CVE-2024-50226 (GCVE-0-2024-50226)

Vulnerability from cvelistv5 – Published: 2024-11-09 10:14 – Updated: 2026-05-11 20:47
VLAI
Title
cxl/port: Fix use-after-free, permit out-of-order decoder shutdown
Summary
In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown In support of investigating an initialization failure report [1], cxl_test was updated to register mock memory-devices after the mock root-port/bus device had been registered. That led to cxl_test crashing with a use-after-free bug with the following signature: cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1 cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1 cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0 1) cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 for mem4:decoder14.0 @ 1 [..] cxld_unregister: cxl decoder14.0: cxl_region_decode_reset: cxl_region region3: mock_decoder_reset: cxl_port port3: decoder3.0 reset 2) mock_decoder_reset: cxl_port port3: decoder3.0: out of order reset, expected decoder3.1 cxl_endpoint_decoder_release: cxl decoder14.0: [..] cxld_unregister: cxl decoder7.0: 3) cxl_region_decode_reset: cxl_region region3: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI [..] RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core] [..] Call Trace: <TASK> cxl_region_decode_reset+0x69/0x190 [cxl_core] cxl_region_detach+0xe8/0x210 [cxl_core] cxl_decoder_kill_region+0x27/0x40 [cxl_core] cxld_unregister+0x5d/0x60 [cxl_core] At 1) a region has been established with 2 endpoint decoders (7.0 and 14.0). Those endpoints share a common switch-decoder in the topology (3.0). At teardown, 2), decoder14.0 is the first to be removed and hits the "out of order reset case" in the switch decoder. The effect though is that region3 cleanup is aborted leaving it in-tact and referencing decoder14.0. At 3) the second attempt to teardown region3 trips over the stale decoder14.0 object which has long since been deleted. The fix here is to recognize that the CXL specification places no mandate on in-order shutdown of switch-decoders, the driver enforces in-order allocation, and hardware enforces in-order commit. So, rather than fail and leave objects dangling, always remove them. In support of making cxl_region_decode_reset() always succeed, cxl_region_invalidate_memregion() failures are turned into warnings. Crashing the kernel is ok there since system integrity is at risk if caches cannot be managed around physical address mutation events like CXL region destruction. A new device_for_each_child_reverse_from() is added to cleanup port->commit_end after all dependent decoders have been disabled. In other words if decoders are allocated 0->1->2 and disabled 1->2->0 then port->commit_end only decrements from 2 after 2 has been disabled, and it decrements all the way to zero since 1 was disabled previously.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 176baefb2eb5d7a3ddebe3ff803db1fce44574b5 , < 8e1b52c15c81106456437f8e49575040e489e355 (git)
Affected: 176baefb2eb5d7a3ddebe3ff803db1fce44574b5 , < 78c8454fdce0eeee962be004eb6d99860c80dad1 (git)
Affected: 176baefb2eb5d7a3ddebe3ff803db1fce44574b5 , < 101c268bd2f37e965a5468353e62d154db38838e (git)
Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.6.60 , ≤ 6.6.* (semver)
Unaffected: 6.11.7 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T14:28:17.687131Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T14:58:32.714Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/core.c",
            "drivers/cxl/core/hdm.c",
            "drivers/cxl/core/region.c",
            "drivers/cxl/cxl.h",
            "include/linux/device.h",
            "tools/testing/cxl/test/cxl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8e1b52c15c81106456437f8e49575040e489e355",
              "status": "affected",
              "version": "176baefb2eb5d7a3ddebe3ff803db1fce44574b5",
              "versionType": "git"
            },
            {
              "lessThan": "78c8454fdce0eeee962be004eb6d99860c80dad1",
              "status": "affected",
              "version": "176baefb2eb5d7a3ddebe3ff803db1fce44574b5",
              "versionType": "git"
            },
            {
              "lessThan": "101c268bd2f37e965a5468353e62d154db38838e",
              "status": "affected",
              "version": "176baefb2eb5d7a3ddebe3ff803db1fce44574b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/core.c",
            "drivers/cxl/core/hdm.c",
            "drivers/cxl/core/region.c",
            "drivers/cxl/cxl.h",
            "include/linux/device.h",
