CVE-2024-39470

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39470
In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix a possible null pointer dereference in eventfs_find_events() In function eventfs_find_events,there is a potential null pointer that may be caused by calling update_events_attr which will perform some operations on the members of the ei struct when ei is NULL. Hence,When ei->is_freed is set,return NULL directly.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/5ade5fbdbbb1f023bb70730ba4d74146c8bc7eb9 Patch
https://git.kernel.org/stable/c/7a1b2d138189375ed1dcd7d0851118230221bd1d Patch
https://git.kernel.org/stable/c/d4e9a968738bf66d3bb852dd5588d4c7afd6d7f4 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

19 Aug 2024, 20:58

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: eventfs: se corrige una posible desreferencia de puntero nulo en eventfs_find_events() En la función eventfs_find_events, existe un posible puntero nulo que puede deberse a la llamada a update_events_attr que realizará algunas operaciones en los miembros de la estructura ei cuando ei es NULL. Por lo tanto, cuando se establece ei->is_freed, se devuelve NULL directamente.
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/5ade5fbdbbb1f023bb70730ba4d74146c8bc7eb9 - () https://git.kernel.org/stable/c/5ade5fbdbbb1f023bb70730ba4d74146c8bc7eb9 - Patch
References () https://git.kernel.org/stable/c/7a1b2d138189375ed1dcd7d0851118230221bd1d - () https://git.kernel.org/stable/c/7a1b2d138189375ed1dcd7d0851118230221bd1d - Patch
References () https://git.kernel.org/stable/c/d4e9a968738bf66d3bb852dd5588d4c7afd6d7f4 - () https://git.kernel.org/stable/c/d4e9a968738bf66d3bb852dd5588d4c7afd6d7f4 - Patch
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

25 Jun 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-25 15:15

Updated : 2024-08-19 20:58

NVD link : CVE-2024-39470

Mitre link : CVE-2024-39470

CVE.ORG link : CVE-2024-39470

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference