CVE-2024-39501

CVE Details

Release Date:

2024-07-12

Description

In the Linux kernel, the following vulnerability has been resolved:\ndrivers: core: synchronize really_probe() and dev_uevent()\nSynchronize the dev->driver usage in really_probe() and dev_uevent().\nThese can run in different threads, what can result in the following\nrace condition for dev->driver uninitialization:\nThread #1:\n==========\nreally_probe() {\n...\nprobe_failed:\n...\ndevice_unbind_cleanup(dev) {\n...\ndev->driver = NULL; // <= Failed probe sets dev->driver to NULL\n...\n}\n...\n}\nThread #2:\n==========\ndev_uevent() {\n...\nif (dev->driver)\n// If dev->driver is NULLed from really_probe() from here on,\n// after above check, the system crashes\nadd_uevent_var(env, 'DRIVER=%s', dev->driver->name);\n...\n}\nreally_probe() holds the lock, already. So nothing needs to be done\nthere. dev_uevent() is called with lock held, often, too. But not\nalways. What implies that we can't add any locking in dev_uevent()\nitself. So fix this race by adding the lock to the non-protected\npath. This is the path where above race is observed:\ndev_uevent+0x235/0x380\nuevent_show+0x10c/0x1f0 <= Add lock here\ndev_attr_show+0x3a/0xa0\nsysfs_kf_seq_show+0x17c/0x250\nkernfs_seq_show+0x7c/0x90\nseq_read_iter+0x2d7/0x940\nkernfs_fop_read_iter+0xc6/0x310\nvfs_read+0x5bc/0x6b0\nksys_read+0xeb/0x1b0\n__x64_sys_read+0x42/0x50\nx64_sys_call+0x27ad/0x2d30\ndo_syscall_64+0xcd/0x1d0\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nSimilar cases are reported by syzkaller in\nhttps://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a\nBut these are regarding the *initialization* of dev->driver\ndev->driver = drv;\nAs this switches dev->driver to non-NULL these reports can be considered\nto be false-positives (which should be 'fixed' by this commit, as well,\nthough).\nThe same issue was reported and tried to be fixed back in 2015 in\nhttps://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@samsung.com/\nalready.

See more information about CVE-2024-39501 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (kernel-uek)	ELSA-2024-12610	2024-09-10
Oracle Linux version 7 (kernel-uek)	ELSA-2024-12779	2024-10-11
Oracle Linux version 7 (kernel-uek-container)	ELSA-2024-12612	2024-09-11
Oracle Linux version 8 (kernel)	ELSA-2024-7000	2024-09-24
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12610	2024-09-10
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12618	2024-09-12
Oracle Linux version 8 (kernel-uek-container)	ELSA-2024-12612	2024-09-11
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12618	2024-09-12