cve-2024-35880
Vulnerability from cvelistv5
Published
2024-05-19 08:34
Modified
2024-08-02 03:21
Severity
Summary
io_uring/kbuf: hold io_buffer_list reference over mmap
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/561e4f9451d65fc2f7eef564e0064373e3019793
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5fd8e2359498043e0b5329a05f02d10a9eb91eb9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/65938e81df2197203bda4b9a0c477e7987218d66
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.7"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "65938e81df21",
                "status": "affected",
                "version": "09f7520048ea",
                "versionType": "git"
              },
              {
                "lessThan": "5fd8e2359498",
                "status": "affected",
                "version": "5cf4f52e6d8a",
                "versionType": "git"
              },
              {
                "lessThan": "561e4f9451d6",
                "status": "affected",
                "version": "5cf4f52e6d8a",
                "versionType": "git"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35880",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-01T03:55:54.843818Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-01T13:23:38.879Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.591Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/65938e81df2197203bda4b9a0c477e7987218d66"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5fd8e2359498043e0b5329a05f02d10a9eb91eb9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/561e4f9451d65fc2f7eef564e0064373e3019793"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/io_uring.c",
            "io_uring/kbuf.c",
            "io_uring/kbuf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "65938e81df21",
              "status": "affected",
              "version": "09f7520048ea",
              "versionType": "git"
            },
            {
              "lessThan": "5fd8e2359498",
              "status": "affected",
              "version": "5cf4f52e6d8a",
              "versionType": "git"
            },
            {
              "lessThan": "561e4f9451d6",
              "status": "affected",
              "version": "5cf4f52e6d8a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/io_uring.c",
            "io_uring/kbuf.c",
            "io_uring/kbuf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: hold io_buffer_list reference over mmap\n\nIf we look up the kbuf, ensure that it doesn\u0027t get unregistered until\nafter we\u0027re done with it. Since we\u0027re inside mmap, we cannot safely use\nthe io_uring lock. Rely on the fact that we can lookup the buffer list\nunder RCU now and grab a reference to it, preventing it from being\nunregistered until we\u0027re done with it. The lookup returns the\nio_buffer_list directly with it referenced."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:30:36.264Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/65938e81df2197203bda4b9a0c477e7987218d66"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fd8e2359498043e0b5329a05f02d10a9eb91eb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/561e4f9451d65fc2f7eef564e0064373e3019793"
        }
      ],
      "title": "io_uring/kbuf: hold io_buffer_list reference over mmap",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35880",
    "datePublished": "2024-05-19T08:34:37.262Z",
    "dateReserved": "2024-05-17T13:50:33.111Z",
    "dateUpdated": "2024-08-02T03:21:48.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35880\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:09.283\",\"lastModified\":\"2024-05-20T13:00:04.957\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring/kbuf: hold io_buffer_list reference over mmap\\n\\nIf we look up the kbuf, ensure that it doesn\u0027t get unregistered until\\nafter we\u0027re done with it. Since we\u0027re inside mmap, we cannot safely use\\nthe io_uring lock. Rely on the fact that we can lookup the buffer list\\nunder RCU now and grab a reference to it, preventing it from being\\nunregistered until we\u0027re done with it. The lookup returns the\\nio_buffer_list directly with it referenced.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring/kbuf: mantiene la referencia io_buffer_list sobre mmap. Si buscamos el kbuf, nos aseguramos de que no se cancele el registro hasta que hayamos terminado con \u00e9l. Como estamos dentro de mmap, no podemos usar de forma segura el bloqueo io_uring. Conf\u00ede en el hecho de que ahora podemos buscar la lista de b\u00fafer en RCU y obtener una referencia a ella, evitando que se cancele el registro hasta que hayamos terminado. La b\u00fasqueda devuelve io_buffer_list directamente con su referencia.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/561e4f9451d65fc2f7eef564e0064373e3019793\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5fd8e2359498043e0b5329a05f02d10a9eb91eb9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/65938e81df2197203bda4b9a0c477e7987218d66\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.