CVE-2024-36932

In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Prevent use-after-free from occurring after cdev removal Since thermal_debug_cdev_remove() does not run under cdev->lock, it can run in parallel with thermal_debug_cdev_state_update() and it may free the struct thermal_debugfs object used by the latter after it has been checked against NULL. If that happens, thermal_debug_cdev_state_update() will access memory that has been freed already causing the kernel to crash. Address this by using cdev->lock in thermal_debug_cdev_remove() around the cdev->debugfs value check (in case the same cdev is removed at the same time in two different threads) and its reset to NULL. Cc :6.8+ <stable@vger.kernel.org> # 6.8+

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/c1279dee33369e2525f532364bb87207d23b9481	Patch
https://git.kernel.org/stable/c/d351eb0ab04c3e8109895fc33250cebbce9c11da	Patch
https://git.kernel.org/stable/c/c1279dee33369e2525f532364bb87207d23b9481	Patch
https://git.kernel.org/stable/c/d351eb0ab04c3e8109895fc33250cebbce9c11da	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

History

21 Nov 2024, 09:22

Type	Values Removed	Values Added
References	~~() https://git.kernel.org/stable/c/c1279dee33369e2525f532364bb87207d23b9481 - Patch~~	() https://git.kernel.org/stable/c/c1279dee33369e2525f532364bb87207d23b9481 - Patch
References	~~() https://git.kernel.org/stable/c/d351eb0ab04c3e8109895fc33250cebbce9c11da - Patch~~	() https://git.kernel.org/stable/c/d351eb0ab04c3e8109895fc33250cebbce9c11da - Patch

10 Jun 2024, 19:20

Type	Values Removed	Values Added
First Time		Linux Linux linux Kernel
References	~~() https://git.kernel.org/stable/c/c1279dee33369e2525f532364bb87207d23b9481 -~~	() https://git.kernel.org/stable/c/c1279dee33369e2525f532364bb87207d23b9481 - Patch
References	~~() https://git.kernel.org/stable/c/d351eb0ab04c3e8109895fc33250cebbce9c11da -~~	() https://git.kernel.org/stable/c/d351eb0ab04c3e8109895fc33250cebbce9c11da - Patch
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CPE		cpe:2.3:o:linux:linux_kernel::::::::
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Thermal/debugfs: evita que se produzca use after free después de la eliminación de cdev. Dado que Thermal_debug_cdev_remove() no se ejecuta bajo cdev->lock, puede ejecutarse en paralelo con Thermal_debug_cdev_state_update() y puede liberar el objeto struct Thermal_debugfs utilizado por este último después de haberlo verificado con NULL. Si eso sucede, Thermal_debug_cdev_state_update() accederá a la memoria que ya ha sido liberada, lo que provocará que el kernel falle. Solucione esto usando cdev->lock en Thermal_debug_cdev_remove() alrededor de la verificación del valor de cdev->debugfs (en caso de que el mismo cdev se elimine al mismo tiempo en dos subprocesos diferentes) y se restablezca a NULL. CC :6.8+ # 6.8+
CWE		CWE-416

30 May 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-05-30 16:15

Updated : 2024-11-21 09:22

NVD link : CVE-2024-36932

Mitre link : CVE-2024-36932

CVE.ORG link : CVE-2024-36932

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

5.5 /10