Vulnerability-Lookup

CERTFR-2024-AVI-0872

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Debian	N/A	Debian LTS bullseye versions antérieures à 5.10.226-1

References

Title

Publication Time

CVE-2024-42302 (GCVE-0-2024-42302)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-05-23 15:52

Title

PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal

Summary

In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpc_handler() awaits readiness of the secondary bus below the Downstream Port where the DPC event occurred. To do so, it polls the config space of the first child device on the secondary bus. If that child device is concurrently removed, accesses to its struct pci_dev cause the kernel to oops. That's because pci_bridge_wait_for_secondary_bus() neglects to hold a reference on the child device. Before v6.3, the function was only called on resume from system sleep or on runtime resume. Holding a reference wasn't necessary back then because the pciehp IRQ thread could never run concurrently. (On resume from system sleep, IRQs are not enabled until after the resume_noirq phase. And runtime resume is always awaited before a PCI device is removed.) However starting with v6.3, pci_bridge_wait_for_secondary_bus() is also called on a DPC event. Commit 53b54ad074de ("PCI/DPC: Await readiness of secondary bus after reset"), which introduced that, failed to appreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a reference on the child device because dpc_handler() and pciehp may indeed run concurrently. The commit was backported to v5.10+ stable kernels, so that's the oldest one affected. Add the missing reference acquisition. Abridged stack trace: BUG: unable to handle page fault for address: 00000000091400c0 CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0 RIP: pci_bus_read_config_dword+0x17/0x50 pci_dev_wait() pci_bridge_wait_for_secondary_bus() dpc_reset_link() pcie_do_recovery() dpc_handler()

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:10 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/c52f9e1a9eb40f139…
https://git.kernel.org/stable/c/2c111413f38ca5cf8…
https://git.kernel.org/stable/c/f63df70b439bb8331…
https://git.kernel.org/stable/c/2cc8973bdc4d6c928…
https://git.kernel.org/stable/c/b16f3ea1db47a6766…
https://git.kernel.org/stable/c/11a1f4bc47362700f…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2024…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: d0292124bb5787a2f1ab1316509e801ca89c10fb , < c52f9e1a9eb40f13993142c331a6cfd334d4b91d (git) Affected: ffe2318405e605f1b3985ce188eff69e6d1d1baa , < 2c111413f38ca5cf87557cab89f6d82b0e3433e7 (git) Affected: 189f856e76f5463f59efb5fc18dcc1692d04c41a , < f63df70b439bb8331358a306541893bf415bf1da (git) Affected: 53b54ad074de1896f8b021615f65b27f557ce874 , < 2cc8973bdc4d6c928ebe38b88090a2cdfe81f42f (git) Affected: 53b54ad074de1896f8b021615f65b27f557ce874 , < b16f3ea1db47a6766a9f1169244cf1fc287a7c62 (git) Affected: 53b54ad074de1896f8b021615f65b27f557ce874 , < 11a1f4bc47362700fcbde717292158873fb847ed (git) Affected: 0081032082b5b45ca902b3c3d6986cb5cca69ff2 (git) Affected: 5.10.176 , < 5.10.224 (semver) Affected: 5.15.104 , < 5.15.165 (semver) Affected: 6.1.16 , < 6.1.103 (semver) Affected: 6.2.3 , < 6.3 (semver)
Linux	Linux	Affected: 6.3 Unaffected: 0 , < 6.3 (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.103 , ≤ 6.1.* (semver) Unaffected: 6.6.44 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42302",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:10:28.656566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:28.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:06.070Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:56:49.184Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c52f9e1a9eb40f13993142c331a6cfd334d4b91d",
              "status": "affected",
              "version": "d0292124bb5787a2f1ab1316509e801ca89c10fb",
              "versionType": "git"
            },
            {
              "lessThan": "2c111413f38ca5cf87557cab89f6d82b0e3433e7",
              "status": "affected",
              "version": "ffe2318405e605f1b3985ce188eff69e6d1d1baa",
              "versionType": "git"
            },
            {
              "lessThan": "f63df70b439bb8331358a306541893bf415bf1da",
              "status": "affected",
              "version": "189f856e76f5463f59efb5fc18dcc1692d04c41a",
              "versionType": "git"
            },
            {
              "lessThan": "2cc8973bdc4d6c928ebe38b88090a2cdfe81f42f",
              "status": "affected",
              "version": "53b54ad074de1896f8b021615f65b27f557ce874",
              "versionType": "git"
            },
            {
              "lessThan": "b16f3ea1db47a6766a9f1169244cf1fc287a7c62",
              "status": "affected",
              "version": "53b54ad074de1896f8b021615f65b27f557ce874",
              "versionType": "git"
            },
            {
              "lessThan": "11a1f4bc47362700fcbde717292158873fb847ed",
              "status": "affected",
              "version": "53b54ad074de1896f8b021615f65b27f557ce874",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0081032082b5b45ca902b3c3d6986cb5cca69ff2",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.224",
              "status": "affected",
              "version": "5.10.176",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.165",
              "status": "affected",
              "version": "5.15.104",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.103",
              "status": "affected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "5.10.176",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "5.15.104",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "6.1.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/DPC: Fix use-after-free on concurrent DPC and hot-removal\n\nKeith reports a use-after-free when a DPC event occurs concurrently to\nhot-removal of the same portion of the hierarchy:\n\nThe dpc_handler() awaits readiness of the secondary bus below the\nDownstream Port where the DPC event occurred.  To do so, it polls the\nconfig space of the first child device on the secondary bus.  If that\nchild device is concurrently removed, accesses to its struct pci_dev\ncause the kernel to oops.\n\nThat\u0027s because pci_bridge_wait_for_secondary_bus() neglects to hold a\nreference on the child device.  Before v6.3, the function was only\ncalled on resume from system sleep or on runtime resume.  Holding a\nreference wasn\u0027t necessary back then because the pciehp IRQ thread\ncould never run concurrently.  (On resume from system sleep, IRQs are\nnot enabled until after the resume_noirq phase.  And runtime resume is\nalways awaited before a PCI device is removed.)\n\nHowever starting with v6.3, pci_bridge_wait_for_secondary_bus() is also\ncalled on a DPC event.  Commit 53b54ad074de (\"PCI/DPC: Await readiness\nof secondary bus after reset\"), which introduced that, failed to\nappreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a\nreference on the child device because dpc_handler() and pciehp may\nindeed run concurrently.  The commit was backported to v5.10+ stable\nkernels, so that\u0027s the oldest one affected.\n\nAdd the missing reference acquisition.\n\nAbridged stack trace:\n\n  BUG: unable to handle page fault for address: 00000000091400c0\n  CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0\n  RIP: pci_bus_read_config_dword+0x17/0x50\n  pci_dev_wait()\n  pci_bridge_wait_for_secondary_bus()\n  dpc_reset_link()\n  pcie_do_recovery()\n  dpc_handler()"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:52:45.929Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c52f9e1a9eb40f13993142c331a6cfd334d4b91d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c111413f38ca5cf87557cab89f6d82b0e3433e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f63df70b439bb8331358a306541893bf415bf1da"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cc8973bdc4d6c928ebe38b88090a2cdfe81f42f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b16f3ea1db47a6766a9f1169244cf1fc287a7c62"
        },
        {
          "url": "https://git.kernel.org/stable/c/11a1f4bc47362700fcbde717292158873fb847ed"
        }
      ],
      "title": "PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42302",
    "datePublished": "2024-08-17T09:09:08.891Z",
    "dateReserved": "2024-07-30T07:40:12.272Z",
    "dateUpdated": "2026-05-23T15:52:45.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-42304 (GCVE-0-2024-42304)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-08-05 11:36

Title

ext4: make sure the first directory block is not a hole

Summary

In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow. ext4_mknod ... ext4_add_entry // Read block 0 ext4_read_dirblock(dir, block, DIRENT) bh = ext4_bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENT_HTREE)) // The first directory block is a hole // But type == DIRENT, so no error is reported. After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash. Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:10 UTC

