Action not permitted
Modal body text goes here.
cve-2024-26639
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2024-06-20T08:29:53.809Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-26639",
"datePublished": "2024-03-18T10:19:06.455Z",
"dateRejected": "2024-06-20T08:29:53.809Z",
"dateReserved": "2024-02-19T14:20:24.137Z",
"dateUpdated": "2024-06-20T08:29:53.809Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-26639\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-18T11:15:10.880\",\"lastModified\":\"2024-06-20T09:15:11.183\",\"vulnStatus\":\"Rejected\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}],\"metrics\":{},\"references\":[]}}"
}
}
gsd-2024-26639
Vulnerability from gsd
Modified
2024-02-20 06:02
Details
In the Linux kernel, the following vulnerability has been resolved:
mm, kmsan: fix infinite recursion due to RCU critical section
Alexander Potapenko writes in [1]: "For every memory access in the code
instrumented by KMSAN we call kmsan_get_metadata() to obtain the metadata
for the memory being accessed. For virtual memory the metadata pointers
are stored in the corresponding `struct page`, therefore we need to call
virt_to_page() to get them.
According to the comment in arch/x86/include/asm/page.h,
virt_to_page(kaddr) returns a valid pointer iff virt_addr_valid(kaddr) is
true, so KMSAN needs to call virt_addr_valid() as well.
To avoid recursion, kmsan_get_metadata() must not call instrumented code,
therefore ./arch/x86/include/asm/kmsan.h forks parts of
arch/x86/mm/physaddr.c to check whether a virtual address is valid or not.
But the introduction of rcu_read_lock() to pfn_valid() added instrumented
RCU API calls to virt_to_page_or_null(), which is called by
kmsan_get_metadata(), so there is an infinite recursion now. I do not
think it is correct to stop that recursion by doing
kmsan_enter_runtime()/kmsan_exit_runtime() in kmsan_get_metadata(): that
would prevent instrumented functions called from within the runtime from
tracking the shadow values, which might introduce false positives."
Fix the issue by switching pfn_valid() to the _sched() variant of
rcu_read_lock/unlock(), which does not require calling into RCU. Given
the critical section in pfn_valid() is very small, this is a reasonable
trade-off (with preemptible RCU).
KMSAN further needs to be careful to suppress calls into the scheduler,
which would be another source of recursion. This can be done by wrapping
the call to pfn_valid() into preempt_disable/enable_no_resched(). The
downside is that this sacrifices breaking scheduling guarantees; however,
a kernel compiled with KMSAN has already given up any performance
guarantees due to being heavily instrumented.
Note, KMSAN code already disables tracing via Makefile, and since mmzone.h
is included, it is not necessary to use the notrace variant, which is
generally preferred in all other cases.
Aliases
{
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2024-26639"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, kmsan: fix infinite recursion due to RCU critical section\n\nAlexander Potapenko writes in [1]: \"For every memory access in the code\ninstrumented by KMSAN we call kmsan_get_metadata() to obtain the metadata\nfor the memory being accessed. For virtual memory the metadata pointers\nare stored in the corresponding `struct page`, therefore we need to call\nvirt_to_page() to get them.\n\nAccording to the comment in arch/x86/include/asm/page.h,\nvirt_to_page(kaddr) returns a valid pointer iff virt_addr_valid(kaddr) is\ntrue, so KMSAN needs to call virt_addr_valid() as well.\n\nTo avoid recursion, kmsan_get_metadata() must not call instrumented code,\ntherefore ./arch/x86/include/asm/kmsan.h forks parts of\narch/x86/mm/physaddr.c to check whether a virtual address is valid or not.\n\nBut the introduction of rcu_read_lock() to pfn_valid() added instrumented\nRCU API calls to virt_to_page_or_null(), which is called by\nkmsan_get_metadata(), so there is an infinite recursion now. I do not\nthink it is correct to stop that recursion by doing\nkmsan_enter_runtime()/kmsan_exit_runtime() in kmsan_get_metadata(): that\nwould prevent instrumented functions called from within the runtime from\ntracking the shadow values, which might introduce false positives.