CVE-2024-38629

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-38629
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Avoid unnecessary destruction of file_ida file_ida is allocated during cdev open and is freed accordingly during cdev release. This sequence is guaranteed by driver file operations. Therefore, there is no need to destroy an already empty file_ida when the WQ cdev is removed. Worse, ida_free() in cdev release may happen after destruction of file_ida per WQ cdev. This can lead to accessing an id in file_ida after it has been destroyed, resulting in a kernel panic. Remove ida_destroy(&file_ida) to address these issues.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/15edb906211bf53e7b5574f7326ab734d6bff4f9 Patch
https://git.kernel.org/stable/c/76e43fa6a456787bad31b8d0daeabda27351a480 Patch
https://git.kernel.org/stable/c/9eb15f24a0b9b017b39cde8b8c07243676b63687 Patch
https://git.kernel.org/stable/c/15edb906211bf53e7b5574f7326ab734d6bff4f9 Patch
https://git.kernel.org/stable/c/76e43fa6a456787bad31b8d0daeabda27351a480 Patch
https://git.kernel.org/stable/c/9eb15f24a0b9b017b39cde8b8c07243676b63687 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Oct 2025, 14:53

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/15edb906211bf53e7b5574f7326ab734d6bff4f9 - () https://git.kernel.org/stable/c/15edb906211bf53e7b5574f7326ab734d6bff4f9 - Patch
References () https://git.kernel.org/stable/c/76e43fa6a456787bad31b8d0daeabda27351a480 - () https://git.kernel.org/stable/c/76e43fa6a456787bad31b8d0daeabda27351a480 - Patch
References () https://git.kernel.org/stable/c/9eb15f24a0b9b017b39cde8b8c07243676b63687 - () https://git.kernel.org/stable/c/9eb15f24a0b9b017b39cde8b8c07243676b63687 - Patch
CWE CWE-416
First Time Linux linux Kernel
Linux

21 Nov 2024, 09:26

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/15edb906211bf53e7b5574f7326ab734d6bff4f9 - () https://git.kernel.org/stable/c/15edb906211bf53e7b5574f7326ab734d6bff4f9 -
References () https://git.kernel.org/stable/c/76e43fa6a456787bad31b8d0daeabda27351a480 - () https://git.kernel.org/stable/c/76e43fa6a456787bad31b8d0daeabda27351a480 -
References () https://git.kernel.org/stable/c/9eb15f24a0b9b017b39cde8b8c07243676b63687 - () https://git.kernel.org/stable/c/9eb15f24a0b9b017b39cde8b8c07243676b63687 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: idxd: evita la destrucción innecesaria de file_ida file_ida se asigna durante la apertura de cdev y se libera en consecuencia durante el lanzamiento de cdev. Esta secuencia está garantizada por las operaciones del archivo del controlador. Por lo tanto, no es necesario destruir un file_ida que ya está vacío cuando se elimina WQ cdev. Peor aún, ida_free() en la versión cdev puede ocurrir después de la destrucción de file_ida según WQ cdev. Esto puede llevar a acceder a una identificación en file_ida después de haber sido destruida, lo que resulta en un pánico en el kernel. Elimine ida_destroy(&file_ida) para solucionar estos problemas.

21 Jun 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-21 11:15

Updated : 2025-10-03 14:53

NVD link : CVE-2024-38629

Mitre link : CVE-2024-38629

CVE.ORG link : CVE-2024-38629

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free