Re: [cip-dev] New CVE entries this week

[Masami Ichikawa <masami.ichikawa@miraclelinux.com>]

Hi.

On Thu, Jun 15, 2023 at 5:41 PM Pavel Machek <pavel@denx.de> wrote:
>
> Hi!
>
> > This week reported 4 new CVEs and 7 updated CVEs.
> >
> > * New CVEs
> >
> > CVE-2023-3141: memstick: r592: Fix UAF bug in r592_remove due to race condition
> >
> > CVSS v3 score is 5.9 MEDIUM.
> >
> > The client side in OpenSSH 5.7 through 8.4 has an Observable
> > Discrepancy leading to an information leak in the algorithm
> > negotiation. This allows man-in-the-middle attackers to target initial
> > connection attempts (where no host key for the server has been cached
> > by the client).
>
> Description seems wrong here. Here's better one:
>
> https://nvd.nist.gov/vuln/detail/CVE-2023-3141
>
> A use-after-free flaw was found in r592_remove in
> drivers/memstick/host/r592.c in media access in the Linux Kernel. This
> flaw allows a local attacker to crash the system at device disconnect,
> possibly leading to a kernel information leak.
>

Thank you for correcting this one.
CVE-2023-3141.yml in cip-kernel-sec contains the correct link to this CVE.
I may paste the wrong description.

> Best regards,
>                                                         Pavel
> --
> DENX Software Engineering GmbH,        Managing Director: Erika Unter
> HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#12044): https://lists.cip-project.org/g/cip-dev/message/12044
> Mute This Topic: https://lists.cip-project.org/mt/99538378/4520416
> Group Owner: cip-dev+owner@lists.cip-project.org
> Unsubscribe: https://lists.cip-project.org/g/cip-dev/leave/8129101/4520416/1465703922/xyzzy [masami.ichikawa@miraclelinux.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

Regards,
-- 
Masami Ichikawa
Cybertrust Japan Co., Ltd.

Email :masami.ichikawa@cybertrust.co.jp
          :masami.ichikawa@miraclelinux.com