2024-35895/): bpf, sockmap: Prevent lock inversion deadlock in map delete elem (medium 5.5)
- [CVE-2024-35894](https://insights.sbomify.com/CVE-2024-35894/): mptcp: prevent BPF accessing lowat from a subflow socket. (high 7.8)
- [CVE-2024-35893](https://insights.sbomify.com/CVE-2024-35893/): net/sched: act_skbmod: prevent kernel-infoleak (medium 5.5)
- [CVE-2024-35892](https://insights.sbomify.com/CVE-2024-35892/): net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() (medium 5.5)
- [CVE-2024-35891](https://insights.sbomify.com/CVE-2024-35891/): net: phy: micrel: Fix potential null pointer dereference (high 7.5)
- [CVE-2024-35890](https://insights.sbomify.com/CVE-2024-35890/): gro: fix ownership transfer (high 7.8)
- [CVE-2024-35889](https://insights.sbomify.com/CVE-2024-35889/): idpf: fix kernel panic on unknown packet types (high 8.6)
- [CVE-2024-35888](https://insights.sbomify.com/CVE-2024-35888/): erspan: make sure erspan_base_hdr is present in skb->head (high 7.3)
- [CVE-2024-35887](https://insights.sbomify.com/CVE-2024-35887/): ax25: fix use-after-free bugs caused by ax25_ds_del_timer (high 8.8)
- [CVE-2024-35886](https://insights.sbomify.com/CVE-2024-35886/): ipv6: Fix infinite recursion in fib6_dump_done(). (high 7.8)
- [CVE-2024-35885](https://insights.sbomify.com/CVE-2024-35885/): mlxbf_gige: stop interface during shutdown (medium 5.5)
- [CVE-2024-35884](https://insights.sbomify.com/CVE-2024-35884/): udp: do not accept non-tunnel GSO skbs landing in a tunnel (critical 9.8)
- [CVE-2024-35883](https://insights.sbomify.com/CVE-2024-35883/): spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe (medium 5.5)
- [CVE-2024-35882](https://insights.sbomify.com/CVE-2024-35882/): SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP (high 7.5)
- [CVE-2024-35880](https://insights.sbomify.com/CVE-2024-35880/): io_uring/kbuf: hold io_buffer_list reference over mmap (high 7.8)
- [CVE-2024-3588](https://insights.sbomify.com/CVE-2024-3588/): Getwid – Gutenberg Blocks <= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown' (medium 6.4)
- [CVE-2024-35879](https://insights.sbomify.com/CVE-2024-35879/): of: dynamic: Synchronize of_changeset_destroy() with the devlink removals (high 7.8)
- [CVE-2024-35878](https://insights.sbomify.com/CVE-2024-35878/): of: module: prevent NULL pointer dereference in vsnprintf() (medium 5.3)
- [CVE-2024-35877](https://insights.sbomify.com/CVE-2024-35877/): x86/mm/pat: fix VM_PAT handling in COW mappings (medium 5.5)
- [CVE-2024-35875](https://insights.sbomify.com/CVE-2024-35875/): x86/coco: Require seeding RNG with RDRAND on CoCo systems (high 8.4)
- [CVE-2024-35874](https://insights.sbomify.com/CVE-2024-35874/): aio: Fix null ptr deref in aio_complete() wakeup (high 7.8)
- [CVE-2024-35873](https://insights.sbomify.com/CVE-2024-35873/): riscv: Fix vector state restore in rt_sigreturn() (medium 5.5)
- [CVE-2024-35872](https://insights.sbomify.com/CVE-2024-35872/): mm/secretmem: fix GUP-fast succeeding on secretmem folios (high 7.8)
- [CVE-2024-35871](https://insights.sbomify.com/CVE-2024-35871/): riscv: process: Fix kernel gp leakage (high 7.1)
- [CVE-2024-35870](https://insights.sbomify.com/CVE-2024-35870/): smb: client: fix UAF in smb2_reconnect_server() (critical 9.8)
- [CVE-2024-3587](https://insights.sbomify.com/CVE-2024-3587/): Cross-site scripting in Premium Portfolio Features for Phlox theme (medium 6.4)
- [CVE-2024-35869](https://insights.sbomify.com/CVE-2024-35869/): smb: client: guarantee refcounted children from parent session (critical 9.8)
- [CVE-2024-35868](https://insights.sbomify.com/CVE-2024-35868/): smb: client: fix potential UAF in cifs_stats_proc_write() (high 7.8)
- [CVE-2024-35867](https://insights.sbomify.com/CVE-2024-35867/): smb: client: fix potential UAF in cifs_stats_proc_show() (high 7.8)
- [CVE-2024-35866](https://insights.sbomify.com/CVE-2024-35866/): smb: client: fix potential UAF in cifs_dump_full_key() (high 7.8)