            "tools/testing/cxl/test/cxl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.60",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.7",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Fix use-after-free, permit out-of-order decoder shutdown\n\nIn support of investigating an initialization failure report [1],\ncxl_test was updated to register mock memory-devices after the mock\nroot-port/bus device had been registered. That led to cxl_test crashing\nwith a use-after-free bug with the following signature:\n\n    cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1\n    cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1\n    cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0\n1)  cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 for mem4:decoder14.0 @ 1\n    [..]\n    cxld_unregister: cxl decoder14.0:\n    cxl_region_decode_reset: cxl_region region3:\n    mock_decoder_reset: cxl_port port3: decoder3.0 reset\n2)  mock_decoder_reset: cxl_port port3: decoder3.0: out of order reset, expected decoder3.1\n    cxl_endpoint_decoder_release: cxl decoder14.0:\n    [..]\n    cxld_unregister: cxl decoder7.0:\n3)  cxl_region_decode_reset: cxl_region region3:\n    Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI\n    [..]\n    RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core]\n    [..]\n    Call Trace:\n     \u003cTASK\u003e\n     cxl_region_decode_reset+0x69/0x190 [cxl_core]\n     cxl_region_detach+0xe8/0x210 [cxl_core]\n     cxl_decoder_kill_region+0x27/0x40 [cxl_core]\n     cxld_unregister+0x5d/0x60 [cxl_core]\n\nAt 1) a region has been established with 2 endpoint decoders (7.0 and\n14.0). Those endpoints share a common switch-decoder in the topology\n(3.0). At teardown, 2), decoder14.0 is the first to be removed and hits\nthe \"out of order reset case\" in the switch decoder. The effect though\nis that region3 cleanup is aborted leaving it in-tact and\nreferencing decoder14.0. At 3) the second attempt to teardown region3\ntrips over the stale decoder14.0 object which has long since been\ndeleted.\n\nThe fix here is to recognize that the CXL specification places no\nmandate on in-order shutdown of switch-decoders, the driver enforces\nin-order allocation, and hardware enforces in-order commit. So, rather\nthan fail and leave objects dangling, always remove them.\n\nIn support of making cxl_region_decode_reset() always succeed,\ncxl_region_invalidate_memregion() failures are turned into warnings.\nCrashing the kernel is ok there since system integrity is at risk if\ncaches cannot be managed around physical address mutation events like\nCXL region destruction.\n\nA new device_for_each_child_reverse_from() is added to cleanup\nport-\u003ecommit_end after all dependent decoders have been disabled. In\nother words if decoders are allocated 0-\u003e1-\u003e2 and disabled 1-\u003e2-\u003e0 then\nport-\u003ecommit_end only decrements from 2 after 2 has been disabled, and\nit decrements all the way to zero since 1 was disabled previously."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:47:50.585Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8e1b52c15c81106456437f8e49575040e489e355"
        },
        {
          "url": "https://git.kernel.org/stable/c/78c8454fdce0eeee962be004eb6d99860c80dad1"
        },
        {
          "url": "https://git.kernel.org/stable/c/101c268bd2f37e965a5468353e62d154db38838e"
        }
      ],
      "title": "cxl/port: Fix use-after-free, permit out-of-order decoder shutdown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50226",
    "datePublished": "2024-11-09T10:14:37.003Z",
    "dateReserved": "2024-10-21T19:36:19.973Z",
    "dateUpdated": "2026-05-11T20:47:50.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50226",
      "date": "2026-06-08",
      "epss": "0.00017",
      "percentile": "0.0419"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.0\", \"versionEndExcluding\": \"6.6.60\", \"matchCriteriaId\": \"CF072D0B-0626-4356-9FC8-867518FD4C56\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.7\", \"matchCriteriaId\": \"E96F53A4-5E87-4A70-BD9A-BC327828D57F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F717D8-3014-4F84-8086-0124B2111379\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/port: Fix use-after-free, permit out-of-order decoder shutdown\\n\\nIn support of investigating an initialization failure report [1],\\ncxl_test was updated to register mock memory-devices after the mock\\nroot-port/bus device had been registered. That led to cxl_test crashing\\nwith a use-after-free bug with the following signature:\\n\\n    cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1\\n    cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1\\n    cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0\\n1)  cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 for mem4:decoder14.0 @ 1\\n    [..]