CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-27023 – md: Fix missing release of 'active_io' for flush
https://notcve.org/view.php?id=CVE-2024-27023
In the Linux kernel, the following vulnerability has been resolved: md: Fix missing release of 'active_io' for flush submit_flushes atomic_set(&mddev->flush_pending, 1); rdev_for_each_rcu(rdev, mddev) atomic_inc(&mddev->flush_pending); bi->bi_end_io = md_end_flush submit_bio(bi); /* flush io is done first */ md_end_flush if (atomic_dec_and_test(&mddev->flush_pending)) percpu_ref_put(&mddev->active_io) -> active_io is not released if (atomic_dec_and_test(&mddev->flush_pending)) -> missing release of active_io For consequence, mddev_suspend() will wait for 'active_io' to be zero forever. Fix this problem by releasing 'active_io' in submit_flushes() if 'flush_pending' is decreased to zero. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: md: Se corrigió la versión faltante de 'active_io' para descarga submit_flushes atomic_set(&mddev->flush_pending, 1); rdev_for_each_rcu(rdev, mddev) atomic_inc(&mddev->flush_pending); bi->bi_end_io = md_end_flush submit_bio(bi); /* purgar io se realiza primero */ md_end_flush if (atomic_dec_and_test(&mddev->flush_pending)) percpu_ref_put(&mddev->active_io) -> active_io no se publica si (atomic_dec_and_test(&mddev->flush_pending)) -> falta la versión de active_io para Como consecuencia, mddev_suspend() esperará a que 'active_io' sea cero para siempre. Solucione este problema liberando 'active_io' en submit_flushes() si 'flush_pending' se reduce a cero. • https://git.kernel.org/stable/c/f9f2d957a8ea93c73182aebf7de30935a58c027d https://git.kernel.org/stable/c/530cec617f5a8ba6f26bcbf0d64d75c951d17730 https://git.kernel.org/stable/c/c4c2345214b66e2505a26fd2ea58839dd7a1d48d https://git.kernel.org/stable/c/6b2ff10390b19a2364af622b6666b690443f9f3f https://git.kernel.org/stable/c/02dad157ba11064d073f5499dc33552b227d5d3a https://git.kernel.org/stable/c/11f81438927f84edfaaeb5d5f10856c3a1c1fc82 https://git.kernel.org/stable/c/855678ed8534518e2b428bcbcec695de9ba248e8 https://access.redhat.com/security/cve/CVE-2024-27023 •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2024-27022 – fork: defer linking file vma until vma is fully initialized
https://notcve.org/view.php?id=CVE-2024-27022
In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma is fully initialized Thorvald reported a WARNING [1]. And the root cause is below race: CPU 1 CPU 2 fork hugetlbfs_fallocate dup_mmap hugetlbfs_punch_hole i_mmap_lock_write(mapping); vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree. i_mmap_unlock_write(mapping); hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem! i_mmap_lock_write(mapping); hugetlb_vmdelete_list vma_interval_tree_foreach hugetlb_vma_trylock_write -- Vma_lock is cleared. tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem! hugetlb_vma_unlock_write -- Vma_lock is assigned!!! i_mmap_unlock_write(mapping); hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside i_mmap_rwsem lock while vma lock can be used in the same time. • https://git.kernel.org/stable/c/8d9bfb2608145cf3e408428c224099e1585471af https://git.kernel.org/stable/c/0c42f7e039aba3de6d7dbf92da708e2b2ecba557 https://git.kernel.org/stable/c/04b0c41912349aff11a1bbaef6a722bd7fbb90ac https://git.kernel.org/stable/c/cec11fa2eb512ebe3a459c185f4aca1d44059bbf https://git.kernel.org/stable/c/dd782da470761077f4d1120e191f1a35787cda6e https://git.kernel.org/stable/c/abdb88dd272bbeb93efe01d8e0b7b17e24af3a34 https://git.kernel.org/stable/c/35e351780fa9d8240dd6f7e4f245f9ea37e96c19 https://access.redhat.com/security/cve/CVE-2024-27022 • CWE-908: Use of Uninitialized Resource •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-27021 – r8169: fix LED-related deadlock on module removal
https://notcve.org/view.php?id=CVE-2024-27021
