CVE-2024-42300 (GCVE-0-2024-42300)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-08-05 11:36
VLAI
Title
erofs: fix race in z_erofs_get_gbuf()
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: fix race in z_erofs_get_gbuf() In z_erofs_get_gbuf(), the current task may be migrated to another CPU between `z_erofs_gbuf_id()` and `spin_lock(&gbuf->lock)`. Therefore, z_erofs_put_gbuf() will trigger the following issue which was found by stress test: <2>[772156.434168] kernel BUG at fs/erofs/zutil.c:58! .. <4>[772156.435007] <4>[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G E 6.10.0-rc7+ #2 <4>[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017 <4>[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) <4>[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs] .. <6>[772156.445958] stress (3127): drop_caches: 1 <4>[772156.446120] Call trace: <4>[772156.446121] z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.446761] z_erofs_lz4_decompress+0x600/0x6a0 [erofs] <4>[772156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs] <4>[772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs] <4>[772156.447160] z_erofs_readahead+0x224/0x390 [erofs] ..
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f36f3010f67611a45d66e773bc91e4c66a9abab5 , < 49b22e06a947727a6d1c802d2d9ad92420b90fc5 (git)
Affected: f36f3010f67611a45d66e773bc91e4c66a9abab5 , < 7dc5537c3f8be87e005f0844a7626c987914f8fd (git)
Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.10.3 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:10:35.332066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:28.436Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zutil.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "49b22e06a947727a6d1c802d2d9ad92420b90fc5",
              "status": "affected",
              "version": "f36f3010f67611a45d66e773bc91e4c66a9abab5",
              "versionType": "git"
            },
            {
              "lessThan": "7dc5537c3f8be87e005f0844a7626c987914f8fd",
              "status": "affected",
              "version": "f36f3010f67611a45d66e773bc91e4c66a9abab5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zutil.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix race in z_erofs_get_gbuf()\n\nIn z_erofs_get_gbuf(), the current task may be migrated to another\nCPU between `z_erofs_gbuf_id()` and `spin_lock(\u0026gbuf-\u003elock)`.\n\nTherefore, z_erofs_put_gbuf() will trigger the following issue\nwhich was found by stress test:\n\n\u003c2\u003e[772156.434168] kernel BUG at fs/erofs/zutil.c:58!\n..\n\u003c4\u003e[772156.435007]\n\u003c4\u003e[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G            E      6.10.0-rc7+ #2\n\u003c4\u003e[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017\n\u003c4\u003e[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n\u003c4\u003e[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs]\n\u003c4\u003e[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\n..\n\u003c6\u003e[772156.445958] stress (3127): drop_caches: 1\n\u003c4\u003e[772156.446120] Call trace:\n\u003c4\u003e[772156.446121]  z_erofs_put_gbuf+0x64/0x70 [erofs]\n\u003c4\u003e[772156.446761]  z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\n\u003c4\u003e[772156.446897]  z_erofs_decompress_queue+0x740/0xa10 [erofs]\n\u003c4\u003e[772156.447036]  z_erofs_runqueue+0x428/0x8c0 [erofs]\n\u003c4\u003e[772156.447160]  z_erofs_readahead+0x224/0x390 [erofs]\n.."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through ordinary file reads/readahead on a mounted erofs filesystem (read(), mmap, page-fault paths), which requires local access to the system. There is no network-facing consumer of z_erofs_get_gbuf().\nAC:L - The attacker controls both sides of the race: it drives the decompression load (repeated reads plus cache eviction on compressed erofs files) and simultaneously forces the migration via sched_setaffinity() on its own reader threads or CPU oversubscription, and the bug was already shown to reproduce under a plain stress test.