\"\n\nFix the issue by switching pfn_valid() to the _sched() variant of\nrcu_read_lock/unlock(), which does not require calling into RCU. Given\nthe critical section in pfn_valid() is very small, this is a reasonable\ntrade-off (with preemptible RCU).\n\nKMSAN further needs to be careful to suppress calls into the scheduler,\nwhich would be another source of recursion. This can be done by wrapping\nthe call to pfn_valid() into preempt_disable/enable_no_resched(). The\ndownside is that this sacrifices breaking scheduling guarantees; however,\na kernel compiled with KMSAN has already given up any performance\nguarantees due to being heavily instrumented.\n\nNote, KMSAN code already disables tracing via Makefile, and since mmzone.h\nis included, it is not necessary to use the notrace variant, which is\ngenerally preferred in all other cases.",
"id": "GSD-2024-26639",
"modified": "2024-02-20T06:02:29.160153Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@kernel.org",
"ID": "CVE-2024-26639",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Linux",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "68ed9e333240",
"version_value": "dc904345e377"
},
{
"version_affected": "\u003c",
"version_name": "70064241f222",
"version_value": "6335c0cdb2ea"
},
{
"version_affected": "\u003c",
"version_name": "3a01daace71b",
"version_value": "5a33420599fa"
},
{
"version_affected": "\u003c",
"version_name": "5ec8e8ea8b77",
"version_value": "f6564fce256a"
},
{
"version_affected": "\u003c",
"version_name": "6.1.76",
"version_value": "6.1.77"
},
{
"version_affected": "\u003c",
"version_name": "6.6.15",
"version_value": "6.6.16"
},
{
"version_affected": "\u003c",
"version_name": "6.7.3",
"version_value": "6.7.4"
}
]
}
}
]
},
"vendor_name": "Linux"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, kmsan: fix infinite recursion due to RCU critical section\n\nAlexander Potapenko writes in [1]: \"For every memory access in the code\ninstrumented by KMSAN we call kmsan_get_metadata() to obtain the metadata\nfor the memory being accessed. For virtual memory the metadata pointers\nare stored in the corresponding `struct page`, therefore we need to call\nvirt_to_page() to get them.\n\nAccording to the comment in arch/x86/include/asm/page.h,\nvirt_to_page(kaddr) returns a valid pointer iff virt_addr_valid(kaddr) is\ntrue, so KMSAN needs to call virt_addr_valid() as well.\n\nTo avoid recursion, kmsan_get_metadata() must not call instrumented code,\ntherefore ./arch/x86/include/asm/kmsan.h forks parts of\narch/x86/mm/physaddr.c to check whether a virtual address is valid or not.\n\nBut the introduction of rcu_read_lock() to pfn_valid() added instrumented\nRCU API calls to virt_to_page_or_null(), which is called by\nkmsan_get_metadata(), so there is an infinite recursion now. I do not\nthink it is correct to stop that recursion by doing\nkmsan_enter_runtime()/kmsan_exit_runtime() in kmsan_get_metadata(): that\nwould prevent instrumented functions called from within the runtime from\ntracking the shadow values, which might introduce false positives.\"\n\nFix the issue by switching pfn_valid() to the _sched() variant of\nrcu_read_lock/unlock(), which does not require calling into RCU. Given\nthe critical section in pfn_valid() is very small, this is a reasonable\ntrade-off (with preemptible RCU).\n\nKMSAN further needs to be careful to suppress calls into the scheduler,\nwhich would be another source of recursion. This can be done by wrapping\nthe call to pfn_valid() into preempt_disable/enable_no_resched(). The\ndownside is that this sacrifices breaking scheduling guarantees; however,\na kernel compiled with KMSAN has already given up any performance\nguarantees due to being heavily instrumented.\n\nNote, KMSAN code already disables tracing via Makefile, and since mmzone.h\nis included, it is not necessary to use the notrace variant, which is\ngenerally preferred in all other cases."
}
]
},
"generator": {
"engine": "bippy-5f0117140d9a"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://git.kernel.org/stable/c/dc904345e3771aa01d0b8358b550802fdc6fe00b",
"refsource": "MISC",
"url": "https://git.kernel.org/stable/c/dc904345e3771aa01d0b8358b550802fdc6fe00b"
},
{
"name": "https://git.kernel.org/stable/c/6335c0cdb2ea0ea02c999e04d34fd84f69fb27ff",
"refsource": "MISC",
"url": "https://git.kernel.org/stable/c/6335c0cdb2ea0ea02c999e04d34fd84f69fb27ff"
},
{
"name": "https://git.kernel.org/stable/c/5a33420599fa0288792537e6872fd19cc8607ea6",
"refsource": "MISC",
"url": "https://git.kernel.org/stable/c/5a33420599fa0288792537e6872fd19cc8607ea6"
},
{
"name": "https://git.kernel.org/stable/c/f6564fce256a3944aa1bc76cb3c40e792d97c1eb",
"refsource": "MISC",
"url": "https://git.kernel.org/stable/c/f6564fce256a3944aa1bc76cb3c40e792d97c1eb"
}
]
}
},
"nvd.nist.gov": {
"cve": {
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, kmsan: fix infinite recursion due to RCU critical section\n\nAlexander Potapenko writes in [1]: \"For every memory access in the code\ninstrumented by KMSAN we call kmsan_get_metadata() to obtain the metadata\nfor the memory being accessed. For virtual memory the metadata pointers\nare stored in the corresponding `struct page`, therefore we need to call\nvirt_to_page() to get them.\n\nAccording to the comment in arch/x86/include/asm/page.h,\nvirt_to_page(kaddr) returns a valid pointer iff virt_addr_valid(kaddr) is\ntrue, so KMSAN needs to call virt_addr_valid() as well.\n\nTo avoid recursion, kmsan_get_metadata() must not call instrumented code,\ntherefore ./arch/x86/include/asm/kmsan.h forks parts of\narch/x86/mm/physaddr.c to check whether a virtual address is valid or not.\n\nBut the introduction of rcu_read_lock() to pfn_valid() added instrumented\nRCU API calls to virt_to_page_or_null(), which is called by\nkmsan_get_metadata(), so there is an infinite recursion now. I do not\nthink it is correct to stop that recursion by doing\nkmsan_enter_runtime()/kmsan_exit_runtime() in kmsan_get_metadata(): that\nwould prevent instrumented functions called from within the runtime from\ntracking the shadow values, which might introduce false positives.\"\n\nFix the issue by switching pfn_valid() to the _sched() variant of\nrcu_read_lock/unlock(), which does not require calling into RCU. Given\nthe critical section in pfn_valid() is very small, this is a reasonable\ntrade-off (with preemptible RCU).\n\nKMSAN further needs to be careful to suppress calls into the scheduler,\nwhich would be another source of recursion. This can be done by wrapping\nthe call to pfn_valid() into preempt_disable/enable_no_resched(). The\ndownside is that this sacrifices breaking scheduling guarantees; however,\na kernel compiled with KMSAN has already given up any performance\nguarantees due to being heavily instrumented.\n\nNote, KMSAN code already disables tracing via Makefile, and since mmzone.h\nis included, it is not necessary to use the notrace variant, which is\ngenerally preferred in all other cases."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm, kmsan: corrige la recursividad infinita debido a la secci\u00f3n cr\u00edtica de RCU Alexander Potapenko escribe en [1]: \"Para cada acceso a memoria en el c\u00f3digo instrumentado por KMSAN llamamos kmsan_get_metadata() para obtener los metadatos de la memoria a la que se accede. Para la memoria virtual, los punteros de metadatos se almacenan en la `p\u00e1gina de estructura` correspondiente, por lo tanto, necesitamos llamar a virt_to_page() para obtenerlos. De acuerdo con el comentario en arch/x86/include/asm/page .h, virt_to_page(kaddr) devuelve un puntero v\u00e1lido si virt_addr_valid(kaddr) es verdadero, por lo que KMSAN tambi\u00e9n necesita llamar a virt_addr_valid(). Para evitar la recursividad, kmsan_get_metadata() no debe llamar al c\u00f3digo instrumentado, por lo tanto ./arch/x86/ include/asm/kmsan.h bifurca partes de arch/x86/mm/physaddr.c para verificar si una direcci\u00f3n virtual es v\u00e1lida o no, pero la introducci\u00f3n de rcu_read_lock() a pfn_valid() agreg\u00f3 llamadas API de RCU instrumentadas a virt_to_page_or_null() , que es llamado por kmsan_get_metadata(), por lo que ahora hay una recursividad infinita. No creo que sea correcto detener esa recursividad haciendo kmsan_enter_runtime()/kmsan_exit_runtime() en kmsan_get_metadata(): eso evitar\u00eda que las funciones instrumentadas llamadas desde el tiempo de ejecuci\u00f3n rastreen los valores ocultos, lo que podr\u00eda introducir falsos positivos. problema al cambiar pfn_valid() a la variante _sched() de rcu_read_lock/unlock(), que no requiere llamar a RCU. Dado que la secci\u00f3n cr\u00edtica en