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/d81d7e347d1f1f48a…
https://git.kernel.org/stable/c/e02f9941e8c011aa3…
https://git.kernel.org/stable/c/de2a011a13a46468a…
https://git.kernel.org/stable/c/9771e3d8365ae1dd5…
https://git.kernel.org/stable/c/b609753cbbd38f8c0…
https://git.kernel.org/stable/c/c3893d9de8ee153ba…
https://git.kernel.org/stable/c/299bc6ffa57e04e74…
https://git.kernel.org/stable/c/f9ca51596bbfd0f9c…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2024…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 3a17ca864baffc0c6f6e8aad525aa4365775a193 , < d81d7e347d1f1f48a5634607d39eb90c161c8afe (git) Affected: 4e19d6b65fb4fc42e352ce9883649e049da14743 , < e02f9941e8c011aa3eafa799def6a134ce06bcfa (git) Affected: 4e19d6b65fb4fc42e352ce9883649e049da14743 , < de2a011a13a46468a6e8259db58b1b62071fe136 (git) Affected: 4e19d6b65fb4fc42e352ce9883649e049da14743 , < 9771e3d8365ae1dd5e8846a204cb9af14e3e656a (git) Affected: 4e19d6b65fb4fc42e352ce9883649e049da14743 , < b609753cbbd38f8c0affd4956c0af178348523ac (git) Affected: 4e19d6b65fb4fc42e352ce9883649e049da14743 , < c3893d9de8ee153baac56d127d844103488133b5 (git) Affected: 4e19d6b65fb4fc42e352ce9883649e049da14743 , < 299bc6ffa57e04e74c6cce866d6c0741fb4897a1 (git) Affected: 4e19d6b65fb4fc42e352ce9883649e049da14743 , < f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6 (git) Affected: 3f0307b0d2d8b333a6964fc4c820dc86896fd1cf (git) Affected: 514631c2225c1fd556c799cc1893fb27b0f48f00 (git) Affected: 7f1f86276515f6816a98f6ca3ef99c827d54642f (git) Affected: 5021b7a5bdd6bb859eb648c3da71cdd6aae1d133 (git) Affected: 4.19.62 , < 4.19.320 (semver) Affected: 4.9.187 , < 4.10 (semver) Affected: 4.14.135 , < 4.15 (semver) Affected: 5.1.21 , < 5.2 (semver) Affected: 5.2.4 , < 5.3 (semver)
Linux	Linux	Affected: 5.3 Unaffected: 0 , < 5.3 (semver) Unaffected: 4.19.320 , ≤ 4.19.* (semver) Unaffected: 5.4.282 , ≤ 5.4.* (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.103 , ≤ 6.1.* (semver) Unaffected: 6.6.44 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42304",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:10:22.365835Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:28.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:09.091Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:56:50.352Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d81d7e347d1f1f48a5634607d39eb90c161c8afe",
              "status": "affected",
              "version": "3a17ca864baffc0c6f6e8aad525aa4365775a193",
              "versionType": "git"
            },
            {
              "lessThan": "e02f9941e8c011aa3eafa799def6a134ce06bcfa",
              "status": "affected",
              "version": "4e19d6b65fb4fc42e352ce9883649e049da14743",
              "versionType": "git"
            },
            {
              "lessThan": "de2a011a13a46468a6e8259db58b1b62071fe136",
              "status": "affected",
              "version": "4e19d6b65fb4fc42e352ce9883649e049da14743",
              "versionType": "git"
            },
            {
              "lessThan": "9771e3d8365ae1dd5e8846a204cb9af14e3e656a",
              "status": "affected",
              "version": "4e19d6b65fb4fc42e352ce9883649e049da14743",
              "versionType": "git"
            },
            {
              "lessThan": "b609753cbbd38f8c0affd4956c0af178348523ac",
              "status": "affected",
              "version": "4e19d6b65fb4fc42e352ce9883649e049da14743",
              "versionType": "git"
            },
            {
              "lessThan": "c3893d9de8ee153baac56d127d844103488133b5",
              "status": "affected",
              "version": "4e19d6b65fb4fc42e352ce9883649e049da14743",
              "versionType": "git"
            },
            {
              "lessThan": "299bc6ffa57e04e74c6cce866d6c0741fb4897a1",
              "status": "affected",
              "version": "4e19d6b65fb4fc42e352ce9883649e049da14743",
              "versionType": "git"
            },
            {
              "lessThan": "f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6",
              "status": "affected",
              "version": "4e19d6b65fb4fc42e352ce9883649e049da14743",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3f0307b0d2d8b333a6964fc4c820dc86896fd1cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "514631c2225c1fd556c799cc1893fb27b0f48f00",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7f1f86276515f6816a98f6ca3ef99c827d54642f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5021b7a5bdd6bb859eb648c3da71cdd6aae1d133",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.320",
              "status": "affected",
              "version": "4.19.62",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.187",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.135",
              "versionType": "semver"
            },
            {
              "lessThan": "5.2",
              "status": "affected",
              "version": "5.1.21",
              "versionType": "semver"
            },
            {
              "lessThan": "5.3",
              "status": "affected",
              "version": "5.2.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "4.19.62",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.135",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.1.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.2.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: make sure the first directory block is not a hole\n\nThe syzbot constructs a directory that has no dirblock but is non-inline,\ni.e. the first directory block is a hole. And no errors are reported when\ncreating files in this directory in the following flow.\n\n    ext4_mknod\n     ...\n      ext4_add_entry\n        // Read block 0\n        ext4_read_dirblock(dir, block, DIRENT)\n          bh = ext4_bread(NULL, inode, block, 0)\n          if (!bh \u0026\u0026 (type == INDEX || type == DIRENT_HTREE))\n          // The first directory block is a hole\n          // But type == DIRENT, so no error is reported.\n\nAfter that, we get a directory block without \u0027.\u0027 and \u0027..\u0027 but with a valid\ndentry. This may cause some code that relies on dot or dotdot (such as\nmake_indexed_dir()) to crash.\n\nTherefore when ext4_read_dirblock() finds that the first directory block\nis a hole report that the filesystem is corrupted and return an error to\navoid loading corrupted data from disk causing something bad."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a locally mounted ext4 filesystem containing the crafted directory and is driven by ordinary local syscalls (creat/mknod/rename) against that directory. There is no network-facing path into `ext4_add_entry()` without a locally mounted corrupt image.\nAC:L - The attacker fully controls the on-disk image, so the block-0 hole and the resulting dot/dotdot-less directory are created deterministically; no race, timing window, or uncontrollable memory layout is involved. A single file creation followed by a rename reliably reaches `make_indexed_dir()`/`do_split()`.\nPR:L - Once the crafted or corrupted filesystem is mounted, any unprivileged local user with write access to the affected directory triggers the bug through normal file-creation and rename syscalls. No CAP_SYS_ADMIN or other capability is checked on this path.\nUI:N - No victim action is needed at exploit time \u2014 the corrupt filesystem may already be mounted (shared/automounted removable media via udisks2, or pre-existing on-disk corruption), and the trigger is the attacker\u0027s own syscalls. This matches CNA precedent for ext4 bugs triggered by operations on an already-mounted corrupt image.\nS:U - The out-of-bounds access and directory-metadata corruption occur entirely within the kernel\u0027s own security authority on the affected host. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dot/dotdot-less directory causes `do_split()` to index `map[0xFFFFFFFF]`, an unbounded out-of-bounds read far outside the buffer whose result is folded into the persisted htree hash, and `ext4_htree_fill_tree()` copies attacker-chosen `name_len` bytes of adjacent block data out to userspace via getdents. This is arbitrary/unbounded kernel memory disclosure, not a few strictly bounded bytes.\nI:H - The kernel silently accepts and writes back corrupt directory metadata \u2014 allocating and populating block 0 without `.`/`..`, then running `dx_move_dirents()`/`dx_pack_dirents()` memcpy/memset operations and `dx_insert_block()` driven by a bogus entry map and out-of-bounds-derived hash. The resulting attacker-influenced kernel memory corruption and on-disk directory/htree corruption is exploitable for control-flow-relevant heap manipulation.\nA:H - The wild out-of-bounds read triggers an unrecoverable page fault / kernel oops (as captured by syzbot) while the task holds the directory `i_rwsem` and an open jbd2 transaction handle, hanging the filesystem for all other users. Any kernel oops or panic is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:31.993Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607d39eb90c161c8afe"
        },
        {
          "url": "https://git.kernel.org/stable/c/e02f9941e8c011aa3eafa799def6a134ce06bcfa"
        },
        {
          "url": "https://git.kernel.org/stable/c/de2a011a13a46468a6e8259db58b1b62071fe136"
        },
        {
          "url": "https://git.kernel.org/stable/c/9771e3d8365ae1dd5e8846a204cb9af14e3e656a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b609753cbbd38f8c0affd4956c0af178348523ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3893d9de8ee153baac56d127d844103488133b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/299bc6ffa57e04e74c6cce866d6c0741fb4897a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6"
        }
      ],
      "title": "ext4: make sure the first directory block is not a hole",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42304",
    "datePublished": "2024-08-17T09:09:10.545Z",
    "dateReserved": "2024-07-30T07:40:12.272Z",
    "dateUpdated": "2026-08-05T11:36:31.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-42305 (GCVE-0-2024-42305)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-05-12 11:56