\\n    cxld_unregister: cxl decoder14.0:\\n    cxl_region_decode_reset: cxl_region region3:\\n    mock_decoder_reset: cxl_port port3: decoder3.0 reset\\n2)  mock_decoder_reset: cxl_port port3: decoder3.0: out of order reset, expected decoder3.1\\n    cxl_endpoint_decoder_release: cxl decoder14.0:\\n    [..]\\n    cxld_unregister: cxl decoder7.0:\\n3)  cxl_region_decode_reset: cxl_region region3:\\n    Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI\\n    [..]\\n    RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core]\\n    [..]\\n    Call Trace:\\n     \u003cTASK\u003e\\n     cxl_region_decode_reset+0x69/0x190 [cxl_core]\\n     cxl_region_detach+0xe8/0x210 [cxl_core]\\n     cxl_decoder_kill_region+0x27/0x40 [cxl_core]\\n     cxld_unregister+0x5d/0x60 [cxl_core]\\n\\nAt 1) a region has been established with 2 endpoint decoders (7.0 and\\n14.0). Those endpoints share a common switch-decoder in the topology\\n(3.0). At teardown, 2), decoder14.0 is the first to be removed and hits\\nthe \\\"out of order reset case\\\" in the switch decoder. The effect though\\nis that region3 cleanup is aborted leaving it in-tact and\\nreferencing decoder14.0. At 3) the second attempt to teardown region3\\ntrips over the stale decoder14.0 object which has long since been\\ndeleted.\\n\\nThe fix here is to recognize that the CXL specification places no\\nmandate on in-order shutdown of switch-decoders, the driver enforces\\nin-order allocation, and hardware enforces in-order commit. So, rather\\nthan fail and leave objects dangling, always remove them.\\n\\nIn support of making cxl_region_decode_reset() always succeed,\\ncxl_region_invalidate_memregion() failures are turned into warnings.\\nCrashing the kernel is ok there since system integrity is at risk if\\ncaches cannot be managed around physical address mutation events like\\nCXL region destruction.\\n\\nA new device_for_each_child_reverse_from() is added to cleanup\\nport-\u003ecommit_end after all dependent decoders have been disabled. In\\nother words if decoders are allocated 0-\u003e1-\u003e2 and disabled 1-\u003e2-\u003e0 then\\nport-\u003ecommit_end only decrements from 2 after 2 has been disabled, and\\nit decrements all the way to zero since 1 was disabled previously.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cxl/port: Corregir use-after-free, permitir el apagado del decodificador fuera de orden. En apoyo a la investigaci\\u00f3n de un informe de falla de inicializaci\\u00f3n [1], cxl_test se actualiz\\u00f3 para registrar dispositivos de memoria simulados despu\\u00e9s de que se hubiera registrado el dispositivo de puerto ra\\u00edz/bus simulado. Esto provoc\\u00f3 que cxl_test se bloqueara con un error de use-after-free con la siguiente firma: cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1 cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1 cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0 1) cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 para mem4:decoder14.0 @ 1 [..] cxld_unregister: cxl decoder14.0: cxl_region_decode_reset: cxl_region region3: mock_decoder_reset: cxl_port port3: decoder3.0 restablecer 2) mock_decoder_reset: cxl_port port3: decoder3.0: restablecimiento fuera de servicio, se esperaba decoder3.1 cxl_endpoint_decoder_release: cxl decoder14.0: [..] cxld_unregister: cxl decoder7.0: 3) cxl_region_decode_reset: cxl_region region3: Vaya: error de protecci\\u00f3n general, probablemente para direcci\\u00f3n no can\\u00f3nica 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI [..] RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core] [..] Rastreo de llamada:  cxl_region_decode_reset+0x69/0x190 [cxl_core] cxl_region_detach+0xe8/0x210 [cxl_core] cxl_decoder_kill_region+0x27/0x40 [cxl_core] cxld_unregister+0x5d/0x60 [cxl_core] En 1) se ha establecido una regi\\u00f3n con 2 decodificadores de endpoint (7.0 y 14.0). Esos endpoints comparten un decodificador de conmutaci\\u00f3n com\\u00fan en la topolog\\u00eda (3.0). En el desmontaje, 2), decoder14.0 es el primero en ser eliminado y llega al \\\"caso de reinicio fuera de orden\\\" en el decodificador de conmutaci\\u00f3n. El efecto, sin embargo, es que la limpieza de la regi\\u00f3n 3 se aborta dej\\u00e1ndola intacta y haciendo referencia a decoder14.0. En 3), el