pfn_valid() es muy peque\u00f1a, esta es una compensaci\u00f3n razonable (con RCU interrumpible ). Adem\u00e1s, KMSAN debe tener cuidado de suprimir las llamadas al programador, lo que ser\u00eda otra fuente de recursividad. Esto se puede hacer envolviendo la llamada a pfn_valid() en preempt_disable/enable_no_resched(). La desventaja es que esto sacrifica la interrupci\u00f3n de la programaci\u00f3n. garant\u00edas; sin embargo, un kernel compilado con KMSAN ya ha renunciado a cualquier garant\u00eda de rendimiento debido a que est\u00e1 fuertemente instrumentado. Tenga en cuenta que el c\u00f3digo KMSAN ya deshabilita el seguimiento a trav\u00e9s de Makefile y, dado que mmzone.h est\u00e1 incluido, no es necesario usar la variante notrace, que generalmente se prefiere en todos los dem\u00e1s casos."
}
],
"id": "CVE-2024-26639",
"lastModified": "2024-04-04T14:15:09.457",
"metrics": {},
"published": "2024-03-18T11:15:10.880",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/5a33420599fa0288792537e6872fd19cc8607ea6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/6335c0cdb2ea0ea02c999e04d34fd84f69fb27ff"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/dc904345e3771aa01d0b8358b550802fdc6fe00b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f6564fce256a3944aa1bc76cb3c40e792d97c1eb"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis"
}
}
}
}
wid-sec-w-2024-0654
Vulnerability from csaf_certbund
Published
2024-03-17 23:00
Modified
2024-07-04 22:00
Summary
Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und unspezifische Angriffe
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen oder einen nicht spezifizierten Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Der Kernel stellt den Kern des Linux Betriebssystems dar.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-0654 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0654.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-0654 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0654"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318101458.2835626-10-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318101458.2835626-11-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318101458.2835626-15-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318101458.2835626-16-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318102117.2839904-10-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318102117.2839904-11-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318102117.2839904-12-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318102117.2839904-7-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318102117.2839904-8-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318102117.2839904-9-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318101458.2835626-12-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318101458.2835626-13-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318101458.2835626-14-lee@kernel.org/"
},
{
"category": "external",
"summary": "CVE Announce auf lore.kernel.org vom 2024-03-17",
"url": "http://lore.kernel.org/linux-cve-announce/20240318101458.2835626-9-lee@kernel.org/"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6725-1 vom 2024-04-09",
"url": "https://ubuntu.com/security/notices/USN-6725-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6726-1 vom 2024-04-09",
"url": "https://ubuntu.com/security/notices/USN-6726-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6725-2 vom 2024-04-16",
"url": "https://ubuntu.com/security/notices/USN-6725-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6726-2 vom 2024-04-16",
"url": "https://ubuntu.com/security/notices/USN-6726-2"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1322-1 vom 2024-04-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018374.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6726-3 vom 2024-04-17",
"url": "https://ubuntu.com/security/notices/USN-6726-3"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1332-1 vom 2024-04-18",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018376.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1332-2 vom 2024-04-18",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018378.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1322-2 vom 2024-04-18",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018377.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1466-1 vom 2024-04-29",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018438.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:2394 vom 2024-04-30",