Title

ext4: check dot and dotdot of dx_root before making dir indexed

Summary

In the Linux kernel, the following vulnerability has been resolved: ext4: check dot and dotdot of dx_root before making dir indexed Syzbot reports a issue as follows: ============================================ BUG: unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D 23ffee067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0 Call Trace: <TASK> make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451 ext4_rename fs/ext4/namei.c:3936 [inline] ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214 [...] ============================================ The immediate cause of this problem is that there is only one valid dentry for the block to be split during do_split, so split==0 results in out of bounds accesses to the map triggering the issue. do_split unsigned split dx_make_map count = 1 split = count/2 = 0; continued = hash2 == map[split - 1].hash; ---> map[4294967295] The maximum length of a filename is 255 and the minimum block size is 1024, so it is always guaranteed that the number of entries is greater than or equal to 2 when do_split() is called. But syzbot's crafted image has no dot and dotdot in dir, and the dentry distribution in dirblock is as follows: bus dentry1 hole dentry2 free |xx--|xx-------------|...............|xx-------------|...............| 0 12 (8+248)=256 268 256 524 (8+256)=264 788 236 1024 So when renaming dentry1 increases its name_len length by 1, neither hole nor free is sufficient to hold the new dentry, and make_indexed_dir() is called. In make_indexed_dir() it is assumed that the first two entries of the dirblock must be dot and dotdot, so bus and dentry1 are left in dx_root because they are treated as dot and dotdot, and only dentry2 is moved to the new leaf block. That's why count is equal to 1. Therefore add the ext4_check_dx_root() helper function to add more sanity checks to dot and dotdot before starting the conversion to avoid the above issue.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:10 UTC

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/b80575ffa98b5bb3a…
https://git.kernel.org/stable/c/19e13b4d7f0303186…
https://git.kernel.org/stable/c/42d420517072028fb…
https://git.kernel.org/stable/c/8afe06ed3be7a874b…
https://git.kernel.org/stable/c/abb411ac991810c0b…
https://git.kernel.org/stable/c/9d241b7a39af192d1…
https://git.kernel.org/stable/c/cdd345321699042ec…
https://git.kernel.org/stable/c/50ea741def587a64e…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2024…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: ac27a0ec112a089f1a5102bc8dffc79c8c815571 , < b80575ffa98b5bb3a5d4d392bfe4c2e03e9557db (git) Affected: ac27a0ec112a089f1a5102bc8dffc79c8c815571 , < 19e13b4d7f0303186fcc891aba8d0de7c8fdbda8 (git) Affected: ac27a0ec112a089f1a5102bc8dffc79c8c815571 , < 42d420517072028fb0eb852c358056b7717ba5aa (git) Affected: ac27a0ec112a089f1a5102bc8dffc79c8c815571 , < 8afe06ed3be7a874b3cd82ef5f8959aca8d6429a (git) Affected: ac27a0ec112a089f1a5102bc8dffc79c8c815571 , < abb411ac991810c0bcbe51c2e76d2502bf611b5c (git) Affected: ac27a0ec112a089f1a5102bc8dffc79c8c815571 , < 9d241b7a39af192d1bb422714a458982c7cc67a2 (git) Affected: ac27a0ec112a089f1a5102bc8dffc79c8c815571 , < cdd345321699042ece4a9d2e70754d2397d378c5 (git) Affected: ac27a0ec112a089f1a5102bc8dffc79c8c815571 , < 50ea741def587a64e08879ce6c6a30131f7111e7 (git)
Linux	Linux	Affected: 2.6.19 Unaffected: 0 , < 2.6.19 (semver) Unaffected: 4.19.320 , ≤ 4.19.* (semver) Unaffected: 5.4.282 , ≤ 5.4.* (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.103 , ≤ 6.1.* (semver) Unaffected: 6.6.44 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42305",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:10:19.161352Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:27.970Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:12.008Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:56:51.529Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b80575ffa98b5bb3a5d4d392bfe4c2e03e9557db",
              "status": "affected",
              "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571",
              "versionType": "git"
            },
            {
              "lessThan": "19e13b4d7f0303186fcc891aba8d0de7c8fdbda8",
              "status": "affected",
              "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571",
              "versionType": "git"
            },
            {
              "lessThan": "42d420517072028fb0eb852c358056b7717ba5aa",
              "status": "affected",
              "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571",
              "versionType": "git"
            },
            {
              "lessThan": "8afe06ed3be7a874b3cd82ef5f8959aca8d6429a",
              "status": "affected",
              "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571",
              "versionType": "git"
            },
            {
              "lessThan": "abb411ac991810c0bcbe51c2e76d2502bf611b5c",
              "status": "affected",
              "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571",
              "versionType": "git"
            },
            {
              "lessThan": "9d241b7a39af192d1bb422714a458982c7cc67a2",
              "status": "affected",
              "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571",
              "versionType": "git"
            },
            {
              "lessThan": "cdd345321699042ece4a9d2e70754d2397d378c5",
              "status": "affected",
              "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571",
              "versionType": "git"
            },
            {
              "lessThan": "50ea741def587a64e08879ce6c6a30131f7111e7",
              "status": "affected",
              "version": "ac27a0ec112a089f1a5102bc8dffc79c8c815571",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: check dot and dotdot of dx_root before making dir indexed\n\nSyzbot reports a issue as follows:\n============================================\nBUG: unable to handle page fault for address: ffffed11022e24fe\nPGD 23ffee067 P4D 23ffee067 PUD 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0\nCall Trace:\n \u003cTASK\u003e\n make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341\n ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451\n ext4_rename fs/ext4/namei.c:3936 [inline]\n ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214\n[...]\n============================================\n\nThe immediate cause of this problem is that there is only one valid dentry\nfor the block to be split during do_split, so split==0 results in out of\nbounds accesses to the map triggering the issue.\n\n    do_split\n      unsigned split\n      dx_make_map\n       count = 1\n      split = count/2 = 0;\n      continued = hash2 == map[split - 1].hash;\n       ---\u003e map[4294967295]\n\nThe maximum length of a filename is 255 and the minimum block size is 1024,\nso it is always guaranteed that the number of entries is greater than or\nequal to 2 when do_split() is called.\n\nBut syzbot\u0027s crafted image has no dot and dotdot in dir, and the dentry\ndistribution in dirblock is as follows:\n\n  bus     dentry1          hole           dentry2           free\n|xx--|xx-------------|...............|xx-------------|...............|\n0   12 (8+248)=256  268     256     524 (8+256)=264 788     236     1024\n\nSo when renaming dentry1 increases its name_len length by 1, neither hole\nnor free is sufficient to hold the new dentry, and make_indexed_dir() is\ncalled.\n\nIn make_indexed_dir() it is assumed that the first two entries of the\ndirblock must be dot and dotdot, so bus and dentry1 are left in dx_root\nbecause they are treated as dot and dotdot, and only dentry2 is moved\nto the new leaf block. That\u0027s why count is equal to 1.\n\nTherefore add the ext4_check_dx_root() helper function to add more sanity\nchecks to dot and dotdot before starting the conversion to avoid the above\nissue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:29:48.607Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b80575ffa98b5bb3a5d4d392bfe4c2e03e9557db"
        },
        {
          "url": "https://git.kernel.org/stable/c/19e13b4d7f0303186fcc891aba8d0de7c8fdbda8"
        },
        {
          "url": "https://git.kernel.org/stable/c/42d420517072028fb0eb852c358056b7717ba5aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/8afe06ed3be7a874b3cd82ef5f8959aca8d6429a"
        },
        {
          "url": "https://git.kernel.org/stable/c/abb411ac991810c0bcbe51c2e76d2502bf611b5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d241b7a39af192d1bb422714a458982c7cc67a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdd345321699042ece4a9d2e70754d2397d378c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/50ea741def587a64e08879ce6c6a30131f7111e7"
        }
      ],
      "title": "ext4: check dot and dotdot of dx_root before making dir indexed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42305",
    "datePublished": "2024-08-17T09:09:11.296Z",
    "dateReserved": "2024-07-30T07:40:12.273Z",
    "dateUpdated": "2026-05-12T11:56:51.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-42306 (GCVE-0-2024-42306)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-08-05 11:36

