In the Linux kernel, the following vulnerability has been resolved:
ima: Fix use-after-free on a dentry's dname.name
->d_name.name can change on rename and the earlier value can be freed;
there are conditions sufficient to stabilize it (->d_lock on dentry,
->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,
rename_lock), but none of those are met at any of the sites. Take a stable
snapshot of the name instead.
References
Configurations
Configuration 1 (hide)
|
History
24 Jul 2024, 19:17
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
References | () https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4 - Patch | |
References | () https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c - Patch | |
References | () https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de - Patch | |
References | () https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c - Patch | |
CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
First Time |
Linux
Linux linux Kernel |
|
CWE | CWE-416 | |
Summary |
|
12 Jul 2024, 13:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-07-12 13:15
Updated : 2024-07-24 19:17
NVD link : CVE-2024-39494
Mitre link : CVE-2024-39494
CVE.ORG link : CVE-2024-39494
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free