segundo intento de desmontaje de la regi\\u00f3n 3 tropieza con el objeto decoder14.0 obsoleto que ha sido eliminado hace mucho tiempo. La soluci\\u00f3n aqu\\u00ed es reconocer que la especificaci\\u00f3n CXL no impone ning\\u00fan mandato sobre el apagado en orden de los decodificadores de conmutaci\\u00f3n, el controlador impone la asignaci\\u00f3n en orden y el hardware impone el commit en orden. Por lo tanto, en lugar de fallar y dejar objetos colgando, siempre elim\\u00ednelos. Para respaldar que cxl_region_decode_reset() siempre tenga \\u00e9xito, los fallos de cxl_region_invalidate_memregion() se convierten en advertencias. All\\u00ed est\\u00e1 bien hacer que el n\\u00facleo se bloquee, ya que la integridad del sistema est\\u00e1 en riesgo si las cach\\u00e9s no se pueden administrar en torno a eventos de mutaci\\u00f3n de direcciones f\\u00edsicas como la destrucci\\u00f3n de la regi\\u00f3n CXL. Se agrega un nuevo device_for_each_child_reverse_from() para limpiar port-\u0026gt;commit_end despu\\u00e9s de que se hayan deshabilitado todos los decodificadores dependientes. En otras palabras, si se asignan decodificadores 0-\u0026gt;1-\u0026gt;2 y se deshabilitan 1-\u0026gt;2-\u0026gt;0, entonces port-\u0026gt;commit_end solo disminuye desde 2 despu\\u00e9s de que se haya deshabilitado 2, y disminuye hasta cero ya que 1 se deshabilit\\u00f3 previamente.\"}]",
      "id": "CVE-2024-50226",
      "lastModified": "2024-12-11T15:15:13.723",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-11-09T11:15:08.117",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/101c268bd2f37e965a5468353e62d154db38838e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/78c8454fdce0eeee962be004eb6d99860c80dad1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8e1b52c15c81106456437f8e49575040e489e355\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50226\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-09T11:15:08.117\",\"lastModified\":\"2024-12-11T15:15:13.723\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/port: Fix use-after-free, permit out-of-order decoder shutdown\\n\\nIn support of investigating an initialization failure report [1],\\ncxl_test was updated to register mock memory-devices after the mock\\nroot-port/bus device had been registered. That led to cxl_test crashing\\nwith a use-after-free bug with the following signature:\\n\\n    cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1\\n    cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1\\n    cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0\\n1)  cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 for mem4:decoder14.0 @ 1\\n    [..]\\n    cxld_unregister: cxl decoder14.0:\\n    cxl_region_decode_reset: cxl_region region3:\\n    mock_decoder_reset: cxl_port port3: decoder3.0 reset\\n2)  mock_decoder_reset: cxl_port port3: decoder3.0: out of order reset, expected decoder3.1\\n    cxl_endpoint_decoder_release: cxl decoder14.0:\\n    [..]\\n    cxld_unregister: cxl decoder7.0:\\n3)  cxl_region_decode_reset: cxl_region region3:\\n    Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI\\n    [..]\\n    RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core]\\n    [..]\\n    Call Trace:\\n     \u003cTASK\u003e\\n     cxl_region_decode_reset+0x69/0x190 [cxl_core]\\n     cxl_region_detach+0xe8/0x210 [cxl_core]\\n     cxl_decoder_kill_region+0x27/0x40 [cxl_core]\\n     cxld_unregister+0x5d/0x60 [cxl_core]\\n\\nAt 1) a region has been established with 2 endpoint decoders (7.0 and\\n14.0). Those endpoints share a common switch-decoder in the topology\\n(3.0). At teardown, 2), decoder14.0 is the first to be removed and hits\\nthe \\\"out of order reset case\\\" in the switch decoder. The effect though\\nis that region3 cleanup is aborted leaving it in-tact and\\nreferencing decoder14.0. At 3) the second attempt to teardown region3\\ntrips over the stale decoder14.0 object which has long since been\\ndeleted.\\n\\nThe fix here is to recognize that the CXL specification places no\\nmandate on in-order shutdown of switch-decoders, the driver enforces\\nin-order allocation, and hardware enforces in-order commit. So, rather\\nthan fail and leave objects dangling, always remove them.\\n\\nIn support of making cxl_region_decode_reset() always succeed,\\ncxl_region_invalidate_memregion() failures are turned into warnings.\\nCrashing the kernel is ok there since system integrity is at risk if\\ncaches cannot be managed around physical address mutation events like\\nCXL region destruction.