cve-2024-39501
Vulnerability from cvelistv5
Published
2024-07-12 12:20
Modified
2024-09-11 17:34
Severity ?
Summary
drivers: core: synchronize really_probe() and dev_uevent()
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/08891eeaa97c079b7f95d60b62dcf0e3ce034b69
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/13d25e82b6d00d743c7961dcb260329f86bedf7c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/760603e30bf19d7b4c28e9d81f18b54fa3b745ad
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/95d03d369ea647b89e950667f1c3363ea6f564e6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a42b0060d6ff2f7e59290a26d5f162a3c6329b90
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bb3641a5831789d83a58a39ed4a928bcbece7080
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c0a40097f0bc81deafc15f9195d1fb54595cd6d0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ec772ed7cb21b46fb132f89241682553efd0b721
Impacted products
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:26:15.451Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bb3641a5831789d83a58a39ed4a928bcbece7080"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13d25e82b6d00d743c7961dcb260329f86bedf7c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/760603e30bf19d7b4c28e9d81f18b54fa3b745ad"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec772ed7cb21b46fb132f89241682553efd0b721"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/08891eeaa97c079b7f95d60b62dcf0e3ce034b69"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a42b0060d6ff2f7e59290a26d5f162a3c6329b90"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/95d03d369ea647b89e950667f1c3363ea6f564e6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c0a40097f0bc81deafc15f9195d1fb54595cd6d0"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39501",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:07:10.431440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:40.462Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bb3641a58317",
              "status": "affected",
              "version": "239378f16aa1",
              "versionType": "git"
            },
            {
              "lessThan": "13d25e82b6d0",
              "status": "affected",
              "version": "239378f16aa1",
              "versionType": "git"
            },
            {
              "lessThan": "760603e30bf1",
              "status": "affected",
              "version": "239378f16aa1",
              "versionType": "git"
            },
            {
              "lessThan": "ec772ed7cb21",
              "status": "affected",
              "version": "239378f16aa1",
              "versionType": "git"
            },
            {
              "lessThan": "08891eeaa97c",
              "status": "affected",
              "version": "239378f16aa1",
              "versionType": "git"
            },
            {
              "lessThan": "a42b0060d6ff",
              "status": "affected",
              "version": "239378f16aa1",
              "versionType": "git"
            },
            {
              "lessThan": "95d03d369ea6",
              "status": "affected",
              "version": "239378f16aa1",
              "versionType": "git"
            },
            {
              "lessThan": "c0a40097f0bc",
              "status": "affected",
              "version": "239378f16aa1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.21"
            },
            {
              "lessThan": "2.6.21",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.317",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.279",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: core: synchronize really_probe() and dev_uevent()\n\nSynchronize the dev-\u003edriver usage in really_probe() and dev_uevent().\nThese can run in different threads, what can result in the following\nrace condition for dev-\u003edriver uninitialization:\n\nThread #1:\n==========\n\nreally_probe() {\n...\nprobe_failed:\n...\ndevice_unbind_cleanup(dev) {\n    ...\n    dev-\u003edriver = NULL;   // \u003c= Failed probe sets dev-\u003edriver to NULL\n    ...\n    }\n...\n}\n\nThread #2:\n==========\n\ndev_uevent() {\n...\nif (dev-\u003edriver)\n      // If dev-\u003edriver is NULLed from really_probe() from here on,\n      // after above check, the system crashes\n      add_uevent_var(env, \"DRIVER=%s\", dev-\u003edriver-\u003ename);\n...\n}\n\nreally_probe() holds the lock, already. So nothing needs to be done\nthere. dev_uevent() is called with lock held, often, too. But not\nalways. What implies that we can\u0027t add any locking in dev_uevent()\nitself. So fix this race by adding the lock to the non-protected\npath. This is the path where above race is observed:\n\n dev_uevent+0x235/0x380\n uevent_show+0x10c/0x1f0  \u003c= Add lock here\n dev_attr_show+0x3a/0xa0\n sysfs_kf_seq_show+0x17c/0x250\n kernfs_seq_show+0x7c/0x90\n seq_read_iter+0x2d7/0x940\n kernfs_fop_read_iter+0xc6/0x310\n vfs_read+0x5bc/0x6b0\n ksys_read+0xeb/0x1b0\n __x64_sys_read+0x42/0x50\n x64_sys_call+0x27ad/0x2d30\n do_syscall_64+0xcd/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nSimilar cases are reported by syzkaller in\n\nhttps://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a\n\nBut these are regarding the *initialization* of dev-\u003edriver\n\ndev-\u003edriver = drv;\n\nAs this switches dev-\u003edriver to non-NULL these reports can be considered\nto be false-positives (which should be \"fixed\" by this commit, as well,\nthough).