"url": "https://access.redhat.com/errata/RHSA-2024:2394"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1480-1 vom 2024-04-30",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018444.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1490-1 vom 2024-05-03",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018445.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-5681 vom 2024-05-06",
"url": "https://lists.debian.org/debian-security-announce/2024/msg00090.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6765-1 vom 2024-05-07",
"url": "https://ubuntu.com/security/notices/USN-6765-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6766-1 vom 2024-05-07",
"url": "https://ubuntu.com/security/notices/USN-6766-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6767-1 vom 2024-05-07",
"url": "https://ubuntu.com/security/notices/USN-6767-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6767-2 vom 2024-05-14",
"url": "https://ubuntu.com/security/notices/USN-6767-2"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1644-1 vom 2024-05-14",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018528.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1648-1 vom 2024-05-14",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018524.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1641-1 vom 2024-05-14",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018531.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1647-1 vom 2024-05-14",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018525.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1646-1 vom 2024-05-14",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018526.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1643-1 vom 2024-05-14",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018529.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1659-1 vom 2024-05-15",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018538.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6766-2 vom 2024-05-15",
"url": "https://ubuntu.com/security/notices/USN-6766-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6778-1 vom 2024-05-16",
"url": "https://ubuntu.com/security/notices/USN-6778-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6774-1 vom 2024-05-16",
"url": "https://ubuntu.com/security/notices/USN-6774-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6777-1 vom 2024-05-16",
"url": "https://ubuntu.com/security/notices/USN-6777-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6766-3 vom 2024-05-20",
"url": "https://ubuntu.com/security/notices/USN-6766-3"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6777-2 vom 2024-05-20",
"url": "https://ubuntu.com/security/notices/USN-6777-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6777-3 vom 2024-05-22",
"url": "https://ubuntu.com/security/notices/USN-6777-3"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1648-2 vom 2024-05-21",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018572.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6777-4 vom 2024-05-23",
"url": "https://ubuntu.com/security/notices/USN-6777-4"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6795-1 vom 2024-05-28",
"url": "https://ubuntu.com/security/notices/USN-6795-1"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1870-1 vom 2024-05-30",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018634.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:3618 vom 2024-06-05",
"url": "https://access.redhat.com/errata/RHSA-2024:3618"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:3627 vom 2024-06-05",
"url": "https://access.redhat.com/errata/RHSA-2024:3627"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2024-3618 vom 2024-06-06",
"url": "https://linux.oracle.com/errata/ELSA-2024-3618.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6818-1 vom 2024-06-08",
"url": "https://ubuntu.com/security/notices/USN-6818-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6819-1 vom 2024-06-08",
"url": "https://ubuntu.com/security/notices/USN-6819-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6818-2 vom 2024-06-10",
"url": "https://ubuntu.com/security/notices/USN-6818-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6828-1 vom 2024-06-11",
"url": "https://ubuntu.com/security/notices/USN-6828-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6819-2 vom 2024-06-12",
"url": "https://ubuntu.com/security/notices/USN-6819-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6819-3 vom 2024-06-12",
"url": "https://ubuntu.com/security/notices/USN-6819-3"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:2008-1 vom 2024-06-12",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-June/018706.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6818-3 vom 2024-06-14",
"url": "https://ubuntu.com/security/notices/USN-6818-3"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6818-4 vom 2024-06-19",