Title

udf: Avoid using corrupted block bitmap buffer

Summary

In the Linux kernel, the following vulnerability has been resolved: udf: Avoid using corrupted block bitmap buffer When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the next allocation from the same bitmap will notice the bitmap buffer is already loaded and tries to allocate from the bitmap with mixed results (depending on the exact nature of the bitmap corruption). Fix the problem by using BH_verified bit to indicate whether the bitmap is valid or not.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:10 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/cae9e59cc41683408…
https://git.kernel.org/stable/c/2199e157a465aaf98…
https://git.kernel.org/stable/c/6a43e3c210df6c5f0…
https://git.kernel.org/stable/c/271cab2ca00652bc9…
https://git.kernel.org/stable/c/57053b3bcf3403b80…
https://git.kernel.org/stable/c/8ca170c39eca7cad6…
https://git.kernel.org/stable/c/a90d4471146de2174…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2024…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 7648ea9896b31aff38830d81188f5b7a1773e4a8 , < cae9e59cc41683408b70b9ab569f8654866ba914 (git) Affected: 4ac54312f623c6d2ca30c36c1ef530c11f5aff64 , < 2199e157a465aaf98294d3932797ecd7fce942d5 (git) Affected: 099bf90d7fc4622da9fd4727f6d318a0f12d10be , < 6a43e3c210df6c5f00570f4be49a897677dbcb64 (git) Affected: 6ac8f2c8362afd2baa8e7b9c946597589e587d22 , < 271cab2ca00652bc984e269cf1208699a1e09cdd (git) Affected: 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d , < 57053b3bcf3403b80db6f65aba284d7dfe7326af (git) Affected: 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d , < 8ca170c39eca7cad6e0cfeb24e351d8f8eddcd65 (git) Affected: 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d , < a90d4471146de21745980cba51ce88e7926bcc4f (git) Affected: f862a9049c3f6e73a5504a1ac10ffd5bc253ab55 (git) Affected: 4622cc1b6d86013e01c56b60b092b5e4726c8e52 (git) Affected: 5.4.257 , < 5.4.282 (semver) Affected: 5.10.195 , < 5.10.224 (semver) Affected: 5.15.132 , < 5.15.165 (semver) Affected: 6.1.53 , < 6.1.103 (semver) Affected: 4.14.326 , < 4.15 (semver) Affected: 4.19.295 , < 4.20 (semver)
Linux	Linux	Affected: 6.3 Unaffected: 0 , < 6.3 (semver) Unaffected: 5.4.282 , ≤ 5.4.* (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.103 , ≤ 6.1.* (semver) Unaffected: 6.6.44 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42306",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:10:15.929324Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:27.843Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:14.937Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:56:52.686Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/balloc.c",
            "fs/udf/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cae9e59cc41683408b70b9ab569f8654866ba914",
              "status": "affected",
              "version": "7648ea9896b31aff38830d81188f5b7a1773e4a8",
              "versionType": "git"
            },
            {
              "lessThan": "2199e157a465aaf98294d3932797ecd7fce942d5",
              "status": "affected",
              "version": "4ac54312f623c6d2ca30c36c1ef530c11f5aff64",
              "versionType": "git"
            },
            {
              "lessThan": "6a43e3c210df6c5f00570f4be49a897677dbcb64",
              "status": "affected",
              "version": "099bf90d7fc4622da9fd4727f6d318a0f12d10be",
              "versionType": "git"
            },
            {
              "lessThan": "271cab2ca00652bc984e269cf1208699a1e09cdd",
              "status": "affected",
              "version": "6ac8f2c8362afd2baa8e7b9c946597589e587d22",
              "versionType": "git"
            },
            {
              "lessThan": "57053b3bcf3403b80db6f65aba284d7dfe7326af",
              "status": "affected",
              "version": "1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d",
              "versionType": "git"
            },
            {
              "lessThan": "8ca170c39eca7cad6e0cfeb24e351d8f8eddcd65",
              "status": "affected",
              "version": "1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d",
              "versionType": "git"
            },
            {
              "lessThan": "a90d4471146de21745980cba51ce88e7926bcc4f",
              "status": "affected",
              "version": "1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f862a9049c3f6e73a5504a1ac10ffd5bc253ab55",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4622cc1b6d86013e01c56b60b092b5e4726c8e52",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.282",
              "status": "affected",
              "version": "5.4.257",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.224",
              "status": "affected",
              "version": "5.10.195",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.165",
              "status": "affected",
              "version": "5.15.132",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.103",
              "status": "affected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.326",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.295",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/balloc.c",
            "fs/udf/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "5.4.257",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "5.10.195",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "5.15.132",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "6.1.53",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.326",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.295",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Avoid using corrupted block bitmap buffer\n\nWhen the filesystem block bitmap is corrupted, we detect the corruption\nwhile loading the bitmap and fail the allocation with error. However the\nnext allocation from the same bitmap will notice the bitmap buffer is\nalready loaded and tries to allocate from the bitmap with mixed results\n(depending on the exact nature of the bitmap corruption). Fix the\nproblem by using BH_verified bit to indicate whether the bitmap is valid\nor not."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through local filesystem operations (write/create/mkdir) on a mounted UDF volume, whose image is attacker-supplied via removable media or a loop device \u2014 no network path exists.\nAC:L - Triggering is fully deterministic and requires no race: the attacker crafts a UDF image with a bitmap whose own descriptor blocks are marked free, then performs two block allocations \u2014 the first fails with -EFSCORRUPTED, the second silently uses the cached corrupt bitmap.\nPR:L - UDF images from removable media are routinely auto-mounted by desktop/kiosk automounters (udisks2) without administrator action, after which any unprivileged local user with write access to the volume reaches udf_new_block() and triggers the corrupt-bitmap allocation path.\nUI:N - Once the malicious volume is present, no victim action is needed \u2014 the attacker performs the two allocations themselves via ordinary file creation or write syscalls; automount requires no interactive step.\nS:U - The corruption is confined to kernel memory and filesystem metadata within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Allocating the bitmap\u0027s own blocks makes one buffer_head serve as both the space bitmap and an allocation extent descriptor, so the extent parser reads attacker-influenced bitmap bytes as extent offsets and lengths, yielding out-of-bounds reads and disclosure of adjacent kernel buffer contents.\nI:H - The resulting type confusion lets bitmap bit-set/clear operations write into a live allocExtDesc (and vice versa), producing attacker-influenced metadata corruption and out-of-bounds writes usable for further heap corruption.\nA:H - The condition reproduces the syzbot-reported WARNING in __udf_add_aext() and leads to cascading metadata corruption and kernel oops, rendering the system unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:33.068Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cae9e59cc41683408b70b9ab569f8654866ba914"
        },
        {
          "url": "https://git.kernel.org/stable/c/2199e157a465aaf98294d3932797ecd7fce942d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a43e3c210df6c5f00570f4be49a897677dbcb64"
        },
        {
          "url": "https://git.kernel.org/stable/c/271cab2ca00652bc984e269cf1208699a1e09cdd"
        },
        {
          "url": "https://git.kernel.org/stable/c/57053b3bcf3403b80db6f65aba284d7dfe7326af"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ca170c39eca7cad6e0cfeb24e351d8f8eddcd65"
        },
        {
          "url": "https://git.kernel.org/stable/c/a90d4471146de21745980cba51ce88e7926bcc4f"
        }
      ],
      "title": "udf: Avoid using corrupted block bitmap buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42306",
    "datePublished": "2024-08-17T09:09:11.938Z",
    "dateReserved": "2024-07-30T07:40:12.273Z",
    "dateUpdated": "2026-08-05T11:36:33.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-42308 (GCVE-0-2024-42308)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2024-10-09 13:57