- [CVE-2024-35865](https://insights.sbomify.com/CVE-2024-35865/): smb: client: fix potential UAF in smb2_is_valid_oplock_break() (critical 9.8)
- [CVE-2024-35864](https://insights.sbomify.com/CVE-2024-35864/): smb: client: fix potential UAF in smb2_is_valid_lease_break() (critical 9.8)
- [CVE-2024-35863](https://insights.sbomify.com/CVE-2024-35863/): smb: client: fix potential UAF in is_valid_oplock_break() (critical 9.8)
- [CVE-2024-35862](https://insights.sbomify.com/CVE-2024-35862/): smb: client: fix potential UAF in smb2_is_network_name_deleted() (critical 9.8)
- [CVE-2024-35861](https://insights.sbomify.com/CVE-2024-35861/): smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() (critical 9.8)
- [CVE-2024-35860](https://insights.sbomify.com/CVE-2024-35860/): bpf: support deferring bpf_link dealloc to after RCU grace period (high 7.8)
- [CVE-2024-3586](https://insights.sbomify.com/CVE-2024-3586/): LetterPress < 2.4.0 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-35859](https://insights.sbomify.com/CVE-2024-35859/): block: fix module reference leakage from bdev_open_by_dev error path (medium 5.5)
- [CVE-2024-35858](https://insights.sbomify.com/CVE-2024-35858/): net: bcmasp: fix memory leak when bringing down interface (high 7.8)
- [CVE-2024-35857](https://insights.sbomify.com/CVE-2024-35857/): icmp: prevent possible NULL dereferences from icmp_build_probe() (high 7.5)
- [CVE-2024-35856](https://insights.sbomify.com/CVE-2024-35856/): Bluetooth: btusb: mediatek: Fix double free of skb in coredump (high 8.8)
- [CVE-2024-35855](https://insights.sbomify.com/CVE-2024-35855/): mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (high 7.8)
- [CVE-2024-35854](https://insights.sbomify.com/CVE-2024-35854/): mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (high 7.8)
- [CVE-2024-35853](https://insights.sbomify.com/CVE-2024-35853/): mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (medium 6.4)
- [CVE-2024-35852](https://insights.sbomify.com/CVE-2024-35852/): mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (medium 5.5)
- [CVE-2024-35851](https://insights.sbomify.com/CVE-2024-35851/): Bluetooth: qca: fix NULL-deref on non-serdev suspend (medium 5.5)
- [CVE-2024-35850](https://insights.sbomify.com/CVE-2024-35850/): Bluetooth: qca: fix NULL-deref on non-serdev setup (medium 5.5)
- [CVE-2024-3585](https://insights.sbomify.com/CVE-2024-3585/): Send PDF for Contact Form 7 <= 1.0.2.3 - Missing Authorization (medium 5.3)
- [CVE-2024-35849](https://insights.sbomify.com/CVE-2024-35849/): btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (high 7.1)
- [CVE-2024-35848](https://insights.sbomify.com/CVE-2024-35848/): eeprom: at24: fix memory corruption race condition (high 7.0)
- [CVE-2024-35847](https://insights.sbomify.com/CVE-2024-35847/): irqchip/gic-v3-its: Prevent double free on error (high 7.8)
- [CVE-2024-35846](https://insights.sbomify.com/CVE-2024-35846/): mm: zswap: fix shrinker NULL crash with cgroup_disable=memory (medium 5.5)
- [CVE-2024-35845](https://insights.sbomify.com/CVE-2024-35845/): wifi: iwlwifi: dbg-tlv: ensure NUL termination (critical 9.1)
- [CVE-2024-35844](https://insights.sbomify.com/CVE-2024-35844/): f2fs: compress: fix reserve_cblocks counting error when out of space (medium 5.5)
- [CVE-2024-35843](https://insights.sbomify.com/CVE-2024-35843/): iommu/vt-d: Use device rbtree in iopf reporting path (high 8.8)
- [CVE-2024-35842](https://insights.sbomify.com/CVE-2024-35842/): ASoC: mediatek: sof-common: Add NULL check for normal_link string (medium 5.5)
- [CVE-2024-35841](https://insights.sbomify.com/CVE-2024-35841/): net: tls, fix WARNIING in __sk_msg_free (medium 5.5)
- [CVE-2024-35840](https://insights.sbomify.com/CVE-2024-35840/): mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (medium 5.5)
- [CVE-2024-3584](https://insights.sbomify.com/CVE-2024-3584/): Path Traversal in qdrant/qdrant (critical 9.8)
- [CVE-2024-35839](https://insights.sbomify.com/CVE-2024-35839/): netfilter: bridge: replace physindev with physinif in nf_bridge_info (high 7.8)