"url": "https://ubuntu.com/security/notices/USN-6818-4"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:2135-1 vom 2024-06-21",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-June/018783.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3842 vom 2024-06-25",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3841 vom 2024-06-25",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:2190-1 vom 2024-06-25",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-June/018819.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6819-4 vom 2024-06-26",
"url": "https://ubuntu.com/security/notices/USN-6819-4"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3840 vom 2024-06-27",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:4211 vom 2024-07-02",
"url": "https://access.redhat.com/errata/RHSA-2024:4211"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2024-4211 vom 2024-07-03",
"url": "https://linux.oracle.com/errata/ELSA-2024-4211.html"
},
{
"category": "external",
"summary": "Dell Security Advisory DSA-2024-022 vom 2024-07-03",
"url": "https://www.dell.com/support/kbdoc/de-de/000226633/dsa-2024-022-security-update-for-dell-networker-vproxy-multiple-component-vulnerabilities"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6865-1 vom 2024-07-04",
"url": "https://ubuntu.com/security/notices/USN-6865-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6866-1 vom 2024-07-04",
"url": "https://ubuntu.com/security/notices/USN-6866-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6866-2 vom 2024-07-04",
"url": "https://ubuntu.com/security/notices/USN-6866-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6865-2 vom 2024-07-04",
"url": "https://ubuntu.com/security/notices/USN-6865-2"
}
],
"source_lang": "en-US",
"title": "Linux Kernel: Mehrere Schwachstellen erm\u00f6glichen Denial of Service und unspezifische Angriffe",
"tracking": {
"current_release_date": "2024-07-04T22:00:00.000+00:00",
"generator": {
"date": "2024-07-05T08:04:32.748+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.0"
}
},
"id": "WID-SEC-W-2024-0654",
"initial_release_date": "2024-03-17T23:00:00.000+00:00",
"revision_history": [
{
"date": "2024-03-17T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2024-03-18T23:00:00.000+00:00",
"number": "2",
"summary": "doppelten Eintrag entfernt"
},
{
"date": "2024-04-09T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-04-16T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-04-17T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-04-18T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-04-29T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-05-01T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-05-02T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-05-06T22:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-05-07T22:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-05-13T22:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-05-14T22:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-05-15T22:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von SUSE und Ubuntu aufgenommen"
},
{
"date": "2024-05-16T22:00:00.000+00:00",
"number": "15",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-05-20T22:00:00.000+00:00",
"number": "16",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-05-21T22:00:00.000+00:00",
"number": "17",
"summary": "Neue Updates von Ubuntu und SUSE aufgenommen"
},
{
"date": "2024-05-23T22:00:00.000+00:00",
"number": "18",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-05-28T22:00:00.000+00:00",
"number": "19",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-05-30T22:00:00.000+00:00",
"number": "20",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-06-04T22:00:00.000+00:00",
"number": "21",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2024-06-06T22:00:00.000+00:00",
"number": "22",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2024-06-09T22:00:00.000+00:00",
"number": "23",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-06-10T22:00:00.000+00:00",
"number": "24",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-06-11T22:00:00.000+00:00",
"number": "25",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-06-12T22:00:00.000+00:00",
"number": "26",
"summary": "Neue Updates von Ubuntu und SUSE aufgenommen"
},
{
"date": "2024-06-16T22:00:00.000+00:00",
"number": "27",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-06-18T22:00:00.000+00:00",
"number": "28",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-06-23T22:00:00.000+00:00",
"number": "29",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-06-25T22:00:00.000+00:00",
"number": "30",
