CVE-2024-56584

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56584
In the Linux kernel, the following vulnerability has been resolved: io_uring/tctx: work around xa_store() allocation error issue syzbot triggered the following WARN_ON: WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51 which is the WARN_ON_ONCE(!xa_empty(&tctx->xa)); sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with ->head being non-NULL even though no entries exist in the xarray. Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/42882b583095dcf747da6e3af1daeff40e27033e Patch
https://git.kernel.org/stable/c/7eb75ce7527129d7f1fee6951566af409a37a1c4 Patch
https://git.kernel.org/stable/c/94ad56f61b873ffeebcc620d451eacfbdf9d40f0 Patch
https://git.kernel.org/stable/c/d5b2ddf1f90c7248eff9630b95895c8950f2f36d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Oct 2025, 17:21

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/42882b583095dcf747da6e3af1daeff40e27033e - () https://git.kernel.org/stable/c/42882b583095dcf747da6e3af1daeff40e27033e - Patch
References () https://git.kernel.org/stable/c/7eb75ce7527129d7f1fee6951566af409a37a1c4 - () https://git.kernel.org/stable/c/7eb75ce7527129d7f1fee6951566af409a37a1c4 - Patch
References () https://git.kernel.org/stable/c/94ad56f61b873ffeebcc620d451eacfbdf9d40f0 - () https://git.kernel.org/stable/c/94ad56f61b873ffeebcc620d451eacfbdf9d40f0 - Patch
References () https://git.kernel.org/stable/c/d5b2ddf1f90c7248eff9630b95895c8950f2f36d - () https://git.kernel.org/stable/c/d5b2ddf1f90c7248eff9630b95895c8950f2f36d - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring/tctx: workaround al problema de error de asignación de xa_store() syzbot activó el siguiente WARN_ON: WARNING: CPU: 0 PID: 16 en io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51 que es la comprobación de cordura WARN_ON_ONCE(!xa_empty(&tctx->xa)); en __io_uring_free() cuando una io_uring_task está pasando por su put final. El caso de prueba de syzbot incluye la inyección de fallos de asignación de memoria, y parece que xa_store() puede fallar en una de sus asignaciones de memoria y terminar con ->head siendo distinto de NULL aunque no existan entradas en la matriz x. Hasta que se resuelva este problema, puede solucionarlo intentando iterar las entradas en nuestra matriz x y usar WARN_ON_ONCE() si encuentra alguna.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CWE CWE-770

27 Dec 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-27 15:15

Updated : 2025-10-07 17:21

NVD link : CVE-2024-56584

Mitre link : CVE-2024-56584

CVE.ORG link : CVE-2024-56584

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-770

Allocation of Resources Without Limits or Throttling