\nPR:L - Any unprivileged local user or sandboxed app that can read a file on an already-mounted erofs image reaches z_erofs_readahead \u2192 z_erofs_get_gbuf with no capability, LSM, or ownership check on the path; on Android every app reads compressed erofs system partitions by default.\nUI:N - The attacker triggers the decompression path entirely with its own reads on an already-mounted filesystem; no victim action such as mounting an image or opening a file is required.\nS:U - The corrupted spinlock state, the shared global buffer, and the resulting hang all reside within the kernel\u0027s own security authority, with no crossing into a hypervisor, IOMMU, or other security scope.\nC:H - The unbalanced spin_unlock() destroys mutual exclusion on the shared global decompression buffer, so one task\u0027s LZ4 decompression reads compressed bytes belonging to another task\u0027s file, placing content derived from files the attacker cannot otherwise read into its own page-cache pages; the same window also lets gbuf_growsize() vunmap a buffer still in use.\nI:H - Concurrent use of the same gbuf lets attacker-supplied compressed input be decompressed into the page cache pages of an unrelated inode, corrupting file data that other \u2014 including privileged \u2014 processes mmap and execute, and the vunmap-under-use window gives a write to freed/unmapped vmalloc memory.\nA:H - On CONFIG_EROFS_FS_DEBUG kernels this immediately panics at the DBG_BUGON in z_erofs_put_gbuf(); on production kernels the abandoned gbuf lock is never released, so every subsequent decompression mapping to it spins forever with preemption disabled, producing a hard lockup/RCU stall that requires a reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:29.855Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/49b22e06a947727a6d1c802d2d9ad92420b90fc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/7dc5537c3f8be87e005f0844a7626c987914f8fd"
        }
      ],
      "title": "erofs: fix race in z_erofs_get_gbuf()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42300",
    "datePublished": "2024-08-17T09:09:07.311Z",
    "dateReserved": "2024-07-30T07:40:12.270Z",
    "dateUpdated": "2026-08-05T11:36:29.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42300",
      "date": "2026-08-05",
      "epss": "0.00144",
      "percentile": "0.04169"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nerofs: fix race in z_erofs_get_gbuf()\\n\\nIn z_erofs_get_gbuf(), the current task may be migrated to another\\nCPU between `z_erofs_gbuf_id()` and `spin_lock(\u0026gbuf-\u003elock)`.\\n\\nTherefore, z_erofs_put_gbuf() will trigger the following issue\\nwhich was found by stress test:\\n\\n\u003c2\u003e[772156.434168] kernel BUG at fs/erofs/zutil.c:58!\\n..\\n\u003c4\u003e[772156.435007]\\n\u003c4\u003e[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G            E      6.10.0-rc7+ #2\\n\u003c4\u003e[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017\\n\u003c4\u003e[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\\n\u003c4\u003e[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs]\\n\u003c4\u003e[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\\n..\\n\u003c6\u003e[772156.445958] stress (3127): drop_caches: 1\\n\u003c4\u003e[772156.446120] Call trace:\\n\u003c4\u003e[772156.446121]  z_erofs_put_gbuf+0x64/0x70 [erofs]\\n\u003c4\u003e[772156.446761]  z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\\n\u003c4\u003e[772156.446897]  z_erofs_decompress_queue+0x740/0xa10 [erofs]\\n\u003c4\u003e[772156.447036]  z_erofs_runqueue+0x428/0x8c0 [erofs]\\n\u003c4\u003e[772156.447160]  z_erofs_readahead+0x224/0x390 [erofs]\\n..