\\n\\nA new device_for_each_child_reverse_from() is added to cleanup\\nport-\u003ecommit_end after all dependent decoders have been disabled. In\\nother words if decoders are allocated 0-\u003e1-\u003e2 and disabled 1-\u003e2-\u003e0 then\\nport-\u003ecommit_end only decrements from 2 after 2 has been disabled, and\\nit decrements all the way to zero since 1 was disabled previously.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cxl/port: Corregir use-after-free, permitir el apagado del decodificador fuera de orden. En apoyo a la investigaci\u00f3n de un informe de falla de inicializaci\u00f3n [1], cxl_test se actualiz\u00f3 para registrar dispositivos de memoria simulados despu\u00e9s de que se hubiera registrado el dispositivo de puerto ra\u00edz/bus simulado. Esto provoc\u00f3 que cxl_test se bloqueara con un error de use-after-free con la siguiente firma: cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1 cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1 cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0 1) cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 para mem4:decoder14.0 @ 1 [..] cxld_unregister: cxl decoder14.0: cxl_region_decode_reset: cxl_region region3: mock_decoder_reset: cxl_port port3: decoder3.0 restablecer 2) mock_decoder_reset: cxl_port port3: decoder3.0: restablecimiento fuera de servicio, se esperaba decoder3.1 cxl_endpoint_decoder_release: cxl decoder14.0: [..] cxld_unregister: cxl decoder7.0: 3) cxl_region_decode_reset: cxl_region region3: Vaya: error de protecci\u00f3n general, probablemente para direcci\u00f3n no can\u00f3nica 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI [..] RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core] [..] Rastreo de llamada:  cxl_region_decode_reset+0x69/0x190 [cxl_core] cxl_region_detach+0xe8/0x210 [cxl_core] cxl_decoder_kill_region+0x27/0x40 [cxl_core] cxld_unregister+0x5d/0x60 [cxl_core] En 1) se ha establecido una regi\u00f3n con 2 decodificadores de endpoint (7.0 y 14.0). Esos endpoints comparten un decodificador de conmutaci\u00f3n com\u00fan en la topolog\u00eda (3.0). En el desmontaje, 2), decoder14.0 es el primero en ser eliminado y llega al \\\"caso de reinicio fuera de orden\\\" en el decodificador de conmutaci\u00f3n. El efecto, sin embargo, es que la limpieza de la regi\u00f3n 3 se aborta dej\u00e1ndola intacta y haciendo referencia a decoder14.0. En 3), el segundo intento de desmontaje de la regi\u00f3n 3 tropieza con el objeto decoder14.0 obsoleto que ha sido eliminado hace mucho tiempo. La soluci\u00f3n aqu\u00ed es reconocer que la especificaci\u00f3n CXL no impone ning\u00fan mandato sobre el apagado en orden de los decodificadores de conmutaci\u00f3n, el controlador impone la asignaci\u00f3n en orden y el hardware impone el commit en orden. Por lo tanto, en lugar de fallar y dejar objetos colgando, siempre elim\u00ednelos. Para respaldar que cxl_region_decode_reset() siempre tenga \u00e9xito, los fallos de cxl_region_invalidate_memregion() se convierten en advertencias. All\u00ed est\u00e1 bien hacer que el n\u00facleo se bloquee, ya que la integridad del sistema est\u00e1 en riesgo si las cach\u00e9s no se pueden administrar en torno a eventos de mutaci\u00f3n de direcciones f\u00edsicas como la destrucci\u00f3n de la regi\u00f3n CXL. Se agrega un nuevo device_for_each_child_reverse_from() para limpiar port-\u0026gt;commit_end despu\u00e9s de que se hayan deshabilitado todos los decodificadores dependientes. En otras palabras, si se asignan decodificadores 0-\u0026gt;1-\u0026gt;2 y se deshabilitan 1-\u0026gt;2-\u0026gt;0, entonces port-\u0026gt;commit_end solo disminuye desde 2 despu\u00e9s de que se haya deshabilitado 2, y disminuye hasta cero ya que 1 se deshabilit\u00f3 previamente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.6.60\",\"matchCriteriaId\":\"CF072D0B-0626-4356-9FC8-867518FD4C56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.7\",\"matchCriteriaId\":\"E96F53A4-5E87-4A70-BD9A-BC327828D57F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/101c268bd2f37e965a5468353e62d154db38838e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78c8454fdce0eeee962be004eb6d99860c80dad1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e1b52c15c81106456437f8e49575040e489e355\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50226\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-11T14:28:17.687131Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-11T14:28:18.844Z\"}}], \"cna\": {\"title\": \"cxl/port: Fix use-after-free, permit out-of-order decoder shutdown\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"176baefb2eb5d7a3ddebe3ff803db1fce44574b5\", \"lessThan\": \"8e1b52c15c81106456437f8e49575040e489e355\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"176baefb2eb5d7a3ddebe3ff803db1fce44574b5\", \"lessThan\": \"78c8454fdce0eeee962be004eb6d99860c80dad1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"176baefb2eb5d7a3ddebe3ff803db1fce44574b5\", \"lessThan\": \"101c268bd2f37e965a5468353e62d154db38838e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/base/core.c\", \"drivers/cxl/core/hdm.c\", \"drivers/cxl/core/region.c\", \"drivers/cxl/cxl.h\", \"include/linux/device.h\", \"tools/testing/cxl/test/cxl.