CVE-2024-46762
Severity CVSS v4.0:
Pending analysis
Type:
CWE-416
Use After Free
Publication date:
18/09/2024
Last modified:
23/09/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
xen: privcmd: Fix possible access to a freed kirqfd instance<br />
<br />
Nothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and<br />
privcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd<br />
created and added to the irqfds_list by privcmd_irqfd_assign() may get<br />
removed by another thread executing privcmd_irqfd_deassign(), while the<br />
former is still using it after dropping the locks.<br />
<br />
This can lead to a situation where an already freed kirqfd instance may<br />
be accessed and cause kernel oops.<br />
<br />
Use SRCU locking to prevent the same, as is done for the KVM<br />
implementation for irqfds.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.6.51 (excluding) | |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.10.10 (excluding) |
To consult the complete list of CPE names with products and versions, see this page