"summary": "Neue Updates von Debian und SUSE aufgenommen"
},
{
"date": "2024-06-26T22:00:00.000+00:00",
"number": "31",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-06-27T22:00:00.000+00:00",
"number": "32",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-07-01T22:00:00.000+00:00",
"number": "33",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2024-07-02T22:00:00.000+00:00",
"number": "34",
"summary": "Neue Updates von Oracle Linux und Dell aufgenommen"
},
{
"date": "2024-07-03T22:00:00.000+00:00",
"number": "35",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-07-04T22:00:00.000+00:00",
"number": "36",
"summary": "Neue Updates von Ubuntu aufgenommen"
}
],
"status": "final",
"version": "36"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c19.11",
"product": {
"name": "Dell NetWorker \u003c19.11",
"product_id": "T035785",
"product_identification_helper": {
"cpe": "cpe:/a:dell:networker:19.11"
}
}
}
],
"category": "product_name",
"name": "NetWorker"
}
],
"category": "vendor",
"name": "Dell"
},
{
"branches": [
{
"category": "product_name",
"name": "Open Source Linux Kernel",
"product": {
"name": "Open Source Linux Kernel",
"product_id": "T033522",
"product_identification_helper": {
"cpe": "cpe:/o:linux:linux_kernel:-"
}
}
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "Oracle Linux",
"product": {
"name": "Oracle Linux",
"product_id": "T004914",
"product_identification_helper": {
"cpe": "cpe:/o:oracle:linux:-"
}
}
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-52609",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52609"
},
{
"cve": "CVE-2023-52610",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52610"
},
{
"cve": "CVE-2023-52611",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52611"
},
{
"cve": "CVE-2023-52612",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52612"
},
{
"cve": "CVE-2023-52613",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52613"
},
{
"cve": "CVE-2023-52614",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52614"
},
{
"cve": "CVE-2023-52615",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52615"
},
{
"cve": "CVE-2023-52616",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52616"
},
{
"cve": "CVE-2023-52617",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52617"
},
{
"cve": "CVE-2023-52618",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52618"
},
{
"cve": "CVE-2023-52619",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2023-52619"
},
{
"cve": "CVE-2024-26631",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26631"
},
{
"cve": "CVE-2024-26632",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26632"
},
{
"cve": "CVE-2024-26633",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26633"
},
{
"cve": "CVE-2024-26634",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26634"
},
{
"cve": "CVE-2024-26635",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26635"
},
{
"cve": "CVE-2024-26636",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26636"
},
{
"cve": "CVE-2024-26637",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26637"
},
{
"cve": "CVE-2024-26638",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26638"
},
{
"cve": "CVE-2024-26639",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26639"
},
{
"cve": "CVE-2024-26640",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26640"
},
{
"cve": "CVE-2024-26641",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen im Linux-Kernel. Diese Fehler bestehen in mehreren Subsystemen und Komponenten wie dem ip6_tunnel, dem PCI oder dem llc, unter anderem aufgrund von mehreren Problemen wie einem Buffer Overflows, unerwarteten Zeigerzugriffen oder Deadlocks. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand herbeizuf\u00fchren oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"product_status": {
"known_affected": [
"T033522",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T035785"
]
},
"release_date": "2024-03-17T23:00:00Z",
"title": "CVE-2024-26641"
}
]
}
ghsa-q99v-mcmh-7x5m
Vulnerability from github
Published
2024-03-18 12:30
Modified
2024-04-04 15:30
Details
In the Linux kernel, the following vulnerability has been resolved:
mm, kmsan: fix infinite recursion due to RCU critical section
Alexander Potapenko writes in [1]: "For every memory access in the code
instrumented by KMSAN we call kmsan_get_metadata() to obtain the metadata
for the memory being accessed. For virtual memory the metadata pointers
are stored in the corresponding struct page, therefore we need to call
virt_to_page() to get them.
According to the comment in arch/x86/include/asm/page.h, virt_to_page(kaddr) returns a valid pointer iff virt_addr_valid(kaddr) is true, so KMSAN needs to call virt_addr_valid() as well.
