cve-2024-50002
Vulnerability from cvelistv5
Published
2024-10-21 18:02
Modified
2024-12-19 09:31
Severity ?
EPSS score ?
0.03% (0.05952)
Summary
In the Linux kernel, the following vulnerability has been resolved: static_call: Handle module init failure correctly in static_call_del_module() Module insertion invokes static_call_add_module() to initialize the static calls in a module. static_call_add_module() invokes __static_call_init(), which allocates a struct static_call_mod to either encapsulate the built-in static call sites of the associated key into it so further modules can be added or to append the module to the module chain. If that allocation fails the function returns with an error code and the module core invokes static_call_del_module() to clean up eventually added static_call_mod entries. This works correctly, when all keys used by the module were converted over to a module chain before the failure. If not then static_call_del_module() causes a #GP as it blindly assumes that key::mods points to a valid struct static_call_mod. The problem is that key::mods is not a individual struct member of struct static_call_key, it's part of a union to save space: union { /* bit 0: 0 = mods, 1 = sites */ unsigned long type; struct static_call_mod *mods; struct static_call_site *sites; }; key::sites is a pointer to the list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A mods pointer has the bit clear, the sites pointer has the bit set. As static_call_del_module() blidly assumes that the pointer is a valid static_call_mod type, it fails to check for this failure case and dereferences the pointer to the list of built-in call sites, which is obviously bogus. Cure it by checking whether the key has a sites or a mods pointer. If it's a sites pointer then the key is not to be touched. As the sites are walked in the same order as in __static_call_init() the site walk can be terminated because all subsequent sites have not been touched by the init code due to the error exit. If it was converted before the allocation fail, then the inner loop which searches for a module match will find nothing. A fail in the second allocation in __static_call_init() is harmless and does not require special treatment. The first allocation succeeded and converted the key to a module chain. That first entry has mod::mod == NULL and mod::next == NULL, so the inner loop of static_call_del_module() will neither find a module match nor a module chain. The next site in the walk was either already converted, but can't match the module, or it will exit the outer loop because it has a static_call_site pointer and not a static_call_mod pointer.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2b494471797bff3d257e99dc0a7abb0c5ff3b4cdPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4b30051c4864234ec57290c3d142db7c88f10d8aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9c48c2b53191bf991361998f5bb97b8f2fc5a89cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b566c7d8a2de403ccc9d8a06195e19bbb386d0e4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c0abbbe8c98c077292221ec7e2baa667c9f0974cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ed4c8ce0f307f2ab8778aeb40a8866d171e8f128Patch
Impacted products
Vendor Product Version
Linux Linux Version: 9183c3f9ed710a8edf1a61e8a96d497258d26e08
Version: 9183c3f9ed710a8edf1a61e8a96d497258d26e08
Version: 9183c3f9ed710a8edf1a61e8a96d497258d26e08
Version: 9183c3f9ed710a8edf1a61e8a96d497258d26e08
Version: 9183c3f9ed710a8edf1a61e8a96d497258d26e08
Version: 9183c3f9ed710a8edf1a61e8a96d497258d26e08
 Create a notification for this product.
   Linux Linux Version: 5.10
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-50002",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-22T13:29:50.299737Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-22T13:38:40.988Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "kernel/static_call_inline.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "ed4c8ce0f307f2ab8778aeb40a8866d171e8f128",
                     status: "affected",
                     version: "9183c3f9ed710a8edf1a61e8a96d497258d26e08",
                     versionType: "git",
                  },
                  {
                     lessThan: "b566c7d8a2de403ccc9d8a06195e19bbb386d0e4",
                     status: "affected",
                     version: "9183c3f9ed710a8edf1a61e8a96d497258d26e08",
                     versionType: "git",
                  },
                  {
                     lessThan: "c0abbbe8c98c077292221ec7e2baa667c9f0974c",
                     status: "affected",
                     version: "9183c3f9ed710a8edf1a61e8a96d497258d26e08",
                     versionType: "git",
                  },
                  {
                     lessThan: "2b494471797bff3d257e99dc0a7abb0c5ff3b4cd",
                     status: "affected",
                     version: "9183c3f9ed710a8edf1a61e8a96d497258d26e08",
                     versionType: "git",
                  },
                  {
                     lessThan: "9c48c2b53191bf991361998f5bb97b8f2fc5a89c",
                     status: "affected",
                     version: "9183c3f9ed710a8edf1a61e8a96d497258d26e08",
                     versionType: "git",
