CVE-2024-46858

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in timerdeletesync There are two paths to access mptcppmdeladdtimer, result in a race condition: CPU1 CPU2 ==== ==== netrxaction napipoll netlinksendmsg napipoll netlinkunicast processbacklog netlinkunicastkern...

CVE-2024-46866 drm/xe/client: add missing bo locking in show_meminfo()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: add missing bo locking in showmeminfo bomeminfo wants to inspect bo state like tt and the ttm resource, however this state can change at any point leading to stuff like NPD and UAF, if the bo lock is not held. Grab...

CVE-2024-46866

The CVE-2024-46866 issue in the Linux kernel affects the drm/xe client, specifically the bo_meminfo path. Root cause: bo_meminfo() inspects bo state (tt and ttm resource) without consistently holding the bo lock, allowing state changes that can cause NPD or UAF. Mitigation implemented by grabbing...

CVE-2024-46858

CVE-2024-46858 in the Linux kernel fixes a local UAF race in mptcp_pm_del_add_timer. Two paths can access mptcp_pm_del_add_timer concurrently (CPU1 in PM code path vs CPU2 in netlink/ip stack path), leading to use-after-free when a timer entry is freed after leaving the critical region. The patch...

CVE-2024-46858 mptcp: pm: Fix uaf in __timer_delete_sync

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in timerdeletesync There are two paths to access mptcppmdeladdtimer, result in a race condition: CPU1 CPU2 ==== ==== netrxaction napipoll netlinksendmsg napipoll netlinkunicast processbacklog netlinkunicastkern...

CVE-2024-46858 mptcp: pm: Fix uaf in __timer_delete_sync

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in timerdeletesync There are two paths to access mptcppmdeladdtimer, result in a race condition: CPU1 CPU2 ==== ==== netrxaction napipoll netlinksendmsg napipoll netlinkunicast processbacklog netlinkunicastkern...

CVE-2024-46801

In the Linux kernel, the following vulnerability has been resolved: libfs: fix getstasheddentry getstasheddentry tries to optimistically retrieve a stashed dentry from a provided location. It needs to ensure to hold rcu lock before it dereference the stashed location to prevent UAF issues. Use...

CVE-2024-46800

A use-after-free vulnerability was found in the Linux kernel. If netemdequeue enqueues a packet to inner qdisc and that qdisc returns NETXMITSTOLEN, the packet is dropped but qdisctreereducebacklog is not called to update the parent's q.qlen. Mitigation Mitigation for this issue is either not...

CVE-2024-46740

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lac...

CVE-2024-46801

In the Linux kernel, the following vulnerability has been resolved: libfs: fix getstasheddentry getstasheddentry tries to optimistically retrieve a stashed dentry from a provided location. It needs to ensure to hold rcu lock before it dereference the stashed location to prevent UAF issues. Use...

DEBIAN-CVE-2024-46801

In the Linux kernel, the following vulnerability has been resolved: libfs: fix getstasheddentry getstasheddentry tries to optimistically retrieve a stashed dentry from a provided location. It needs to ensure to hold rcu lock before it dereference the stashed location to prevent UAF issues. Use...

CVE-2024-46786

In the Linux kernel, the following vulnerability has been resolved: fscache: delete fscachecookielrutimer when fscache exits to avoid UAF The fscachecookielrutimer is initialized when the fscache module is inserted, but is not deleted when the fscache module is removed. If timerreduce is called...

CVE-2024-46740

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lac...

CVE-2024-46801 libfs: fix get_stashed_dentry()

In the Linux kernel, the following vulnerability has been resolved: libfs: fix getstasheddentry getstasheddentry tries to optimistically retrieve a stashed dentry from a provided location. It needs to ensure to hold rcu lock before it dereference the stashed location to prevent UAF issues. Use...

CVE-2024-46801 libfs: fix get_stashed_dentry()

In the Linux kernel, the following vulnerability has been resolved: libfs: fix getstasheddentry getstasheddentry tries to optimistically retrieve a stashed dentry from a provided location. It needs to ensure to hold rcu lock before it dereference the stashed location to prevent UAF issues. Use...

CVE-2024-46801

CVE-2024-46801 is a Linux kernel issue in libfs: fix get_stashed_dentry().get_stashed_dentry() may dereference a stashed dentry without proper protection; the fix switches from READ_ONCE() to rcu_dereference() to ensure rcu protection, addressing potential use-after-free. Public documents (includ...

CVE-2024-46801 libfs: fix get_stashed_dentry()

In the Linux kernel, the following vulnerability has been resolved: libfs: fix getstasheddentry getstasheddentry tries to optimistically retrieve a stashed dentry from a provided location. It needs to ensure to hold rcu lock before it dereference the stashed location to prevent UAF issues. Use...

CVE-2024-46800 sch/netem: fix use after free in netem_dequeue

In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netemdequeue If netemdequeue enqueues packet to inner qdisc and that qdisc returns NETXMITSTOLEN. The packet is dropped but qdisctreereducebacklog is not called to update the parent's q.qlen,...

CVE-2024-46800 sch/netem: fix use after free in netem_dequeue

In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netemdequeue If netemdequeue enqueues packet to inner qdisc and that qdisc returns NETXMITSTOLEN. The packet is dropped but qdisctreereducebacklog is not called to update the parent's q.qlen,...

CVE-2024-46800

CVE-2024-46800 affects the Linux kernel's netem (sch/netem) code. The issue is a use-after-free in netem_dequeue when enqueuing a packet to an inner qdisc that later returns __NET_XMIT_STOLEN; the packet is dropped but qdisc_tree_reduce_backlog() may not update the parent q.len, causing a use-aft...