cve-2024-49982
Vulnerability from cvelistv5
Published
2024-10-21 18:02
Modified
2024-12-19 09:30
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs into use-after-free. Then Nicolai Stange found more places in aoe have potential use-after-free problem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe() and aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push packet to tx queue. So they should also use dev_hold() to increase the refcnt of skb->dev. On the other hand, moving dev_put() to tx() causes that the refcnt of skb->dev be reduced to a negative value, because corresponding dev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(), probe(), and aoecmd_cfg_rsp(). This patch fixed this issue.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645Patch
Impacted products
Vendor Product Version
Linux Linux Version: ad80c34944d7175fa1f5c7a55066020002921a99
Version: 1a54aa506b3b2f31496731039e49778f54eee881
Version: faf0b4c5e00bb680e8e43ac936df24d3f48c8e65
Version: 7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4
Version: 74ca3ef68d2f449bc848c0a814cefc487bf755fa
Version: eb48680b0255a9e8a9bdc93d6a55b11c31262e62
Version: f98364e926626c678fb4b9004b75cacf92ff0662
Version: f98364e926626c678fb4b9004b75cacf92ff0662
Version: f98364e926626c678fb4b9004b75cacf92ff0662
 Create a notification for this product.
   Linux Linux Version: 6.9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:32:22.974285Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:44.189Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/aoe/aoecmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "12f7b89dd72b25da4eeaa22097877963cad6418e",
              "status": "affected",
              "version": "ad80c34944d7175fa1f5c7a55066020002921a99",
              "versionType": "git"
            },
            {
              "lessThan": "a786265aecf39015418e4f930cc1c14603a01490",
              "status": "affected",
              "version": "1a54aa506b3b2f31496731039e49778f54eee881",
              "versionType": "git"
            },
            {
              "lessThan": "f63461af2c1a86af4217910e47a5c46e3372e645",
              "status": "affected",
              "version": "faf0b4c5e00bb680e8e43ac936df24d3f48c8e65",
              "versionType": "git"
            },
            {
              "lessThan": "07b418d50ccbbca7e5d87a3a0d41d436cefebf79",
              "status": "affected",
              "version": "7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4",
              "versionType": "git"
            },
            {
              "lessThan": "bc2cbf7525ac288e07d465f5a1d8cb8fb9599254",
              "status": "affected",
              "version": "74ca3ef68d2f449bc848c0a814cefc487bf755fa",
              "versionType": "git"
            },
            {
              "lessThan": "acc5103a0a8c200a52af7d732c36a8477436a3d3",
              "status": "affected",
              "version": "eb48680b0255a9e8a9bdc93d6a55b11c31262e62",
              "versionType": "git"
            },
            {
              "lessThan": "89d9a69ae0c667e4d9d028028e2dcc837bae626f",
              "status": "affected",
              "version": "f98364e926626c678fb4b9004b75cacf92ff0662",
              "versionType": "git"
            },
            {
              "lessThan": "8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58",
              "status": "affected",
              "version": "f98364e926626c678fb4b9004b75cacf92ff0662",
              "versionType": "git"
            },
            {
              "lessThan": "6d6e54fc71ad1ab0a87047fd9c211e75d86084a3",
              "status": "affected",
              "version": "f98364e926626c678fb4b9004b75cacf92ff0662",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/aoe/aoecmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naoe: fix the potential use-after-free problem in more places\n\nFor fixing CVE-2023-6270, f98364e92662 (\"aoe: fix the potential\nuse-after-free problem in aoecmd_cfg_pkts\") makes tx() calling dev_put()\ninstead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs\ninto use-after-free.\n\nThen Nicolai Stange found more places in aoe have potential use-after-free\nproblem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe()\nand aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push\npacket to tx queue. So they should also use dev_hold() to increase the\nrefcnt of skb-\u003edev.\n\nOn the other hand, moving dev_put() to tx() causes that the refcnt of\nskb-\u003edev be reduced to a negative value, because corresponding\ndev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(),\nprobe(), and aoecmd_cfg_rsp(). This patch fixed this issue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:30:39.439Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490"
        },
        {
          "url": "https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645"
        },
        {
          "url": "https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254"
        },
        {
          "url": "https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3"
        }
      ],
      "title": "aoe: fix the potential use-after-free problem in more places",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49982",
    "datePublished": "2024-10-21T18:02:27.820Z",
    "dateReserved": "2024-10-21T12:17:06.052Z",
    "dateUpdated": "2024-12-19T09:30:39.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49982\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:18.733\",\"lastModified\":\"2024-11-08T16:15:39.680\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naoe: fix the potential use-after-free problem in more places\\n\\nFor fixing CVE-2023-6270, f98364e92662 (\\\"aoe: fix the potential\\nuse-after-free problem in aoecmd_cfg_pkts\\\") makes tx() calling dev_put()\\ninstead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs\\ninto use-after-free.\\n\\nThen Nicolai Stange found more places in aoe have potential use-after-free\\nproblem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe()\\nand aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push\\npacket to tx queue. So they should also use dev_hold() to increase the\\nrefcnt of skb-\u003edev.\\n\\nOn the other hand, moving dev_put() to tx() causes that the refcnt of\\nskb-\u003edev be reduced to a negative value, because corresponding\\ndev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(),\\nprobe(), and aoecmd_cfg_rsp(). This patch fixed this issue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: aoe: soluciona el posible problema de use-after-free en m\u00e1s lugares Para solucionar CVE-2023-6270, f98364e92662 (\\\"aoe: soluciona el posible problema de use-after-free en aoecmd_cfg_pkts\\\") hace que tx() llame a dev_put() en lugar de hacerlo en aoecmd_cfg_pkts(). Esto evita que tx() se ejecute en use-after-free. Luego, Nicolai Stange encontr\u00f3 que m\u00e1s lugares en aoe tienen un posible problema de use-after-free con tx(). Por ejemplo, revalidate(), aoecmd_ata_rw(), resend(), probe() y aoecmd_cfg_rsp(). Esas funciones tambi\u00e9n usan aoenet_xmit() para enviar paquetes a la cola de tx. Por lo tanto, tambi\u00e9n deber\u00edan usar dev_hold() para aumentar el refcnt de skb-\u0026gt;dev. Por otra parte, mover dev_put() a tx() hace que el refcnt de skb-\u0026gt;dev se reduzca a un valor negativo, porque los dev_hold() correspondientes no se llaman en revalidate(), aoecmd_ata_rw(), resend(), probe() y aoecmd_cfg_rsp(). Este parche solucion\u00f3 este problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.214\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"A8846BE7-5AEC-4A74-8E34-0FE8B1205194\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.153\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"41952CCA-3B42-425D-A5FF-DE2474EC8369\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.83\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"161F9759-367F-4944-B666-215896634DCA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.23\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"45944AD8-B4B6-4255-83BA-8A6750FEE47B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.11\",\"versionEndExcluding\":\"6.8.2\",\"matchCriteriaId\":\"2DF20568-DF11-4303-9FA2-3DA7F6C84BD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"158EBA02-95B5-4E0A-85BC-1EAC91B085F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:4.19.311:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70FB9763-2A30-46A0-8FC0-C8152849C55A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.4.273:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"517FA340-6242-490E-A71D-B855DEF4C620\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49982\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:32:22.974285Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:32:26.019Z\"}}], \"cna\": {\"title\": \"aoe: fix the potential use-after-free problem in more places\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ad80c34944d7\", \"lessThan\": \"12f7b89dd72b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1a54aa506b3b\", \"lessThan\": \"a786265aecf3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"faf0b4c5e00b\", \"lessThan\": \"f63461af2c1a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7dd09fa80b07\", \"lessThan\": \"07b418d50ccb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"74ca3ef68d2f\", \"lessThan\": \"bc2cbf7525ac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eb48680b0255\", \"lessThan\": \"acc5103a0a8c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f98364e92662\", \"lessThan\": \"89d9a69ae0c6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f98364e92662\", \"lessThan\": \"8253a60c89ec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f98364e92662\", \"lessThan\": \"6d6e54fc71ad\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/block/aoe/aoecmd.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12-rc2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/block/aoe/aoecmd.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e\"}, {\"url\": \"https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490\"}, {\"url\": \"https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645\"}, {\"url\": \"https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79\"}, {\"url\": \"https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254\"}, {\"url\": \"https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3\"}, {\"url\": \"https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626f\"}, {\"url\": \"https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58\"}, {\"url\": \"https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\naoe: fix the potential use-after-free problem in more places\\n\\nFor fixing CVE-2023-6270, f98364e92662 (\\\"aoe: fix the potential\\nuse-after-free problem in aoecmd_cfg_pkts\\\") makes tx() calling dev_put()\\ninstead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs\\ninto use-after-free.\\n\\nThen Nicolai Stange found more places in aoe have potential use-after-free\\nproblem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe()\\nand aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push\\npacket to tx queue. So they should also use dev_hold() to increase the\\nrefcnt of skb-\u003edev.\\n\\nOn the other hand, moving dev_put() to tx() causes that the refcnt of\\nskb-\u003edev be reduced to a negative value, because corresponding\\ndev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(),\\nprobe(), and aoecmd_cfg_rsp(). This patch fixed this issue.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-08T15:57:43.099Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49982\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-08T15:57:43.099Z\", \"dateReserved\": \"2024-10-21T12:17:06.052Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:02:27.820Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.