                  },
                  {
                     lessThan: "4b30051c4864234ec57290c3d142db7c88f10d8a",
                     status: "affected",
                     version: "9183c3f9ed710a8edf1a61e8a96d497258d26e08",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "kernel/static_call_inline.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "5.10",
                  },
                  {
                     lessThan: "5.10",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.168",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.113",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.55",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.10.*",
                     status: "unaffected",
                     version: "6.10.14",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.11.*",
                     status: "unaffected",
                     version: "6.11.3",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.12",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nstatic_call: Handle module init failure correctly in static_call_del_module()\n\nModule insertion invokes static_call_add_module() to initialize the static\ncalls in a module. static_call_add_module() invokes __static_call_init(),\nwhich allocates a struct static_call_mod to either encapsulate the built-in\nstatic call sites of the associated key into it so further modules can be\nadded or to append the module to the module chain.\n\nIf that allocation fails the function returns with an error code and the\nmodule core invokes static_call_del_module() to clean up eventually added\nstatic_call_mod entries.\n\nThis works correctly, when all keys used by the module were converted over\nto a module chain before the failure. If not then static_call_del_module()\ncauses a #GP as it blindly assumes that key::mods points to a valid struct\nstatic_call_mod.\n\nThe problem is that key::mods is not a individual struct member of struct\nstatic_call_key, it's part of a union to save space:\n\n        union {\n                /* bit 0: 0 = mods, 1 = sites */\n                unsigned long type;\n                struct static_call_mod *mods;\n                struct static_call_site *sites;\n\t};\n\nkey::sites is a pointer to the list of built-in usage sites of the static\ncall. The type of the pointer is differentiated by bit 0. A mods pointer\nhas the bit clear, the sites pointer has the bit set.\n\nAs static_call_del_module() blidly assumes that the pointer is a valid\nstatic_call_mod type, it fails to check for this failure case and\ndereferences the pointer to the list of built-in call sites, which is\nobviously bogus.\n\nCure it by checking whether the key has a sites or a mods pointer.\n\nIf it's a sites pointer then the key is not to be touched. As the sites are\nwalked in the same order as in __static_call_init() the site walk can be\nterminated because all subsequent sites have not been touched by the init\ncode due to the error exit.\n\nIf it was converted before the allocation fail, then the inner loop which\nsearches for a module match will find nothing.\n\nA fail in the second allocation in __static_call_init() is harmless and\ndoes not require special treatment. The first allocation succeeded and\nconverted the key to a module chain. That first entry has mod::mod == NULL\nand mod::next == NULL, so the inner loop of static_call_del_module() will\nneither find a module match nor a module chain. The next site in the walk\nwas either already converted, but can't match the module, or it will exit\nthe outer loop because it has a static_call_site pointer and not a\nstatic_call_mod pointer.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T09:31:03.847Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/ed4c8ce0f307f2ab8778aeb40a8866d171e8f128",
            },
            {
               url: "https://git.kernel.org/stable/c/b566c7d8a2de403ccc9d8a06195e19bbb386d0e4",
            },
            {
               url: "https://git.kernel.org/stable/c/c0abbbe8c98c077292221ec7e2baa667c9f0974c",
            },
            {
               url: "https://git.kernel.org/stable/c/2b494471797bff3d257e99dc0a7abb0c5ff3b4cd",
            },
            {
               url: "https://git.kernel.org/stable/c/9c48c2b53191bf991361998f5bb97b8f2fc5a89c",
            },
            {
               url: "https://git.kernel.org/stable/c/4b30051c4864234ec57290c3d142db7c88f10d8a",
            },
         ],
         title: "static_call: Handle module init failure correctly in static_call_del_module()",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-50002",
      datePublished: "2024-10-21T18:02:40.908Z",
      dateReserved: "2024-10-21T12:17:06.059Z",