In the Linux kernel, the following vulnerability has been resolved: r8169: fix LED-related deadlock on module removal Binding devm_led_classdev_register() to the netdev is problematic because on module removal we get a RTNL-related deadlock. Fix this by avoiding the device-managed LED functions. Note: We can safely call led_classdev_unregister() for a LED even if registering it failed, because led_classdev_unregister() detects this and is a no-op in this case. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: r8169: corrige el punto muerto relacionado con el LED al eliminar el módulo. Vincular devm_led_classdev_register() al netdev es problemático porque al eliminar el módulo obtenemos un punto muerto relacionado con RTNL. Solucione este problema evitando las funciones LED administradas por el dispositivo. • https://git.kernel.org/stable/c/18764b883e157e28126b54e7d4ba9dd487d5bf54 https://git.kernel.org/stable/c/53d986f39acd8ea11c9e460732bfa5add66360d9 https://git.kernel.org/stable/c/19fa4f2a85d777a8052e869c1b892a2f7556569d • CWE-667: Improper Locking •
CVSS: 7.0EPSS: 0%CPEs: 8EXPL: 0CVE-2024-27020 – netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
https://notcve.org/view.php?id=CVE-2024-27020
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_tables_expressions list in __nft_expr_type_get(). Therefore, there is potential data-race of nf_tables_expressions list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_expressions list in __nft_expr_type_get(), and use rcu_read_lock() in the caller nft_expr_type_get() to protect the entire type query process. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netfilter: nf_tables: corrige una posible ejecución de datos en __nft_expr_type_get() nft_unregister_expr() puede concurrente con __nft_expr_type_get(), y no hay ninguna protección cuando se itera sobre la lista nf_tables_expressions en __nft_expr_type_get() . Por lo tanto, existe una posible ejecución de datos en la entrada de la lista nf_tables_expressions. Utilice list_for_each_entry_rcu() para iterar sobre la lista nf_tables_expressions en __nft_expr_type_get() y utilice rcu_read_lock() en el llamador nft_expr_type_get() para proteger todo el proceso de consulta de tipos. • https://git.kernel.org/stable/c/ef1f7df9170dbd875ce198ba84e6ab80f6fc139e https://git.kernel.org/stable/c/939109c0a8e2a006a6cc8209e262d25065f4403a https://git.kernel.org/stable/c/b38a133d37fa421c8447b383d788c9cc6f5cb34c https://git.kernel.org/stable/c/934e66e231cff2b18faa2c8aad0b8cec13957e05 https://git.kernel.org/stable/c/0b6de00206adbbfc6373b3ae38d2a6f197987907 https://git.kernel.org/stable/c/8d56bad42ac4c43c6c72ddd6a654a2628bf839c5 https://git.kernel.org/stable/c/a9ebf340d123ae12582210407f879d6a5a1bc25b https://git.kernel.org/stable/c/01f1a678b05ade4b1248019c2dcca773a • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-27019 – netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
https://notcve.org/view.php?id=CVE-2024-27019
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_tables_objects list in __nft_obj_type_get(). Therefore, there is potential data-race of nf_tables_objects list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_objects list in __nft_obj_type_get(), and use rcu_read_lock() in the caller nft_obj_type_get() to protect the entire type query process. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netfilter: nf_tables: corrige una posible ejecución de datos en __nft_obj_type_get() nft_unregister_obj() puede concurrir con __nft_obj_type_get(), y no hay ninguna protección cuando se itera sobre la lista de nf_tables_objects en __nft_obj_type_get() . Por lo tanto, existe una posible ejecución de datos de la entrada de la lista nf_tables_objects. Utilice list_for_each_entry_rcu() para iterar sobre la lista nf_tables_objects en __nft_obj_type_get(), y utilice rcu_read_lock() en el llamador nft_obj_type_get() para proteger todo el proceso de consulta de tipos. • https://git.kernel.org/stable/c/e50092404c1bc7aaeb0a0f4077fa6f07b073a20f https://git.kernel.org/stable/c/cade34279c2249eafe528564bd2e203e4ff15f88 https://git.kernel.org/stable/c/379bf7257bc5f2a1b1ca8514e08a871b7bf6d920 https://git.kernel.org/stable/c/df7c0fb8c2b9f9cac65659332581b19682a71349 https://git.kernel.org/stable/c/ad333578f736d56920e090d7db1f8dec891d815e https://git.kernel.org/stable/c/4ca946b19caf655a08d5e2266d4d5526025ebb73 https://git.kernel.org/stable/c/d78d867dcea69c328db30df665be5be7d0148484 https://access.redhat.com/security/cve/CVE-2024-27019 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •