CVE-2024-39508

CVE Details

Release Date:

2024-07-12

Description

In the Linux kernel, the following vulnerability has been resolved:\nio_uring/io-wq: Use set_bit() and test_bit() at worker->flags\nUtilize set_bit() and test_bit() on worker->flags within io_uring/io-wq\nto address potential data races.\nThe structure io_worker->flags may be accessed through various data\npaths, leading to concurrency issues. When KCSAN is enabled, it reveals\ndata races occurring in io_worker_handle_work and\nio_wq_activate_free_worker functions.\nBUG: KCSAN: data-race in io_worker_handle_work / io_wq_activate_free_worker\nwrite to 0xffff8885c4246404 of 4 bytes by task 49071 on cpu 28:\nio_worker_handle_work (io_uring/io-wq.c:434 io_uring/io-wq.c:569)\nio_wq_worker (io_uring/io-wq.c:?)\n\nread to 0xffff8885c4246404 of 4 bytes by task 49024 on cpu 5:\nio_wq_activate_free_worker (io_uring/io-wq.c:? io_uring/io-wq.c:285)\nio_wq_enqueue (io_uring/io-wq.c:947)\nio_queue_iowq (io_uring/io_uring.c:524)\nio_req_task_submit (io_uring/io_uring.c:1511)\nio_handle_tw_list (io_uring/io_uring.c:1198)\n\nLine numbers against commit 18daea77cca6 ('Merge tag 'for-linus' of\ngit://git.kernel.org/pub/scm/virt/kvm/kvm').\nThese races involve writes and reads to the same memory location by\ndifferent tasks running on different CPUs. To mitigate this, refactor\nthe code to use atomic operations such as set_bit(), test_bit(), and\nclear_bit() instead of basic 'and' and 'or' operations. This ensures\nthread-safe manipulation of worker flags.\nAlso, move `create_index` to avoid holes in the structure.

See more information about CVE-2024-39508 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	7	CVSS Vector:	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector:	Local network	Attack Complexity:	High
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	High
Integrity Impact:	High	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (kernel)	ELSA-2024-9315	2024-11-14