\n\nThe same issue was reported and tried to be fixed back in 2015 in\n\nhttps://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@samsung.com/\n\nalready."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-15T06:50:47.462Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bb3641a5831789d83a58a39ed4a928bcbece7080"
        },
        {
          "url": "https://git.kernel.org/stable/c/13d25e82b6d00d743c7961dcb260329f86bedf7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/760603e30bf19d7b4c28e9d81f18b54fa3b745ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec772ed7cb21b46fb132f89241682553efd0b721"
        },
        {
          "url": "https://git.kernel.org/stable/c/08891eeaa97c079b7f95d60b62dcf0e3ce034b69"
        },
        {
          "url": "https://git.kernel.org/stable/c/a42b0060d6ff2f7e59290a26d5f162a3c6329b90"
        },
        {
          "url": "https://git.kernel.org/stable/c/95d03d369ea647b89e950667f1c3363ea6f564e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0a40097f0bc81deafc15f9195d1fb54595cd6d0"
        }
      ],
      "title": "drivers: core: synchronize really_probe() and dev_uevent()",
      "x_generator": {
        "engine": "bippy-c9c4e1df01b2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39501",
    "datePublished": "2024-07-12T12:20:34.980Z",
    "dateReserved": "2024-06-25T14:23:23.752Z",
    "dateUpdated": "2024-09-11T17:34:40.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39501\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:12.600\",\"lastModified\":\"2024-07-12T16:34:58.687\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrivers: core: synchronize really_probe() and dev_uevent()\\n\\nSynchronize the dev-\u003edriver usage in really_probe() and dev_uevent().\\nThese can run in different threads, what can result in the following\\nrace condition for dev-\u003edriver uninitialization:\\n\\nThread #1:\\n==========\\n\\nreally_probe() {\\n...\\nprobe_failed:\\n...\\ndevice_unbind_cleanup(dev) {\\n    ...\\n    dev-\u003edriver = NULL;   // \u003c= Failed probe sets dev-\u003edriver to NULL\\n    ...\\n    }\\n...\\n}\\n\\nThread #2:\\n==========\\n\\ndev_uevent() {\\n...\\nif (dev-\u003edriver)\\n      // If dev-\u003edriver is NULLed from really_probe() from here on,\\n      // after above check, the system crashes\\n      add_uevent_var(env, \\\"DRIVER=%s\\\", dev-\u003edriver-\u003ename);\\n...\\n}\\n\\nreally_probe() holds the lock, already. So nothing needs to be done\\nthere. dev_uevent() is called with lock held, often, too. But not\\nalways. What implies that we can\u0027t add any locking in dev_uevent()\\nitself. So fix this race by adding the lock to the non-protected\\npath. This is the path where above race is observed:\\n\\n dev_uevent+0x235/0x380\\n uevent_show+0x10c/0x1f0  \u003c= Add lock here\\n dev_attr_show+0x3a/0xa0\\n sysfs_kf_seq_show+0x17c/0x250\\n kernfs_seq_show+0x7c/0x90\\n seq_read_iter+0x2d7/0x940\\n kernfs_fop_read_iter+0xc6/0x310\\n vfs_read+0x5bc/0x6b0\\n ksys_read+0xeb/0x1b0\\n __x64_sys_read+0x42/0x50\\n x64_sys_call+0x27ad/0x2d30\\n do_syscall_64+0xcd/0x1d0\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nSimilar cases are reported by syzkaller in\\n\\nhttps://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a\\n\\nBut these are regarding the *initialization* of dev-\u003edriver\\n\\ndev-\u003edriver = drv;\\n\\nAs this switches dev-\u003edriver to non-NULL these reports can be considered\\nto be false-positives (which should be \\\"fixed\\\" by this commit, as well,\\nthough).\\n\\nThe same issue was reported and tried to be fixed back in 2015 in\\n\\nhttps://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@samsung.com/\\n\\nalready.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08891eeaa97c079b7f95d60b62dcf0e3ce034b69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/13d25e82b6d00d743c7961dcb260329f86bedf7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/760603e30bf19d7b4c28e9d81f18b54fa3b745ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/95d03d369ea647b89e950667f1c3363ea6f564e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a42b0060d6ff2f7e59290a26d5f162a3c6329b90\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb3641a5831789d83a58a39ed4a928bcbece7080\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c0a40097f0bc81deafc15f9195d1fb54595cd6d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec772ed7cb21b46fb132f89241682553efd0b721\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.