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2024-10-09T13:57:37.908Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42308",
    "datePublished": "2024-08-17T09:09:13.467Z",
    "dateRejected": "2024-10-09T13:57:37.908Z",
    "dateReserved": "2024-07-30T07:40:12.275Z",
    "dateUpdated": "2024-10-09T13:57:37.908Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-42309 (GCVE-0-2024-42309)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-05-11 20:29

Title

drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes In psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:10 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/13b5f3ee94bdbdc4b…
https://git.kernel.org/stable/c/d6ad202f73f8edba0…
https://git.kernel.org/stable/c/6735d02ead7dd3adf…
https://git.kernel.org/stable/c/7e52c62ff029f9500…
https://git.kernel.org/stable/c/f70ffeca546452d1a…
https://git.kernel.org/stable/c/46d2ef272957879cb…
https://git.kernel.org/stable/c/475a5b3b7c8edf6e5…
https://git.kernel.org/stable/c/2df7aac81070987b0…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 89c78134cc54dff016c83367912eb055637fa50c , < 13b5f3ee94bdbdc4b5f40582aab62977905aedee (git) Affected: 89c78134cc54dff016c83367912eb055637fa50c , < d6ad202f73f8edba0cbc0065aa57a79ffe8fdcdc (git) Affected: 89c78134cc54dff016c83367912eb055637fa50c , < 6735d02ead7dd3adf74eb8b70aebd09e0ce78ec9 (git) Affected: 89c78134cc54dff016c83367912eb055637fa50c , < 7e52c62ff029f95005915c0a11863b5fb5185c8c (git) Affected: 89c78134cc54dff016c83367912eb055637fa50c , < f70ffeca546452d1acd3a70ada56ecb2f3e7f811 (git) Affected: 89c78134cc54dff016c83367912eb055637fa50c , < 46d2ef272957879cbe30a884574320e7f7d78692 (git) Affected: 89c78134cc54dff016c83367912eb055637fa50c , < 475a5b3b7c8edf6e583a9eb59cf28ea770602e14 (git) Affected: 89c78134cc54dff016c83367912eb055637fa50c , < 2df7aac81070987b0f052985856aa325a38debf6 (git)
Linux	Linux	Affected: 3.3 Unaffected: 0 , < 3.3 (semver) Unaffected: 4.19.320 , ≤ 4.19.* (semver) Unaffected: 5.4.282 , ≤ 5.4.* (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.103 , ≤ 6.1.* (semver) Unaffected: 6.6.44 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42309",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:10:05.824030Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:27.439Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:21.161Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/gma500/psb_intel_lvds.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13b5f3ee94bdbdc4b5f40582aab62977905aedee",
              "status": "affected",
              "version": "89c78134cc54dff016c83367912eb055637fa50c",
              "versionType": "git"
            },
            {
              "lessThan": "d6ad202f73f8edba0cbc0065aa57a79ffe8fdcdc",
              "status": "affected",
              "version": "89c78134cc54dff016c83367912eb055637fa50c",
              "versionType": "git"
            },
            {
              "lessThan": "6735d02ead7dd3adf74eb8b70aebd09e0ce78ec9",
              "status": "affected",
              "version": "89c78134cc54dff016c83367912eb055637fa50c",
              "versionType": "git"
            },
            {
              "lessThan": "7e52c62ff029f95005915c0a11863b5fb5185c8c",
              "status": "affected",
              "version": "89c78134cc54dff016c83367912eb055637fa50c",
              "versionType": "git"
            },
            {
              "lessThan": "f70ffeca546452d1acd3a70ada56ecb2f3e7f811",
              "status": "affected",
              "version": "89c78134cc54dff016c83367912eb055637fa50c",
              "versionType": "git"
            },
            {
              "lessThan": "46d2ef272957879cbe30a884574320e7f7d78692",
              "status": "affected",
              "version": "89c78134cc54dff016c83367912eb055637fa50c",
              "versionType": "git"
            },
            {
              "lessThan": "475a5b3b7c8edf6e583a9eb59cf28ea770602e14",
              "status": "affected",
              "version": "89c78134cc54dff016c83367912eb055637fa50c",
              "versionType": "git"
            },
            {
              "lessThan": "2df7aac81070987b0f052985856aa325a38debf6",
              "status": "affected",
              "version": "89c78134cc54dff016c83367912eb055637fa50c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/gma500/psb_intel_lvds.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes\n\nIn psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:29:54.720Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13b5f3ee94bdbdc4b5f40582aab62977905aedee"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6ad202f73f8edba0cbc0065aa57a79ffe8fdcdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6735d02ead7dd3adf74eb8b70aebd09e0ce78ec9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e52c62ff029f95005915c0a11863b5fb5185c8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f70ffeca546452d1acd3a70ada56ecb2f3e7f811"
        },
        {
          "url": "https://git.kernel.org/stable/c/46d2ef272957879cbe30a884574320e7f7d78692"
        },
        {
          "url": "https://git.kernel.org/stable/c/475a5b3b7c8edf6e583a9eb59cf28ea770602e14"
        },
        {
          "url": "https://git.kernel.org/stable/c/2df7aac81070987b0f052985856aa325a38debf6"
        }
      ],
      "title": "drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42309",
    "datePublished": "2024-08-17T09:09:14.164Z",
    "dateReserved": "2024-07-30T07:40:12.276Z",
    "dateUpdated": "2026-05-11T20:29:54.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-42310 (GCVE-0-2024-42310)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-05-11 20:29