\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: erofs: corrige la ejecuci\\u00f3n en z_erofs_get_gbuf() En z_erofs_get_gbuf(), la tarea actual se puede migrar a otra CPU entre `z_erofs_gbuf_id()` y `spin_lock(\u0026amp;gbuf-\u0026gt;lock)` . Por lo tanto, z_erofs_put_gbuf() desencadenar\\u00e1 el siguiente problema que se encontr\\u00f3 en la prueba de estr\\u00e9s: \u0026lt;2\u0026gt;[772156.434168] ERROR del kernel en fs/erofs/zutil.c:58. .. \u0026lt;4\u0026gt;[772156.435007] \u0026lt;4\u0026gt;[772156.439237] CPU: 0 PID: 3078 Comm: estr\\u00e9s Kdump: cargado Contaminado: GE 6.10.0-rc7+ #2 \u0026lt;4\u0026gt;[772156.439239] Nombre de hardware: Alibaba Cloud Alibaba Cloud ECS , BIOS 1.0.0 01/01/2017 \u0026lt;4\u0026gt;[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) \u0026lt;4\u0026gt;[772156.439243] pc: z_erofs_put_gbuf+0x64/0x70 [erofs] \u0026lt;4\u0026gt;[772156.439252] lr: z_erofs_lz4_decompress+0x600/0x6a0 [erofs] .. \u0026lt;6\u0026gt;[772156.445958] estr\\u00e9s (3127): drop_caches: 1 \u0026lt;4\u0026gt;[772156.446120] Rastreo de llamadas: \u0026lt;4\u0026gt;[772156. 446121] z_erofs_put_gbuf+0x64/0x70 [erofs] \u0026lt;4\u0026gt;[772156.446761] z_erofs_lz4_decompress+0x600/0x6a0 [erofs] \u0026lt;4\u0026gt;[772156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs \u0026lt;4\u0026gt;[ 772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs] \u0026lt;4\u0026gt;[772156.447160] z_erofs_readahead+0x224/0x390 [erofs] ..\"}]",
      "id": "CVE-2024-42300",
      "lastModified": "2024-08-19T12:59:59.177",
      "published": "2024-08-17T09:15:10.360",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/49b22e06a947727a6d1c802d2d9ad92420b90fc5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7dc5537c3f8be87e005f0844a7626c987914f8fd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42300\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T09:15:10.360\",\"lastModified\":\"2026-08-04T11:19:49.830\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nerofs: fix race in z_erofs_get_gbuf()\\n\\nIn z_erofs_get_gbuf(), the current task may be migrated to another\\nCPU between `z_erofs_gbuf_id()` and `spin_lock(\u0026gbuf-\u003elock)`.\\n\\nTherefore, z_erofs_put_gbuf() will trigger the following issue\\nwhich was found by stress test:\\n\\n\u003c2\u003e[772156.434168] kernel BUG at fs/erofs/zutil.c:58!\\n..\\n\u003c4\u003e[772156.435007]\\n\u003c4\u003e[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G            E      6.10.0-rc7+ #2\\n\u003c4\u003e[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017\\n\u003c4\u003e[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\\n\u003c4\u003e[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs]\\n\u003c4\u003e[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\\n..\\n\u003c6\u003e[772156.445958] stress (3127): drop_caches: 1\\n\u003c4\u003e[772156.446120] Call trace:\\n\u003c4\u003e[772156.446121]  z_erofs_put_gbuf+0x64/0x70 [erofs]\\n\u003c4\u003e[772156.446761]  z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\\n\u003c4\u003e[772156.446897]  z_erofs_decompress_queue+0x740/0xa10 [erofs]\\n\u003c4\u003e[772156.447036]  z_erofs_runqueue+0x428/0x8c0 [erofs]\\n\u003c4\u003e[772156.447160]  z_erofs_readahead+0x224/0x390 [erofs]\\n..\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: erofs: corrige la ejecuci\u00f3n en z_erofs_get_gbuf() En z_erofs_get_gbuf(), la tarea actual se puede migrar a otra CPU entre `z_erofs_gbuf_id()` y `spin_lock(\u0026amp;gbuf-\u0026gt;lock)` . Por lo tanto, z_erofs_put_gbuf() desencadenar\u00e1 el siguiente problema que se encontr\u00f3 en la prueba de estr\u00e9s: \u0026lt;2\u0026gt;[772156.434168] ERROR del kernel en fs/erofs/zutil.c:58. .. \u0026lt;4\u0026gt;[772156.435007] \u0026lt;4\u0026gt;[772156.439237] CPU: 0 PID: 3078 Comm: estr\u00e9s Kdump: cargado Contaminado: GE 6.10.0-rc7+ #2 \u0026lt;4\u0026gt;[772156.439239] Nombre de hardware: Alibaba Cloud Alibaba Cloud ECS , BIOS 1.0.0 01/01/2017 \u0026lt;4\u0026gt;[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) \u0026lt;4\u0026gt;[772156.439243] pc: z_erofs_put_gbuf+0x64/0x70 [erofs] \u0026lt;4\u0026gt;[772156.439252] lr: z_erofs_lz4_decompress+0x600/0x6a0 [erofs] .. \u0026lt;6\u0026gt;[772156.445958] estr\u00e9s (3127): drop_caches: 1 \u0026lt;4\u0026gt;[772156.446120] Rastreo de llamadas: \u0026lt;4\u0026gt;[772156. 446121] z_erofs_put_gbuf+0x64/0x70 [erofs] \u0026lt;4\u0026gt;[772156.446761] z_erofs_lz4_decompress+0x600/0x6a0 [erofs] \u0026lt;4\u0026gt;[772156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs \u0026lt;4\u0026gt;[ 772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs] \u0026lt;4\u0026gt;[772156.447160] z_erofs_readahead+0x224/0x390 [erofs] ..