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.60\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/base/core.c\", \"drivers/cxl/core/hdm.c\", \"drivers/cxl/core/region.c\", \"drivers/cxl/cxl.h\", \"include/linux/device.h\", \"tools/testing/cxl/test/cxl.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8e1b52c15c81106456437f8e49575040e489e355\"}, {\"url\": \"https://git.kernel.org/stable/c/78c8454fdce0eeee962be004eb6d99860c80dad1\"}, {\"url\": \"https://git.kernel.org/stable/c/101c268bd2f37e965a5468353e62d154db38838e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/port: Fix use-after-free, permit out-of-order decoder shutdown\\n\\nIn support of investigating an initialization failure report [1],\\ncxl_test was updated to register mock memory-devices after the mock\\nroot-port/bus device had been registered. That led to cxl_test crashing\\nwith a use-after-free bug with the following signature:\\n\\n    cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1\\n    cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1\\n    cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0\\n1)  cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 for mem4:decoder14.0 @ 1\\n    [..]\\n    cxld_unregister: cxl decoder14.0:\\n    cxl_region_decode_reset: cxl_region region3:\\n    mock_decoder_reset: cxl_port port3: decoder3.0 reset\\n2)  mock_decoder_reset: cxl_port port3: decoder3.0: out of order reset, expected decoder3.1\\n    cxl_endpoint_decoder_release: cxl decoder14.0:\\n    [..]\\n    cxld_unregister: cxl decoder7.0:\\n3)  cxl_region_decode_reset: cxl_region region3:\\n    Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI\\n    [..]\\n    RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core]\\n    [..]\\n    Call Trace:\\n     \u003cTASK\u003e\\n     cxl_region_decode_reset+0x69/0x190 [cxl_core]\\n     cxl_region_detach+0xe8/0x210 [cxl_core]\\n     cxl_decoder_kill_region+0x27/0x40 [cxl_core]\\n     cxld_unregister+0x5d/0x60 [cxl_core]\\n\\nAt 1) a region has been established with 2 endpoint decoders (7.0 and\\n14.0). Those endpoints share a common switch-decoder in the topology\\n(3.0). At teardown, 2), decoder14.0 is the first to be removed and hits\\nthe \\\"out of order reset case\\\" in the switch decoder. The effect though\\nis that region3 cleanup is aborted leaving it in-tact and\\nreferencing decoder14.0. At 3) the second attempt to teardown region3\\ntrips over the stale decoder14.0 object which has long since been\\ndeleted.\\n\\nThe fix here is to recognize that the CXL specification places no\\nmandate on in-order shutdown of switch-decoders, the driver enforces\\nin-order allocation, and hardware enforces in-order commit. So, rather\\nthan fail and leave objects dangling, always remove them.\\n\\nIn support of making cxl_region_decode_reset() always succeed,\\ncxl_region_invalidate_memregion() failures are turned into warnings.\\nCrashing the kernel is ok there since system integrity is at risk if\\ncaches cannot be managed around physical address mutation events like\\nCXL region destruction.\\n\\nA new device_for_each_child_reverse_from() is added to cleanup\\nport-\u003ecommit_end after all dependent decoders have been disabled. In\\nother words if decoders are allocated 0-\u003e1-\u003e2 and disabled 1-\u003e2-\u003e0 then\\nport-\u003ecommit_end only decrements from 2 after 2 has been disabled, and\\nit decrements all the way to zero since 1 was disabled previously.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.60\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.7\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:49:12.826Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50226\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:49:12.826Z\", \"dateReserved\": \"2024-10-21T19:36:19.973Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-09T10:14:37.003Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.