Title

drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:10 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/f392c36cebf4c1d69…
https://git.kernel.org/stable/c/a658ae2173ab74667…
https://git.kernel.org/stable/c/b6ac46a00188cde50…
https://git.kernel.org/stable/c/08f45102c81ad8bc9…
https://git.kernel.org/stable/c/e74eb5e8089427c8c…
https://git.kernel.org/stable/c/2d209b2f862f6b8bf…
https://git.kernel.org/stable/c/977ee4fe895e1729c…
https://git.kernel.org/stable/c/cb520c3f366c77e8d…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe , < f392c36cebf4c1d6997a4cc2c0f205254acef42a (git) Affected: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe , < a658ae2173ab74667c009e2550455e6de5b33ddc (git) Affected: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe , < b6ac46a00188cde50ffba233e6efb366354a1de5 (git) Affected: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe , < 08f45102c81ad8bc9f85f7a25e9f64e128edb87d (git) Affected: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe , < e74eb5e8089427c8c49e0dd5067e5f39ce3a4d56 (git) Affected: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe , < 2d209b2f862f6b8bff549ede541590a8d119da23 (git) Affected: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe , < 977ee4fe895e1729cd36cc26916bbb10084713d6 (git) Affected: 6a227d5fd6c4abe6a9226a40f6981825e9da5fbe , < cb520c3f366c77e8d69e4e2e2781a8ce48d98e79 (git)
Linux	Linux	Affected: 3.3 Unaffected: 0 , < 3.3 (semver) Unaffected: 4.19.320 , ≤ 4.19.* (semver) Unaffected: 5.4.282 , ≤ 5.4.* (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.103 , ≤ 6.1.* (semver) Unaffected: 6.6.44 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42310",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:10:02.672405Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:27.324Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:24.097Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/gma500/cdv_intel_lvds.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f392c36cebf4c1d6997a4cc2c0f205254acef42a",
              "status": "affected",
              "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe",
              "versionType": "git"
            },
            {
              "lessThan": "a658ae2173ab74667c009e2550455e6de5b33ddc",
              "status": "affected",
              "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe",
              "versionType": "git"
            },
            {
              "lessThan": "b6ac46a00188cde50ffba233e6efb366354a1de5",
              "status": "affected",
              "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe",
              "versionType": "git"
            },
            {
              "lessThan": "08f45102c81ad8bc9f85f7a25e9f64e128edb87d",
              "status": "affected",
              "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe",
              "versionType": "git"
            },
            {
              "lessThan": "e74eb5e8089427c8c49e0dd5067e5f39ce3a4d56",
              "status": "affected",
              "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe",
              "versionType": "git"
            },
            {
              "lessThan": "2d209b2f862f6b8bff549ede541590a8d119da23",
              "status": "affected",
              "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe",
              "versionType": "git"
            },
            {
              "lessThan": "977ee4fe895e1729cd36cc26916bbb10084713d6",
              "status": "affected",
              "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe",
              "versionType": "git"
            },
            {
              "lessThan": "cb520c3f366c77e8d69e4e2e2781a8ce48d98e79",
              "status": "affected",
              "version": "6a227d5fd6c4abe6a9226a40f6981825e9da5fbe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/gma500/cdv_intel_lvds.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes\n\nIn cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate()\nis assigned to mode, which will lead to a NULL pointer dereference on\nfailure of drm_mode_duplicate(). Add a check to avoid npd."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:29:55.880Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f392c36cebf4c1d6997a4cc2c0f205254acef42a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a658ae2173ab74667c009e2550455e6de5b33ddc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6ac46a00188cde50ffba233e6efb366354a1de5"
        },
        {
          "url": "https://git.kernel.org/stable/c/08f45102c81ad8bc9f85f7a25e9f64e128edb87d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e74eb5e8089427c8c49e0dd5067e5f39ce3a4d56"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d209b2f862f6b8bff549ede541590a8d119da23"
        },
        {
          "url": "https://git.kernel.org/stable/c/977ee4fe895e1729cd36cc26916bbb10084713d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb520c3f366c77e8d69e4e2e2781a8ce48d98e79"
        }
      ],
      "title": "drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42310",
    "datePublished": "2024-08-17T09:09:14.820Z",
    "dateReserved": "2024-07-30T07:40:12.276Z",
    "dateUpdated": "2026-05-11T20:29:55.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-42311 (GCVE-0-2024-42311)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-08-05 11:36

Title

hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()