- [CVE-2024-35838](https://insights.sbomify.com/CVE-2024-35838/): wifi: mac80211: fix potential sta-link leak (medium 5.5)
- [CVE-2024-35837](https://insights.sbomify.com/CVE-2024-35837/): net: mvpp2: clear BM pool before initialization (medium 5.5)
- [CVE-2024-35836](https://insights.sbomify.com/CVE-2024-35836/): dpll: fix pin dump crash for rebound module (medium 5.5)
- [CVE-2024-35835](https://insights.sbomify.com/CVE-2024-35835/): net/mlx5e: fix a double-free in arfs_create_groups (high 7.8)
- [CVE-2024-35834](https://insights.sbomify.com/CVE-2024-35834/): xsk: recycle buffer in case Rx queue was full (high 8.2)
- [CVE-2024-35833](https://insights.sbomify.com/CVE-2024-35833/): dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA (medium 5.5)
- [CVE-2024-35832](https://insights.sbomify.com/CVE-2024-35832/): bcachefs: kvfree bch_fs::snapshots in bch2_fs_snapshots_exit (medium 5.5)
- [CVE-2024-35831](https://insights.sbomify.com/CVE-2024-35831/): io_uring: Fix release of pinned pages when __io_uaddr_map fails (medium 5.5)
- [CVE-2024-35830](https://insights.sbomify.com/CVE-2024-35830/): media: tc358743: register v4l2 async device only after successful setup (high 7.8)
- [CVE-2024-3583](https://insights.sbomify.com/CVE-2024-3583/): Simple Like Page Plugin <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-35829](https://insights.sbomify.com/CVE-2024-35829/): drm/lima: fix a memleak in lima_heap_alloc (medium 5.5)
- [CVE-2024-35828](https://insights.sbomify.com/CVE-2024-35828/): wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() (medium 5.5)
- [CVE-2024-35827](https://insights.sbomify.com/CVE-2024-35827/): io_uring/net: fix overflow check in io_recvmsg_mshot_prep() (high 7.8)
- [CVE-2024-35826](https://insights.sbomify.com/CVE-2024-35826/): block: Fix page refcounts for unaligned buffers in __bio_release_pages() (medium 5.5)
- [CVE-2024-35825](https://insights.sbomify.com/CVE-2024-35825/): usb: gadget: ncm: Fix handling of zero block length packets (medium 5.5)
- [CVE-2024-35824](https://insights.sbomify.com/CVE-2024-35824/): misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (medium 5.5)
- [CVE-2024-35823](https://insights.sbomify.com/CVE-2024-35823/): vt: fix unicode buffer corruption when deleting characters (medium 5.3)
- [CVE-2024-35822](https://insights.sbomify.com/CVE-2024-35822/): usb: udc: remove warning when queue disabled ep (medium 5.5)
- [CVE-2024-35821](https://insights.sbomify.com/CVE-2024-35821/): ubifs: Set page uptodate in the correct place (high 7.5)
- [CVE-2024-3582](https://insights.sbomify.com/CVE-2024-3582/): Ungallery <= 2.2.4 - Stored XSS via CSRF (medium 4.8)
- [CVE-2024-35819](https://insights.sbomify.com/CVE-2024-35819/): soc: fsl: qbman: Use raw spinlock for cgr_lock (medium 5.5)
- [CVE-2024-35818](https://insights.sbomify.com/CVE-2024-35818/): LoongArch: Define the __io_aw() hook as mmiowb() (medium 5.5)
- [CVE-2024-35817](https://insights.sbomify.com/CVE-2024-35817/): drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag (high 7.8)
- [CVE-2024-35816](https://insights.sbomify.com/CVE-2024-35816/): firewire: ohci: prevent leak of left-over IRQ on unbind (medium 5.5)
- [CVE-2024-35815](https://insights.sbomify.com/CVE-2024-35815/): fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion (medium 5.5)
- [CVE-2024-35814](https://insights.sbomify.com/CVE-2024-35814/): swiotlb: Fix double-allocation of slots due to broken alignment handling (high 7.8)
- [CVE-2024-35813](https://insights.sbomify.com/CVE-2024-35813/): mmc: core: Avoid negative index with array access (high 7.8)
- [CVE-2024-35811](https://insights.sbomify.com/CVE-2024-35811/): wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach (high 8.8)
- [CVE-2024-35810](https://insights.sbomify.com/CVE-2024-35810/): drm/vmwgfx: Fix the lifetime of the bo cursor memory (high 7.8)
- [CVE-2024-3581](https://insights.sbomify.com/CVE-2024-3581/): MaxGalleria <= 6.4.2 - Missing Authorization (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/343/