CVE-2024-39501

CVE Details

Release Date:2024-07-12

Description


In the Linux kernel, the following vulnerability has been resolved:\ndrivers: core: synchronize really_probe() and dev_uevent()\nSynchronize the dev->driver usage in really_probe() and dev_uevent().\nThese can run in different threads, what can result in the following\nrace condition for dev->driver uninitialization:\nThread #1:\n==========\nreally_probe() {\n...\nprobe_failed:\n...\ndevice_unbind_cleanup(dev) {\n...\ndev->driver = NULL; // <= Failed probe sets dev->driver to NULL\n...\n}\n...\n}\nThread #2:\n==========\ndev_uevent() {\n...\nif (dev->driver)\n// If dev->driver is NULLed from really_probe() from here on,\n// after above check, the system crashes\nadd_uevent_var(env, 'DRIVER=%s', dev->driver->name);\n...\n}\nreally_probe() holds the lock, already. So nothing needs to be done\nthere. dev_uevent() is called with lock held, often, too. But not\nalways. What implies that we can't add any locking in dev_uevent()\nitself. So fix this race by adding the lock to the non-protected\npath. This is the path where above race is observed:\ndev_uevent+0x235/0x380\nuevent_show+0x10c/0x1f0 <= Add lock here\ndev_attr_show+0x3a/0xa0\nsysfs_kf_seq_show+0x17c/0x250\nkernfs_seq_show+0x7c/0x90\nseq_read_iter+0x2d7/0x940\nkernfs_fop_read_iter+0xc6/0x310\nvfs_read+0x5bc/0x6b0\nksys_read+0xeb/0x1b0\n__x64_sys_read+0x42/0x50\nx64_sys_call+0x27ad/0x2d30\ndo_syscall_64+0xcd/0x1d0\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nSimilar cases are reported by syzkaller in\nhttps://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a\nBut these are regarding the *initialization* of dev->driver\ndev->driver = drv;\nAs this switches dev->driver to non-NULL these reports can be considered\nto be false-positives (which should be 'fixed' by this commit, as well,\nthough).\nThe same issue was reported and tried to be fixed back in 2015 in\nhttps://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@samsung.com/\nalready.

See more information about CVE-2024-39501 from MITRE CVE dictionary and NIST NVD


CVSS Scoring


NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score: 4.7 CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector: Local network Attack Complexity: High
Privileges Required: Low User Interaction: None
Scope: Unchanged Confidentiality Impact: None
Integrity Impact: None Availability Impact: High

Errata information


PlatformErrataRelease Date
Oracle Linux version 7 (kernel-uek)ELSA-2024-126102024-09-10
Oracle Linux version 7 (kernel-uek)ELSA-2024-127792024-10-11
Oracle Linux version 7 (kernel-uek-container)ELSA-2024-126122024-09-11
Oracle Linux version 8 (kernel)ELSA-2024-70002024-09-24
Oracle Linux version 8 (kernel-uek)ELSA-2024-126102024-09-10
Oracle Linux version 8 (kernel-uek)ELSA-2024-126182024-09-12
Oracle Linux version 8 (kernel-uek-container)ELSA-2024-126122024-09-11
Oracle Linux version 9 (kernel)ELSA-2024-93152024-11-14
Oracle Linux version 9 (kernel-uek)ELSA-2024-126182024-09-12


This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:

software.hardware.complete