Summary

In the Linux kernel, the following vulnerability has been resolved: hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0 to 64 ===================================================== BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [inline] link_path_walk+0x817/0x1480 fs/namei.c:2332 path_lookupat+0xd9/0x6f0 fs/namei.c:2485 filename_lookup+0x22e/0x740 fs/namei.c:2515 user_path_at_empty+0x8b/0x390 fs/namei.c:2924 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3689 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x66b/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline] BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 hfs_ext_read_extent fs/hfs/extent.c:196 [inline] hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271 hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39 filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426 do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553 do_read_cache_page mm/filemap.c:3595 [inline] read_cache_page+0xfb/0x2f0 mm/filemap.c:3604 read_mapping_page include/linux/pagemap.h:755 [inline] hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78 hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204 hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406 mount_bdev+0x628/0x920 fs/super.c:1359 hfs_mount+0xcd/0xe0 fs/hfs/super.c:456 legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610 vfs_get_tree+0xdc/0x5d0 fs/super.c:1489 do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145 path_mount+0xf98/0x26a0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674 __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3018 [inline] hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165 alloc_inode+0x83/0x440 fs/inode.c:260 new_inode_pseudo fs/inode.c:1005 [inline] new_inode+0x38/0x4f0 fs/inode.c:1031 hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186 hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228 vfs_mkdir+0x49a/0x700 fs/namei.c:4126 do_mkdirat+0x529/0x810 fs/namei.c:4149 __do_sys_mkdirat fs/namei.c:4164 [inline] __se_sys_mkdirat fs/namei.c:4162 [inline] __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b It missed to initialize .tz_secondswest, .cached_start and .cached_blocks fields in struct hfs_inode_info after hfs_alloc_inode(), fix it.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:09 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/f7316b2b2f11cf0c6…
https://git.kernel.org/stable/c/4a52861cd76e79f1a…
https://git.kernel.org/stable/c/10f7163bfb5f8b4e0…
https://git.kernel.org/stable/c/d55aae5c1730d6b70…
https://git.kernel.org/stable/c/58d83fc160505a700…
https://git.kernel.org/stable/c/9c4e40b9b731220f9…
https://git.kernel.org/stable/c/d3493d6f0dfb1ab52…
https://git.kernel.org/stable/c/26a2ed107929a8551…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f7316b2b2f11cf0c6de917beee8d3de728be24db (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4a52861cd76e79f1a593beb23d096523eb9732c2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 10f7163bfb5f8b4e0c9c05a939f20b8540e33c65 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d55aae5c1730d6b70d5d8eaff00113cd34772ea3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 58d83fc160505a7009c39dec64effaac5129b971 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9c4e40b9b731220f9464975e49da75496e3865c4 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d3493d6f0dfb1ab5225b62faa77732983f2187a1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 26a2ed107929a855155429b11e1293b83e6b2a8b (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 4.19.320 , ≤ 4.19.* (semver) Unaffected: 5.4.282 , ≤ 5.4.* (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.103 , ≤ 6.1.* (semver) Unaffected: 6.6.44 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42311",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:09:58.669472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:27.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:27.025Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7316b2b2f11cf0c6de917beee8d3de728be24db",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4a52861cd76e79f1a593beb23d096523eb9732c2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "10f7163bfb5f8b4e0c9c05a939f20b8540e33c65",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d55aae5c1730d6b70d5d8eaff00113cd34772ea3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "58d83fc160505a7009c39dec64effaac5129b971",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9c4e40b9b731220f9464975e49da75496e3865c4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d3493d6f0dfb1ab5225b62faa77732983f2187a1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "26a2ed107929a855155429b11e1293b83e6b2a8b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()\n\nSyzbot reports uninitialized value access issue as below:\n\nloop0: detected capacity change from 0 to 64\n=====================================================\nBUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30\n hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30\n d_revalidate fs/namei.c:862 [inline]\n lookup_fast+0x89e/0x8e0 fs/namei.c:1649\n walk_component fs/namei.c:2001 [inline]\n link_path_walk+0x817/0x1480 fs/namei.c:2332\n path_lookupat+0xd9/0x6f0 fs/namei.c:2485\n filename_lookup+0x22e/0x740 fs/namei.c:2515\n user_path_at_empty+0x8b/0x390 fs/namei.c:2924\n user_path_at include/linux/namei.h:57 [inline]\n do_mount fs/namespace.c:3689 [inline]\n __do_sys_mount fs/namespace.c:3898 [inline]\n __se_sys_mount+0x66b/0x810 fs/namespace.c:3875\n __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nBUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline]\nBUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366\n hfs_ext_read_extent fs/hfs/extent.c:196 [inline]\n hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366\n block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271\n hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39\n filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426\n do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553\n do_read_cache_page mm/filemap.c:3595 [inline]\n read_cache_page+0xfb/0x2f0 mm/filemap.c:3604\n read_mapping_page include/linux/pagemap.h:755 [inline]\n hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78\n hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204\n hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406\n mount_bdev+0x628/0x920 fs/super.c:1359\n hfs_mount+0xcd/0xe0 fs/hfs/super.c:456\n legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610\n vfs_get_tree+0xdc/0x5d0 fs/super.c:1489\n do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145\n path_mount+0xf98/0x26a0 fs/namespace.c:3475\n do_mount fs/namespace.c:3488 [inline]\n __do_sys_mount fs/namespace.c:3697 [inline]\n __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674\n __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674\n do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178\n do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246\n entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\nUninit was created at:\n __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590\n __alloc_pages_node include/linux/gfp.h:238 [inline]\n alloc_pages_node include/linux/gfp.h:261 [inline]\n alloc_slab_page mm/slub.c:2190 [inline]\n allocate_slab mm/slub.c:2354 [inline]\n new_slab+0x2d7/0x1400 mm/slub.c:2407\n ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540\n __slab_alloc mm/slub.c:3625 [inline]\n __slab_alloc_node mm/slub.c:3678 [inline]\n slab_alloc_node mm/slub.c:3850 [inline]\n kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879\n alloc_inode_sb include/linux/fs.h:3018 [inline]\n hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165\n alloc_inode+0x83/0x440 fs/inode.c:260\n new_inode_pseudo fs/inode.c:1005 [inline]\n new_inode+0x38/0x4f0 fs/inode.c:1031\n hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186\n hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228\n vfs_mkdir+0x49a/0x700 fs/namei.c:4126\n do_mkdirat+0x529/0x810 fs/namei.c:4149\n __do_sys_mkdirat fs/namei.c:4164 [inline]\n __se_sys_mkdirat fs/namei.c:4162 [inline]\n __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nIt missed to initialize .tz_secondswest, .cached_start and .cached_blocks\nfields in struct hfs_inode_info after hfs_alloc_inode(), fix it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both triggers require local syscalls (mkdir/create, or path lookup and file read) against a mounted HFS volume; there is no remote or network-facing path into fs/hfs.\nAC:L - No race and no unusual precondition \u2014 the uninitialized fields are read deterministically on the very first lookup or extent access after inode allocation, and the attacker can groom the inode slab to control the stale contents.\nPR:L - An unprivileged local user with ordinary access to an already-mounted HFS filesystem (auto-mounted removable media, or an admin-mounted Mac disk) reaches hfs_new_inode() via mkdir/create and hfs_inode_read_fork() via any inode read; no capability is needed for the trigger itself.\nUI:N - Once the HFS volume is mounted, the attacker triggers the uninitialized reads entirely through their own syscalls with no action from any other user.\nS:U - The uninitialized reads and their consequences stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Stale kernel-heap bytes leak to userspace through the tz_secondswest-derived timestamp delta exposed by stat(), and stale cached_extents used as disk block numbers cause hfs_get_block() to map and return arbitrary out-of-file sectors of the block device to the reader.\nI:H - With create=1 the bogus dblock from uninit cached_extents makes writes land on arbitrary device sectors, and __hfs_ext_write_extent() keys B-tree records off the stale cached_start, corrupting the on-disk extents B-tree and adjacent filesystem data.\nA:H - Garbage block mappings and a corrupted extents B-tree drive hfs\u0027s unhardened bnode code into out-of-bounds accesses and I/O failures, causing oopses and rendering the mounted filesystem unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:34.141Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7316b2b2f11cf0c6de917beee8d3de728be24db"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a52861cd76e79f1a593beb23d096523eb9732c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/10f7163bfb5f8b4e0c9c05a939f20b8540e33c65"
        },
        {
          "url": "https://git.kernel.org/stable/c/d55aae5c1730d6b70d5d8eaff00113cd34772ea3"
        },
        {
          "url": "https://git.kernel.org/stable/c/58d83fc160505a7009c39dec64effaac5129b971"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c4e40b9b731220f9464975e49da75496e3865c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3493d6f0dfb1ab5225b62faa77732983f2187a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/26a2ed107929a855155429b11e1293b83e6b2a8b"
        }
      ],
      "title": "hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42311",
    "datePublished": "2024-08-17T09:09:15.793Z",
    "dateReserved": "2024-07-30T07:40:12.277Z",
    "dateUpdated": "2026-08-05T11:36:34.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-42312 (GCVE-0-2024-42312)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-05-23 15:52

Title

sysctl: always initialize i_uid/i_gid

Summary

In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them. Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when set_ownership() was not implemented. It also missed adjusting net_ctl_set_ownership() to use the same default values in case the computation of a better value failed.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:09 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/b2591c89a6e285879…
https://git.kernel.org/stable/c/34a86adea1f2b3c3f…
https://git.kernel.org/stable/c/1deae34db9f4f8e0e…
https://git.kernel.org/stable/c/ffde3af4b29bf97d6…
https://git.kernel.org/stable/c/c7e2f43d182f5dde4…
https://git.kernel.org/stable/c/98ca62ba9e2be5863…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2024…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf , < b2591c89a6e2858796111138c38fcb6851aa1955 (git) Affected: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf , < 34a86adea1f2b3c3f9d864c8cce09dca644601ab (git) Affected: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf , < 1deae34db9f4f8e0e03f891be2e2e15c15c8ac05 (git) Affected: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf , < ffde3af4b29bf97d62d82e1d45275587e10a991a (git) Affected: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf , < c7e2f43d182f5dde473389dbb39f16c9f0d64536 (git) Affected: 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf , < 98ca62ba9e2be5863c7d069f84f7166b45a5b2f4 (git) Affected: e83234d7ef237931148b4b17834dadf57eb46c12 (git) Affected: 2cbf2af144f0cd08a3361c6299b2e6086b7d21d9 (git) Affected: 2c7b50c7b1d036f71acd9a917a8cb0f9b6e43dab (git) Affected: 7eb45a94c279dd5af4cafaa738ae93737517eef4 (git) Affected: 14cc90952cef94bfa89a6b4a2f55fd9a70f50a16 (git) Affected: 4.9.187 , < 4.10 (semver) Affected: 4.14.135 , < 4.15 (semver) Affected: 4.19.61 , < 4.20 (semver) Affected: 5.1.20 , < 5.2 (semver) Affected: 5.2.3 , < 5.3 (semver)
Linux	Linux	Affected: 5.3 Unaffected: 0 , < 5.3 (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.104 , ≤ 6.1.* (semver) Unaffected: 6.6.45 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42312",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:09:55.484877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:26.909Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:29.959Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:56:53.841Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/proc_sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b2591c89a6e2858796111138c38fcb6851aa1955",
              "status": "affected",
              "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf",
              "versionType": "git"
            },
            {
              "lessThan": "34a86adea1f2b3c3f9d864c8cce09dca644601ab",
              "status": "affected",
              "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf",
              "versionType": "git"
            },
            {
              "lessThan": "1deae34db9f4f8e0e03f891be2e2e15c15c8ac05",
              "status": "affected",
              "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf",
              "versionType": "git"
            },
            {
              "lessThan": "ffde3af4b29bf97d62d82e1d45275587e10a991a",
              "status": "affected",
              "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf",
              "versionType": "git"
            },
            {
              "lessThan": "c7e2f43d182f5dde473389dbb39f16c9f0d64536",
              "status": "affected",
              "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf",
              "versionType": "git"
            },
            {
              "lessThan": "98ca62ba9e2be5863c7d069f84f7166b45a5b2f4",
              "status": "affected",
              "version": "5ec27ec735ba0477d48c80561cc5e856f0c5dfaf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e83234d7ef237931148b4b17834dadf57eb46c12",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2cbf2af144f0cd08a3361c6299b2e6086b7d21d9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c7b50c7b1d036f71acd9a917a8cb0f9b6e43dab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7eb45a94c279dd5af4cafaa738ae93737517eef4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "14cc90952cef94bfa89a6b4a2f55fd9a70f50a16",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.187",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.135",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.61",
              "versionType": "semver"
            },
            {
              "lessThan": "5.2",
              "status": "affected",
              "version": "5.1.20",
              "versionType": "semver"
            },
            {
              "lessThan": "5.3",
              "status": "affected",
              "version": "5.2.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/proc_sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.104",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.45",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.135",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.1.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.2.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: always initialize i_uid/i_gid\n\nAlways initialize i_uid/i_gid inside the sysfs core so set_ownership()\ncan safely skip setting them.\n\nCommit 5ec27ec735ba (\"fs/proc/proc_sysctl.c: fix the default values of\ni_uid/i_gid on /proc/sys inodes.\") added defaults for i_uid/i_gid when\nset_ownership() was not implemented. It also missed adjusting\nnet_ctl_set_ownership() to use the same default values in case the\ncomputation of a better value failed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:52:52.627Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b2591c89a6e2858796111138c38fcb6851aa1955"
        },
        {
          "url": "https://git.kernel.org/stable/c/34a86adea1f2b3c3f9d864c8cce09dca644601ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/1deae34db9f4f8e0e03f891be2e2e15c15c8ac05"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffde3af4b29bf97d62d82e1d45275587e10a991a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7e2f43d182f5dde473389dbb39f16c9f0d64536"
        },
        {
          "url": "https://git.kernel.org/stable/c/98ca62ba9e2be5863c7d069f84f7166b45a5b2f4"
        }
      ],
      "title": "sysctl: always initialize i_uid/i_gid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42312",
    "datePublished": "2024-08-17T09:09:16.646Z",
    "dateReserved": "2024-07-30T07:40:12.277Z",
    "dateUpdated": "2026-05-23T15:52:52.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-42313 (GCVE-0-2024-42313)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-08-05 11:36

