CVE-2024-40951

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-40951
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger() bdev->bd_super has been removed and commit 8887b94d9322 change the usage from bdev->bd_super to b_assoc_map->host->i_sb. Since ocfs2 hasn't set bh->b_assoc_map, it will trigger NULL pointer dereference when calling into ocfs2_abort_trigger(). Actually this was pointed out in history, see commit 74e364ad1b13. But I've made a mistake when reviewing commit 8887b94d9322 and then re-introduce this regression. Since we cannot revive bdev in buffer head, so fix this issue by initializing all types of ocfs2 triggers when fill super, and then get the specific ocfs2 trigger from ocfs2_caching_info when access journal. [joseph.qi@linux.alibaba.com: v2] Link: https://lkml.kernel.org/r/20240602112045.1112708-1-joseph.qi@linux.alibaba.com

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/67bcecd780609f471260a8c83fb0ae15f27734ce Patch
https://git.kernel.org/stable/c/685d03c3795378fca6a1b3d43581f7f1a3fc095f Patch
https://git.kernel.org/stable/c/eb63357ef229fae061ce7ce2839d558681c42f1a Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*
History

06 Aug 2024, 13:29

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ocfs2: corrige la desreferencia del puntero NULL en ocfs2_abort_trigger() bdev->bd_super se ha eliminado y el commit 8887b94d9322 cambia el uso de bdev->bd_super a b_assoc_map->host->i_sb. Dado que ocfs2 no ha configurado bh->b_assoc_map, activará la desreferencia del puntero NULL al llamar a ocfs2_abort_trigger(). En realidad, esto se señaló en la historia, consulte el commit 74e364ad1b13. Pero cometí un error al revisar el commit 8887b94d9322 y luego reintroducir esta regresión. Dado que no podemos reactivar bdev en el encabezado del búfer, solucione este problema inicializando todos los tipos de activadores de ocfs2 cuando complete el super, y luego obtenga el activador de ocfs2 específico de ocfs2_caching_info cuando acceda al diario. [joseph.qi@linux.alibaba.com:v2] Enlace: https://lkml.kernel.org/r/20240602112045.1112708-1-joseph.qi@linux.alibaba.com
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/67bcecd780609f471260a8c83fb0ae15f27734ce - () https://git.kernel.org/stable/c/67bcecd780609f471260a8c83fb0ae15f27734ce - Patch
References () https://git.kernel.org/stable/c/685d03c3795378fca6a1b3d43581f7f1a3fc095f - () https://git.kernel.org/stable/c/685d03c3795378fca6a1b3d43581f7f1a3fc095f - Patch
References () https://git.kernel.org/stable/c/eb63357ef229fae061ce7ce2839d558681c42f1a - () https://git.kernel.org/stable/c/eb63357ef229fae061ce7ce2839d558681c42f1a - Patch

12 Jul 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-12 13:15

Updated : 2024-08-06 13:29

NVD link : CVE-2024-40951

Mitre link : CVE-2024-40951

CVE.ORG link : CVE-2024-40951

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference