172 lines
9.0 KiB
JSON
172 lines
9.0 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2024-46801",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-09-11T15:12:18.280Z",
|
|
"datePublished": "2024-09-18T07:12:55.150Z",
|
|
"dateUpdated": "2026-08-05T11:38:40.674Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:38:40.674Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibfs: fix get_stashed_dentry()\n\nget_stashed_dentry() tries to optimistically retrieve a stashed dentry\nfrom a provided location. It needs to ensure to hold rcu lock before it\ndereference the stashed location to prevent UAF issues. Use\nrcu_dereference() instead of READ_ONCE() it's effectively equivalent\nwith some lockdep bells and whistles and it communicates clearly that\nthis expects rcu protection."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable path is reached only through local syscalls — pidfd_open()/clone(CLONE_PIDFD) into pidfs_alloc_file(), or open/readlink of /proc/<pid>/ns/* and the NS_GET_PARENT/NS_GET_USERNS ioctls into nsfs. No remote or adjacent-network input reaches path_from_stashed().\nAC:L - The attacker controls both sides of the race — one thread repeatedly calls path_from_stashed() while another drops the last reference on the same stashed dentry (always_delete_dentry forces immediate kill), and the sequence can be retried indefinitely at high frequency with slab grooming to control the reallocated object.\nPR:L - Any unprivileged local user can trigger this; pidfd_open() on its own pid, clone(CLONE_PIDFD), and opening /proc/self/ns/* require no capabilities, and the only gate (ptrace_may_access) is trivially satisfied for the attacker's own task.\nUI:N - The attacker drives both racing threads entirely from its own process; no victim action, mount, or file access by another user is needed.\nS:U - The use-after-free corrupts kernel memory within the same security authority as the attacking task; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The stale pointer is read from freed memory and, once the dentry_cache slot is resprayed, is returned as path->dentry and passed to dentry_open(), giving the attacker a file descriptor over a foreign dentry/inode and read access to kernel objects and data it does not own.\nI:H - lockref_get_not_dead() performs a cmpxchg64 read-modify-write into the freed (and attacker-reallocated) object, and the returned foreign dentry causes type confusion where i_private is treated as struct ns_common — including the indirect ns->ops->put(ns) call in nsfs_evict() — a classic path to control-flow hijack and privilege escalation.\nA:H - The use-after-free reliably produces a KASAN-detected corruption/oops, and the non-cmpxchg fallback takes spin_lock() on freed memory, which can hang the CPU; the resulting refcount imbalance also causes later premature frees and panics."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/libfs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "07fd7c329839cf0b8c7766883d830a1a0d12d1dd",
|
|
"lessThan": "03e2a1209a83a380df34a72f7d6d1bc6c74132c7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "07fd7c329839cf0b8c7766883d830a1a0d12d1dd",
|
|
"lessThan": "4e32c25b58b945f976435bbe51f39b32d714052e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/libfs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.9",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.9",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.10.10",
|
|
"lessThanOrEqual": "6.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.11",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "6.10.10"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "6.11"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/03e2a1209a83a380df34a72f7d6d1bc6c74132c7"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4e32c25b58b945f976435bbe51f39b32d714052e"
|
|
}
|
|
],
|
|
"title": "libfs: fix get_stashed_dentry()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2024-09-29T14:21:32.435301Z",
|
|
"id": "CVE-2024-46801",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-09-29T14:21:44.290Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |