CVE-2024-26617

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26617
In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Move mmu notification mechanism inside mm lock to prevent race condition in other components which depend on it. The notifier will invalidate memory range. Depending upon the number of iterations, different memory ranges would be invalidated. The following warning would be removed by this patch: WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 There is no behavioural and performance change with this patch when there is no component registered with the mmu notifier. [akpm@linux-foundation.org: narrow the scope of `range', per Sean]

7.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80 Patch
https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a Patch
https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80 Patch
https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

12 Dec 2024, 15:34

Type Values Removed Values Added
CWE CWE-362
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.0
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80 - () https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80 - Patch
References () https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a - () https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

21 Nov 2024, 09:02

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80 - () https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80 -
References () https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a - () https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a -

12 Mar 2024, 12:40

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/proc/task_mmu: mover el mecanismo de notificación mmu dentro del bloqueo mm Mueva el mecanismo de notificación mmu dentro del bloqueo mm para evitar condiciones de ejecución en otros componentes que dependen de él. El notificador invalidará el rango de memoria. Dependiendo del número de iteraciones, se invalidarían diferentes rangos de memoria. Este parche eliminaría la siguiente advertencia: ADVERTENCIA: CPU: 0 PID: 5067 en arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/ x86/kvm/../../../virt/kvm/kvm_main.c:734 No hay cambios de comportamiento ni de rendimiento con este parche cuando no hay ningún componente registrado con el notificador mmu. [akpm@linux-foundation.org: reduzca el alcance del `rango', según Sean]

11 Mar 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-11 18:15

Updated : 2024-12-12 15:34

NVD link : CVE-2024-26617

Mitre link : CVE-2024-26617

CVE.ORG link : CVE-2024-26617

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')