      dateUpdated: "2024-12-19T09:31:03.847Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-50002\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:20.200\",\"lastModified\":\"2024-10-30T21:57:59.923\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nstatic_call: Handle module init failure correctly in static_call_del_module()\\n\\nModule insertion invokes static_call_add_module() to initialize the static\\ncalls in a module. static_call_add_module() invokes __static_call_init(),\\nwhich allocates a struct static_call_mod to either encapsulate the built-in\\nstatic call sites of the associated key into it so further modules can be\\nadded or to append the module to the module chain.\\n\\nIf that allocation fails the function returns with an error code and the\\nmodule core invokes static_call_del_module() to clean up eventually added\\nstatic_call_mod entries.\\n\\nThis works correctly, when all keys used by the module were converted over\\nto a module chain before the failure. If not then static_call_del_module()\\ncauses a #GP as it blindly assumes that key::mods points to a valid struct\\nstatic_call_mod.\\n\\nThe problem is that key::mods is not a individual struct member of struct\\nstatic_call_key, it's part of a union to save space:\\n\\n        union {\\n                /* bit 0: 0 = mods, 1 = sites */\\n                unsigned long type;\\n                struct static_call_mod *mods;\\n                struct static_call_site *sites;\\n\\t};\\n\\nkey::sites is a pointer to the list of built-in usage sites of the static\\ncall. The type of the pointer is differentiated by bit 0. A mods pointer\\nhas the bit clear, the sites pointer has the bit set.\\n\\nAs static_call_del_module() blidly assumes that the pointer is a valid\\nstatic_call_mod type, it fails to check for this failure case and\\ndereferences the pointer to the list of built-in call sites, which is\\nobviously bogus.\\n\\nCure it by checking whether the key has a sites or a mods pointer.\\n\\nIf it's a sites pointer then the key is not to be touched. As the sites are\\nwalked in the same order as in __static_call_init() the site walk can be\\nterminated because all subsequent sites have not been touched by the init\\ncode due to the error exit.\\n\\nIf it was converted before the allocation fail, then the inner loop which\\nsearches for a module match will find nothing.\\n\\nA fail in the second allocation in __static_call_init() is harmless and\\ndoes not require special treatment. The first allocation succeeded and\\nconverted the key to a module chain. That first entry has mod::mod == NULL\\nand mod::next == NULL, so the inner loop of static_call_del_module() will\\nneither find a module match nor a module chain. The next site in the walk\\nwas either already converted, but can't match the module, or it will exit\\nthe outer loop because it has a static_call_site pointer and not a\\nstatic_call_mod pointer.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: static_call: Manejar el error de inicialización del módulo correctamente en static_call_del_module() La inserción del módulo invoca static_call_add_module() para inicializar las llamadas estáticas en un módulo. static_call_add_module() invoca __static_call_init(), que asigna una estructura static_call_mod para encapsular los sitios de llamadas estáticas integrados de la clave asociada en ella para que se puedan agregar más módulos o para agregar el módulo a la cadena de módulos. Si esa asignación fallo, la función regresa con un código de error y el núcleo del módulo invoca static_call_del_module() para limpiar las entradas static_call_mod agregadas eventualmente. Esto funciona correctamente, cuando todas las claves utilizadas por el módulo se convirtieron a una cadena de módulos antes del error. Si no, static_call_del_module() causa un #GP ya que asume ciegamente que key::mods apunta a una estructura static_call_mod válida. El problema es que key::mods no es un miembro de estructura individual de struct static_call_key, es parte de una unión para ahorrar espacio: union { /* bit 0: 0 = mods, 1 = sites */ unsigned long type; struct static_call_mod *mods; struct static_call_site *sites; }; key::sites es un puntero a la lista de sitios de uso integrados de la llamada estática. El tipo del puntero se diferencia por el bit 0. Un puntero mods tiene el bit claro, el puntero sites tiene el bit establecido. Como static_call_del_module() asume ciegamente que el puntero es un tipo static_call_mod válido, no puede verificar este caso de fallo y desreferencia el puntero a la lista de sitios de llamada integrados, lo que obviamente es falso. Solucione esto verificando si la clave tiene un puntero sites o mods. Si es un puntero sites, entonces no se debe tocar la clave. Como los sitios se recorren en el mismo orden que en __static_call_init(), el recorrido del sitio puede terminarse porque el código de inicio no ha tocado todos los sitios posteriores debido a la salida de error. Si se convirtió antes de que fallara la asignación, entonces el bucle interno que busca una coincidencia de módulo no encontrará nada. un fallo en la segunda asignación en __static_call_init() es inofensiva y no requiere un tratamiento especial. La primera asignación tuvo éxito y convirtió la clave en una cadena de módulos. Esa primera entrada tiene mod::mod == NULL y mod::next == NULL, por lo que el bucle interno de static_call_del_module() no encontrará una coincidencia de módulo ni una cadena de módulos. El siguiente sitio en el recorrido ya se convirtió, pero no puede coincidir con el módulo, o saldrá del bucle externo porque tiene un puntero static_call_site y no un puntero static_call_mod.