CVE-2024-39501 (GCVE-0-2024-39501)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:20 – Updated: 2025-05-10 14:14
VLAI?

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-05-10T14:14:44.417Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39501",
    "datePublished": "2024-07-12T12:20:34.980Z",
    "dateRejected": "2025-05-10T14:14:44.417Z",
    "dateReserved": "2024-06-25T14:23:23.752Z",
    "dateUpdated": "2025-05-10T14:14:44.417Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrivers: core: synchronize really_probe() and dev_uevent()\\n\\nSynchronize the dev-\u003edriver usage in really_probe() and dev_uevent().\\nThese can run in different threads, what can result in the following\\nrace condition for dev-\u003edriver uninitialization:\\n\\nThread #1:\\n==========\\n\\nreally_probe() {\\n...\\nprobe_failed:\\n...\\ndevice_unbind_cleanup(dev) {\\n    ...\\n    dev-\u003edriver = NULL;   // \u003c= Failed probe sets dev-\u003edriver to NULL\\n    ...\\n    }\\n...\\n}\\n\\nThread #2:\\n==========\\n\\ndev_uevent() {\\n...\\nif (dev-\u003edriver)\\n      // If dev-\u003edriver is NULLed from really_probe() from here on,\\n      // after above check, the system crashes\\n      add_uevent_var(env, \\\"DRIVER=%s\\\", dev-\u003edriver-\u003ename);\\n...\\n}\\n\\nreally_probe() holds the lock, already. So nothing needs to be done\\nthere. dev_uevent() is called with lock held, often, too. But not\\nalways. What implies that we can\u0027t add any locking in dev_uevent()\\nitself. So fix this race by adding the lock to the non-protected\\npath. This is the path where above race is observed:\\n\\n dev_uevent+0x235/0x380\\n uevent_show+0x10c/0x1f0  \u003c= Add lock here\\n dev_attr_show+0x3a/0xa0\\n sysfs_kf_seq_show+0x17c/0x250\\n kernfs_seq_show+0x7c/0x90\\n seq_read_iter+0x2d7/0x940\\n kernfs_fop_read_iter+0xc6/0x310\\n vfs_read+0x5bc/0x6b0\\n ksys_read+0xeb/0x1b0\\n __x64_sys_read+0x42/0x50\\n x64_sys_call+0x27ad/0x2d30\\n do_syscall_64+0xcd/0x1d0\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nSimilar cases are reported by syzkaller in\\n\\nhttps://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a\\n\\nBut these are regarding the *initialization* of dev-\u003edriver\\n\\ndev-\u003edriver = drv;\\n\\nAs this switches dev-\u003edriver to non-NULL these reports can be considered\\nto be false-positives (which should be \\\"fixed\\\" by this commit, as well,\\nthough).\\n\\nThe same issue was reported and tried to be fixed back in 2015 in\\n\\nhttps://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@samsung.com/\\n\\nalready.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drivers: core: sincronizar Actually_probe() y dev_uevent() Sincronizar el uso dev-\u0026gt;driver en Actually_probe() y dev_uevent(). Estos pueden ejecutarse en diferentes subprocesos, lo que puede resultar en la siguiente condici\\u00f3n de ejecuci\\u00f3n para dev-\u0026gt;desinicializaci\\u00f3n del controlador: Subproceso n.\\u00b0 1: ========== reality_probe() { ... probe_failed: ... device_unbind_cleanup( dev) { ... dev-\u0026gt;controlador = NULL; // \u0026lt;= La sonda fallida establece dev-\u0026gt;driver en NULL ... } ... } Hilo #2: ========== dev_uevent() { ... if (dev-\u0026gt;driver) / / Si dev-\u0026gt;driver recibe un valor NULL desde reality_probe() de ahora en adelante, // despu\\u00e9s de la verificaci\\u00f3n anterior, el sistema falla add_uevent_var(env, \\\"DRIVER=%s\\\", dev-\u0026gt;driver-\u0026gt;name); ... }realmente_probe() ya tiene el bloqueo. Entonces no es necesario hacer nada all\\u00ed. A menudo tambi\\u00e9n se llama a dev_uevent() con el bloqueo mantenido. Pero no siempre. Lo que implica que no podemos agregar ning\\u00fan bloqueo en el propio dev_uevent(). As\\u00ed que arregle esta ejecuci\\u00f3n agregando el candado al camino no protegido. Esta es la ruta donde se observa la ejecuci\\u00f3n anterior: dev_uevent+0x235/0x380 uevent_show+0x10c/0x1f0 \u0026lt;= Agregar bloqueo aqu\\u00ed dev_attr_show+0x3a/0xa0 sysfs_kf_seq_show+0x17c/0x250 kernfs_seq_show+0x7c/0x90 seq_read_iter+0x2d7/ 0x940 kernfs_fop_read_iter+0xc6/0x310 vfs_read+0x5bc/0x6b0 ksys_read+0xeb/0x1b0 __x64_sys_read+0x42/0x50 x64_sys_call+0x27ad/0x2d30 do_syscall_64+0xcd/0x1d0 Entry_SYSCALL_64_after_hwframe+0x77/0x7f Casos similares son reportados por syzkaller en https://syzkaller.appspot.com/bug?extid =ffa8143439596313a85a Pero estos se refieren a la *inicializaci\\u00f3n* de dev-\u0026gt;driver dev-\u0026gt;driver = drv; Como esto cambia dev-\u0026gt;driver a no NULL, estos informes pueden considerarse falsos positivos (aunque est\\u00e9 commit tambi\\u00e9n deber\\u00eda \\\"solucionarlos\\\"). El mismo problema se inform\\u00f3 y se intent\\u00f3 solucionar en 2015 en https://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@samsung.com/ ya.\"}]",
      "id": "CVE-2024-39501",
      "lastModified": "2024-11-21T09:27:50.060",
      "published": "2024-07-12T13:15:12.600",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/08891eeaa97c079b7f95d60b62dcf0e3ce034b69\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/13d25e82b6d00d743c7961dcb260329f86bedf7c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/760603e30bf19d7b4c28e9d81f18b54fa3b745ad\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/95d03d369ea647b89e950667f1c3363ea6f564e6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a42b0060d6ff2f7e59290a26d5f162a3c6329b90\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bb3641a5831789d83a58a39ed4a928bcbece7080\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c0a40097f0bc81deafc15f9195d1fb54595cd6d0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ec772ed7cb21b46fb132f89241682553efd0b721\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/08891eeaa97c079b7f95d60b62dcf0e3ce034b69\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/13d25e82b6d00d743c7961dcb260329f86bedf7c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/760603e30bf19d7b4c28e9d81f18b54fa3b745ad\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/95d03d369ea647b89e950667f1c3363ea6f564e6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a42b0060d6ff2f7e59290a26d5f162a3c6329b90\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/bb3641a5831789d83a58a39ed4a928bcbece7080\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c0a40097f0bc81deafc15f9195d1fb54595cd6d0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ec772ed7cb21b46fb132f89241682553efd0b721\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39501\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:12.600\",\"lastModified\":\"2025-05-10T15:15:58.887\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"rejectedReasons\": [{\"lang\": \"en\", \"value\": \"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-10T14:14:44.417Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39501\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"REJECTED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2024-06-25T14:23:23.752Z\", \"datePublished\": \"2024-07-12T12:20:34.980Z\", \"dateUpdated\": \"2025-05-10T14:14:44.417Z\", \"dateRejected\": \"2025-05-10T14:14:44.417Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.