Title

media: venus: fix use after free in vdec_close

Summary

In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free in vdec_close There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst. Fix it by cancelling the work in vdec_close.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:09 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/ad8cf035baf294671…
https://git.kernel.org/stable/c/72aff311194c8ceda…
https://git.kernel.org/stable/c/4c9d235630d35db76…
https://git.kernel.org/stable/c/f8e9a63b982a83454…
https://git.kernel.org/stable/c/da55685247f409bf7…
https://git.kernel.org/stable/c/66fa52edd32cdbb67…
https://git.kernel.org/stable/c/6a96041659e834dc0…
https://git.kernel.org/stable/c/a0157b5aa34eb43ec…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < ad8cf035baf29467158e0550c7a42b7bb43d1db6 (git) Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < 72aff311194c8ceda934f24fd6f250b8827d7567 (git) Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < 4c9d235630d35db762b85a4149bbb0be9d504c36 (git) Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < f8e9a63b982a8345470c225679af4ba86e4a7282 (git) Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < da55685247f409bf7f976cc66ba2104df75d8dad (git) Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < 66fa52edd32cdbb675f0803b3c4da10ea19b6635 (git) Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < 6a96041659e834dc0b172dda4b2df512d63920c2 (git) Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < a0157b5aa34eb43ec4c5510f9c260bbb03be937e (git)
Linux	Linux	Affected: 4.13 Unaffected: 0 , < 4.13 (semver) Unaffected: 4.19.320 , ≤ 4.19.* (semver) Unaffected: 5.4.282 , ≤ 5.4.* (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.103 , ≤ 6.1.* (semver) Unaffected: 6.6.44 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42313",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:09:52.303644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:26.779Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:32.858Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/venus/vdec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad8cf035baf29467158e0550c7a42b7bb43d1db6",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "72aff311194c8ceda934f24fd6f250b8827d7567",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "4c9d235630d35db762b85a4149bbb0be9d504c36",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "f8e9a63b982a8345470c225679af4ba86e4a7282",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "da55685247f409bf7f976cc66ba2104df75d8dad",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "66fa52edd32cdbb675f0803b3c4da10ea19b6635",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "6a96041659e834dc0b172dda4b2df512d63920c2",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "a0157b5aa34eb43ec4c5510f9c260bbb03be937e",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/venus/vdec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: fix use after free in vdec_close\n\nThere appears to be a possible use after free with vdec_close().\nThe firmware will add buffer release work to the work queue through\nHFI callbacks as a normal part of decoding. Randomly closing the\ndecoder device from userspace during normal decoding can incur\na read after free for inst.\n\nFix it by cancelling the work in vdec_close."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the local V4L2 device node /dev/videoN via open/ioctl/close on the Qualcomm venus decoder; there is no remote or network-facing path to this code.\nAC:L - The attacker drives both sides of the race \u2014 they queue the decode buffers that cause the worker to be scheduled and they choose when to close the fd \u2014 and can retry in a tight open/decode/close loop while spraying the freed venus_inst slab.\nPR:L - No capability check exists on vdec_open/vdec_close or any ioctl on the path; only access to the video device node is needed, which unprivileged users have on Android (mediacodec), embedded, and desktop systems via the video group/logind ACLs.\nUI:N - The attacker performs the entire sequence \u2014 opening the decoder, streaming buffers, and closing the fd \u2014 with no action required from any other user.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The worker reads inst-\u003elock, inst-\u003edelayed_process, inst-\u003esession and inst-\u003ecore from freed memory, so a reclaimed and attacker-controlled slab object yields kernel memory disclosure primitives.\nI:H - mutex_lock() and list_del_init() write into the freed venus_inst, and session_process_buf() dereferences attacker-reclaimable pointers, giving a heap-spray-based write and control-flow hijack primitive.\nA:H - Operating on a kfree\u0027d instance with an already mutex_destroy\u0027d lock reliably produces list corruption, lock BUGs, and kernel panics, taking the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:35.213Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad8cf035baf29467158e0550c7a42b7bb43d1db6"
        },
        {
          "url": "https://git.kernel.org/stable/c/72aff311194c8ceda934f24fd6f250b8827d7567"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c9d235630d35db762b85a4149bbb0be9d504c36"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8e9a63b982a8345470c225679af4ba86e4a7282"
        },
        {
          "url": "https://git.kernel.org/stable/c/da55685247f409bf7f976cc66ba2104df75d8dad"
        },
        {
          "url": "https://git.kernel.org/stable/c/66fa52edd32cdbb675f0803b3c4da10ea19b6635"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a96041659e834dc0b172dda4b2df512d63920c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0157b5aa34eb43ec4c5510f9c260bbb03be937e"
        }
      ],
      "title": "media: venus: fix use after free in vdec_close",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42313",
    "datePublished": "2024-08-17T09:09:17.334Z",
    "dateReserved": "2024-07-30T07:40:12.277Z",
    "dateUpdated": "2026-08-05T11:36:35.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CERTFR-2024-AVI-0872

Solutions

CVE-2024-42302 (GCVE-0-2024-42302)

CVE-2024-42304 (GCVE-0-2024-42304)

CVE-2024-42305 (GCVE-0-2024-42305)

CVE-2024-42306 (GCVE-0-2024-42306)

CVE-2024-42308 (GCVE-0-2024-42308)

CVE-2024-42309 (GCVE-0-2024-42309)

CVE-2024-42310 (GCVE-0-2024-42310)

CVE-2024-42311 (GCVE-0-2024-42311)

CVE-2024-42312 (GCVE-0-2024-42312)

CVE-2024-42313 (GCVE-0-2024-42313)

Tags

Sightings

Nomenclature