\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/erofs/zutil.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f36f3010f67611a45d66e773bc91e4c66a9abab5\",\"lessThan\":\"49b22e06a947727a6d1c802d2d9ad92420b90fc5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f36f3010f67611a45d66e773bc91e4c66a9abab5\",\"lessThan\":\"7dc5537c3f8be87e005f0844a7626c987914f8fd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/erofs/zutil.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.3\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:10:35.332066Z\",\"id\":\"CVE-2024-42300\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"21DC7A88-E88C-4C44-9AFB-CBB30134097C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/49b22e06a947727a6d1c802d2d9ad92420b90fc5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7dc5537c3f8be87e005f0844a7626c987914f8fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:27:58+00:00",
      "cve": "CVE-2024-42300",
      "id": "CVE-2024-42300",
      "initial_release_date": "2024-08-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: erofs: fix race in z_erofs_get_gbuf()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42300.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:54:11Z",
      "cve": "CVE-2024-42300",
      "id": "CVE-2024-42300",
      "initial_release_date": "2024-08-18T02:02:25Z",
      "product_status:known_not_affected": "310",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42300",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42300.json",
      "version": "20"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42300\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:10:35.332066Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:23.585Z\"}}], \"cna\": {\"title\": \"erofs: fix race in z_erofs_get_gbuf()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f36f3010f67611a45d66e773bc91e4c66a9abab5\", \"lessThan\": \"49b22e06a947727a6d1c802d2d9ad92420b90fc5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f36f3010f67611a45d66e773bc91e4c66a9abab5\", \"lessThan\": \"7dc5537c3f8be87e005f0844a7626c987914f8fd\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/erofs/zutil.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/erofs/zutil.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/49b22e06a947727a6d1c802d2d9ad92420b90fc5\"}, {\"url\": \"https://git.kernel.org/stable/c/7dc5537c3f8be87e005f0844a7626c987914f8fd\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nerofs: fix race in z_erofs_get_gbuf()\\n\\nIn z_erofs_get_gbuf(), the current task may be migrated to another\\nCPU between `z_erofs_gbuf_id()` and `spin_lock(\u0026gbuf-\u003elock)`.\\n\\nTherefore, z_erofs_put_gbuf() will trigger the following issue\\nwhich was found by stress test:\\n\\n\u003c2\u003e[772156.434168] kernel BUG at fs/erofs/zutil.c:58!\\n..\\n\u003c4\u003e[772156.435007]\\n\u003c4\u003e[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G            E      6.10.0-rc7+ #2\\n\u003c4\u003e[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017\\n\u003c4\u003e[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\\n\u003c4\u003e[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs]\\n\u003c4\u003e[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\\n..\\n\u003c6\u003e[772156.445958] stress (3127): drop_caches: 1\\n\u003c4\u003e[772156.446120] Call trace:\\n\u003c4\u003e[772156.446121]  z_erofs_put_gbuf+0x64/0x70 [erofs]\\n\u003c4\u003e[772156.446761]  z_erofs_lz4_decompress+0x600/0x6a0 [erofs]\\n\u003c4\u003e[772156.446897]  z_erofs_decompress_queue+0x740/0xa10 [erofs]\\n\u003c4\u003e[772156.447036]  z_erofs_runqueue+0x428/0x8c0 [erofs]\\n\u003c4\u003e[772156.447160]  z_erofs_readahead+0x224/0x390 [erofs]\\n..\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:26:17.567Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42300\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:26:17.567Z\", \"dateReserved\": \"2024-07-30T07:40:12.270Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:09:07.311Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.