CVE-2024-49954

In the Linux kernel, the following vulnerability has been resolved: static_call: Replace pointless WARN_ON() in static_call_module_notify() static_call_module_notify() triggers a WARN_ON(), when memory allocation fails in __static_call_add_module(). That's not really justified, because the failure case must be correctly handled by the well known call chain and the error code is passed through to the initiating userspace application. A memory allocation fail is not a fatal problem, but the WARN_ON() takes the machine out when panic_on_warn is set. Replace it with a pr_warn().

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/85a104aaef1f56623acc10ba4c42d5f046ba65b7	Patch
https://git.kernel.org/stable/c/b83bef74c121a3311240fc4002d23486b85355e4	Patch
https://git.kernel.org/stable/c/bc9356513d56b688775497b7ac6f2b967f46a80c	Patch
https://git.kernel.org/stable/c/e67534bd31d79952b50e791e92adf0b3e6c13b8c	Patch
https://git.kernel.org/stable/c/ea2cdf4da093d0482f0ef36ba971e2e0c7673425	Patch
https://git.kernel.org/stable/c/fe513c2ef0a172a58f158e2e70465c4317f0a9a2	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

07 Nov 2024, 19:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CWE		NVD-CWE-noinfo
First Time		Linux Linux linux Kernel
CPE		cpe:2.3:o:linux:linux_kernel::::::::
References	~~() https://git.kernel.org/stable/c/85a104aaef1f56623acc10ba4c42d5f046ba65b7 -~~	() https://git.kernel.org/stable/c/85a104aaef1f56623acc10ba4c42d5f046ba65b7 - Patch
References	~~() https://git.kernel.org/stable/c/b83bef74c121a3311240fc4002d23486b85355e4 -~~	() https://git.kernel.org/stable/c/b83bef74c121a3311240fc4002d23486b85355e4 - Patch
References	~~() https://git.kernel.org/stable/c/bc9356513d56b688775497b7ac6f2b967f46a80c -~~	() https://git.kernel.org/stable/c/bc9356513d56b688775497b7ac6f2b967f46a80c - Patch
References	~~() https://git.kernel.org/stable/c/e67534bd31d79952b50e791e92adf0b3e6c13b8c -~~	() https://git.kernel.org/stable/c/e67534bd31d79952b50e791e92adf0b3e6c13b8c - Patch
References	~~() https://git.kernel.org/stable/c/ea2cdf4da093d0482f0ef36ba971e2e0c7673425 -~~	() https://git.kernel.org/stable/c/ea2cdf4da093d0482f0ef36ba971e2e0c7673425 - Patch
References	~~() https://git.kernel.org/stable/c/fe513c2ef0a172a58f158e2e70465c4317f0a9a2 -~~	() https://git.kernel.org/stable/c/fe513c2ef0a172a58f158e2e70465c4317f0a9a2 - Patch

23 Oct 2024, 15:13

Type	Values Removed	Values Added
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: static_call: Reemplazar WARN_ON() sin sentido en static_call_module_notify() static_call_module_notify() activa un WARN_ON() cuando la asignación de memoria fallo en __static_call_add_module(). Esto no está realmente justificado, porque el caso de fallo debe ser manejado correctamente por la cadena de llamadas conocida y el código de error se pasa a la aplicación de espacio de usuario que la inicia. Un error en la asignación de memoria no es un problema fatal, pero WARN_ON() deja fuera de servicio la máquina cuando se establece panic_on_warn. Reemplázalo con un pr_warn().

21 Oct 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-21 18:15

Updated : 2024-11-07 19:16

NVD link : CVE-2024-49954

Mitre link : CVE-2024-49954

CVE.ORG link : CVE-2024-49954

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-noinfo

5.5 /10