cve-2024-42250
Vulnerability from cvelistv5
Published
2024-08-07 15:14
Modified
2024-12-19 09:14
Severity ?
Summary
cachefiles: add missing lock protection when polling
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6bb6bd3dd6f382dfd36220d4b210a0c77c066651Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8eadcab7f3dd809edbe5ae20533ff843dfea3a07Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/97cfd5e20ddc2e33e16ce369626ce76c9a475fd7Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cf5bb09e742a9cf6349127e868329a8f69b7a014Patch
Impacted products
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42250",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:13:18.948935Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:30.655Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/daemon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "97cfd5e20ddc2e33e16ce369626ce76c9a475fd7",
              "status": "affected",
              "version": "0e19a18f998dcabe8be590e0b39660a1f230209b",
              "versionType": "git"
            },
            {
              "lessThan": "6bb6bd3dd6f382dfd36220d4b210a0c77c066651",
              "status": "affected",
              "version": "18943864342705fa18dd4e6b8d608491fec81f6e",
              "versionType": "git"
            },
            {
              "lessThan": "8eadcab7f3dd809edbe5ae20533ff843dfea3a07",
              "status": "affected",
              "version": "b817e22b2e91257ace32a6768c3c003faeaa1c5c",
              "versionType": "git"
            },
            {
              "lessThan": "cf5bb09e742a9cf6349127e868329a8f69b7a014",
              "status": "affected",
              "version": "b817e22b2e91257ace32a6768c3c003faeaa1c5c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/daemon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: add missing lock protection when polling\n\nAdd missing lock protection in poll routine when iterating xarray,\notherwise:\n\nEven with RCU read lock held, only the slot of the radix tree is\nensured to be pinned there, while the data structure (e.g. struct\ncachefiles_req) stored in the slot has no such guarantee.  The poll\nroutine will iterate the radix tree and dereference cachefiles_req\naccordingly.  Thus RCU read lock is not adequate in this case and\nspinlock is needed here."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:14:51.690Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/97cfd5e20ddc2e33e16ce369626ce76c9a475fd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bb6bd3dd6f382dfd36220d4b210a0c77c066651"
        },
        {
          "url": "https://git.kernel.org/stable/c/8eadcab7f3dd809edbe5ae20533ff843dfea3a07"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf5bb09e742a9cf6349127e868329a8f69b7a014"
        }
      ],
      "title": "cachefiles: add missing lock protection when polling",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42250",
    "datePublished": "2024-08-07T15:14:33.997Z",
    "dateReserved": "2024-07-30T07:40:12.256Z",
    "dateUpdated": "2024-12-19T09:14:51.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42250\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-07T16:15:47.567\",\"lastModified\":\"2024-08-08T20:55:19.780\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: add missing lock protection when polling\\n\\nAdd missing lock protection in poll routine when iterating xarray,\\notherwise:\\n\\nEven with RCU read lock held, only the slot of the radix tree is\\nensured to be pinned there, while the data structure (e.g. struct\\ncachefiles_req) stored in the slot has no such guarantee.  The poll\\nroutine will iterate the radix tree and dereference cachefiles_req\\naccordingly.  Thus RCU read lock is not adequate in this case and\\nspinlock is needed here.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: archivos de cach\u00e9: agregue protecci\u00f3n de bloqueo faltante al sondear. Agregue protecci\u00f3n de bloqueo faltante en la rutina de sondeo al iterar xarray; de lo contrario: incluso con el bloqueo de lectura de RCU mantenido, solo se garantiza que la ranura del \u00e1rbol de base ser anclado all\u00ed, mientras que la estructura de datos (por ejemplo, struct cachefiles_req) almacenada en la ranura no tiene tal garant\u00eda. La rutina de sondeo iterar\u00e1 el \u00e1rbol de base y eliminar\u00e1 la referencia a cachefiles_req en consecuencia. Por lo tanto, el bloqueo de lectura de la RCU no es adecuado en este caso y aqu\u00ed se necesita el bloqueo de giro.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.9.10\",\"matchCriteriaId\":\"6FAC1A24-181A-4DB7-801D-4BDF1B4E4116\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6bb6bd3dd6f382dfd36220d4b210a0c77c066651\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8eadcab7f3dd809edbe5ae20533ff843dfea3a07\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97cfd5e20ddc2e33e16ce369626ce76c9a475fd7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cf5bb09e742a9cf6349127e868329a8f69b7a014\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.