To avoid recursion, kmsan_get_metadata() must not call instrumented code, therefore ./arch/x86/include/asm/kmsan.h forks parts of arch/x86/mm/physaddr.c to check whether a virtual address is valid or not.
But the introduction of rcu_read_lock() to pfn_valid() added instrumented RCU API calls to virt_to_page_or_null(), which is called by kmsan_get_metadata(), so there is an infinite recursion now. I do not think it is correct to stop that recursion by doing kmsan_enter_runtime()/kmsan_exit_runtime() in kmsan_get_metadata(): that would prevent instrumented functions called from within the runtime from tracking the shadow values, which might introduce false positives."
Fix the issue by switching pfn_valid() to the _sched() variant of rcu_read_lock/unlock(), which does not require calling into RCU. Given the critical section in pfn_valid() is very small, this is a reasonable trade-off (with preemptible RCU).
KMSAN further needs to be careful to suppress calls into the scheduler, which would be another source of recursion. This can be done by wrapping the call to pfn_valid() into preempt_disable/enable_no_resched(). The downside is that this sacrifices breaking scheduling guarantees; however, a kernel compiled with KMSAN has already given up any performance guarantees due to being heavily instrumented.
Note, KMSAN code already disables tracing via Makefile, and since mmzone.h is included, it is not necessary to use the notrace variant, which is generally preferred in all other cases.
{
"affected": [],
"aliases": [
"CVE-2024-26639"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-18T11:15:10Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, kmsan: fix infinite recursion due to RCU critical section\n\nAlexander Potapenko writes in [1]: \"For every memory access in the code\ninstrumented by KMSAN we call kmsan_get_metadata() to obtain the metadata\nfor the memory being accessed. For virtual memory the metadata pointers\nare stored in the corresponding `struct page`, therefore we need to call\nvirt_to_page() to get them.\n\nAccording to the comment in arch/x86/include/asm/page.h,\nvirt_to_page(kaddr) returns a valid pointer iff virt_addr_valid(kaddr) is\ntrue, so KMSAN needs to call virt_addr_valid() as well.\n\nTo avoid recursion, kmsan_get_metadata() must not call instrumented code,\ntherefore ./arch/x86/include/asm/kmsan.h forks parts of\narch/x86/mm/physaddr.c to check whether a virtual address is valid or not.\n\nBut the introduction of rcu_read_lock() to pfn_valid() added instrumented\nRCU API calls to virt_to_page_or_null(), which is called by\nkmsan_get_metadata(), so there is an infinite recursion now. I do not\nthink it is correct to stop that recursion by doing\nkmsan_enter_runtime()/kmsan_exit_runtime() in kmsan_get_metadata(): that\nwould prevent instrumented functions called from within the runtime from\ntracking the shadow values, which might introduce false positives.\"\n\nFix the issue by switching pfn_valid() to the _sched() variant of\nrcu_read_lock/unlock(), which does not require calling into RCU. Given\nthe critical section in pfn_valid() is very small, this is a reasonable\ntrade-off (with preemptible RCU).\n\nKMSAN further needs to be careful to suppress calls into the scheduler,\nwhich would be another source of recursion. This can be done by wrapping\nthe call to pfn_valid() into preempt_disable/enable_no_resched(). The\ndownside is that this sacrifices breaking scheduling guarantees; however,\na kernel compiled with KMSAN has already given up any performance\nguarantees due to being heavily instrumented.\n\nNote, KMSAN code already disables tracing via Makefile, and since mmzone.h\nis included, it is not necessary to use the notrace variant, which is\ngenerally preferred in all other cases.",
"id": "GHSA-q99v-mcmh-7x5m",
"modified": "2024-04-04T15:30:33Z",
"published": "2024-03-18T12:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26639"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5a33420599fa0288792537e6872fd19cc8607ea6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6335c0cdb2ea0ea02c999e04d34fd84f69fb27ff"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dc904345e3771aa01d0b8358b550802fdc6fe00b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f6564fce256a3944aa1bc76cb3c40e792d97c1eb"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.