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"243E517F-E8D1-4CB4-B5E1-099330E2800C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2b494471797bff3d257e99dc0a7abb0c5ff3b4cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b30051c4864234ec57290c3d142db7c88f10d8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c48c2b53191bf991361998f5bb97b8f2fc5a89c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b566c7d8a2de403ccc9d8a06195e19bbb386d0e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0abbbe8c98c077292221ec7e2baa667c9f0974c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed4c8ce0f307f2ab8778aeb40a8866d171e8f128\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50002\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:29:50.299737Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:29:53.578Z\"}}], \"cna\": {\"title\": \"static_call: Handle module init failure correctly in static_call_del_module()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9183c3f9ed71\", \"lessThan\": \"ed4c8ce0f307\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9183c3f9ed71\", \"lessThan\": \"b566c7d8a2de\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9183c3f9ed71\", \"lessThan\": \"c0abbbe8c98c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9183c3f9ed71\", \"lessThan\": \"2b494471797b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9183c3f9ed71\", \"lessThan\": \"9c48c2b53191\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9183c3f9ed71\", \"lessThan\": \"4b30051c4864\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/static_call_inline.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12-rc1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/static_call_inline.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ed4c8ce0f307f2ab8778aeb40a8866d171e8f128\"}, {\"url\": \"https://git.kernel.org/stable/c/b566c7d8a2de403ccc9d8a06195e19bbb386d0e4\"}, {\"url\": \"https://git.kernel.org/stable/c/c0abbbe8c98c077292221ec7e2baa667c9f0974c\"}, {\"url\": \"https://git.kernel.org/stable/c/2b494471797bff3d257e99dc0a7abb0c5ff3b4cd\"}, {\"url\": \"https://git.kernel.org/stable/c/9c48c2b53191bf991361998f5bb97b8f2fc5a89c\"}, {\"url\": \"https://git.kernel.org/stable/c/4b30051c4864234ec57290c3d142db7c88f10d8a\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nstatic_call: Handle module init failure correctly in static_call_del_module()\\n\\nModule insertion invokes static_call_add_module() to initialize the static\\ncalls in a module. static_call_add_module() invokes __static_call_init(),\\nwhich allocates a struct static_call_mod to either encapsulate the built-in\\nstatic call sites of the associated key into it so further modules can be\\nadded or to append the module to the module chain.\\n\\nIf that allocation fails the function returns with an error code and the\\nmodule core invokes static_call_del_module() to clean up eventually added\\nstatic_call_mod entries.\\n\\nThis works correctly, when all keys used by the module were converted over\\nto a module chain before the failure. If not then static_call_del_module()\\ncauses a #GP as it blindly assumes that key::mods points to a valid struct\\nstatic_call_mod.\\n\\nThe problem is that key::mods is not a individual struct member of struct\\nstatic_call_key, it's part of a union to save space:\\n\\n        union {\\n                /* bit 0: 0 = mods, 1 = sites */\\n                unsigned long type;\\n                struct static_call_mod *mods;\\n                struct static_call_site *sites;\\n\\t};\\n\\nkey::sites is a pointer to the list of built-in usage sites of the static\\ncall. The type of the pointer is differentiated by bit 0. A mods pointer\\nhas the bit clear, the sites pointer has the bit set.\\n\\nAs static_call_del_module() blidly assumes that the pointer is a valid\\nstatic_call_mod type, it fails to check for this failure case and\\ndereferences the pointer to the list of built-in call sites, which is\\nobviously bogus.\\n\\nCure it by checking whether the key has a sites or a mods pointer.\\n\\nIf it's a sites pointer then the key is not to be touched. As the sites are\\nwalked in the same order as in __static_call_init() the site walk can be\\nterminated because all subsequent sites have not been touched by the init\\ncode due to the error exit.\\n\\nIf it was converted before the allocation fail, then the inner loop which\\nsearches for a module match will find nothing.\\n\\nA fail in the second allocation in __static_call_init() is harmless and\\ndoes not require special treatment. The first allocation succeeded and\\nconverted the key to a module chain. That first entry has mod::mod == NULL\\nand mod::next == NULL, so the inner loop of static_call_del_module() will\\nneither find a module match nor a module chain. The next site in the walk\\nwas either already converted, but can't match the module, or it will exit\\nthe outer loop because it has a static_call_site pointer and not a\\nstatic_call_mod pointer.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:53:16.567Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-50002\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:53:16.567Z\", \"dateReserved\": \"2024-10-21T12:17:06.059Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:02:40.908Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.