CVE-2024-49981

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-49981
In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free bug in venus_remove due to race condition in venus_probe, core->work is bound with venus_sys_error_handler, which is used to handle error. The code use core->sys_err_done to make sync work. The core->work is started in venus_event_notify. If we call venus_remove, there might be an unfished work. The possible sequence is as follows: CPU0 CPU1 |venus_sys_error_handler venus_remove | hfi_destroy | venus_hfi_destroy | kfree(hdev); | |hfi_reinit |venus_hfi_queues_reinit |//use hdev Fix it by canceling the work in venus_remove.

7.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/10941d4f99a5a34999121b314afcd9c0a1c14f15 Patch
https://git.kernel.org/stable/c/2a541fcc0bd2b05a458e9613376df1289ec11621 Patch
https://git.kernel.org/stable/c/5098b9e6377577fe13d03e1d8914930f014a3314
https://git.kernel.org/stable/c/60b6968341a6dd5353554f3e72db554693a128a5 Patch
https://git.kernel.org/stable/c/63bbe26471ebdcc3c20bb4cc3950d666279ad658
https://git.kernel.org/stable/c/b0686aedc5f1343442d044bd64eeac7e7a391f4e Patch
https://git.kernel.org/stable/c/bf6be32e2d39f6301ff1831e249d32a8744ab28a Patch
https://git.kernel.org/stable/c/c5a85ed88e043474161bbfe54002c89c1cb50ee2 Patch
https://git.kernel.org/stable/c/d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

08 Nov 2024, 16:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/5098b9e6377577fe13d03e1d8914930f014a3314 -
  • () https://git.kernel.org/stable/c/63bbe26471ebdcc3c20bb4cc3950d666279ad658 -

25 Oct 2024, 14:56

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/10941d4f99a5a34999121b314afcd9c0a1c14f15 - () https://git.kernel.org/stable/c/10941d4f99a5a34999121b314afcd9c0a1c14f15 - Patch
References () https://git.kernel.org/stable/c/2a541fcc0bd2b05a458e9613376df1289ec11621 - () https://git.kernel.org/stable/c/2a541fcc0bd2b05a458e9613376df1289ec11621 - Patch
References () https://git.kernel.org/stable/c/60b6968341a6dd5353554f3e72db554693a128a5 - () https://git.kernel.org/stable/c/60b6968341a6dd5353554f3e72db554693a128a5 - Patch
References () https://git.kernel.org/stable/c/b0686aedc5f1343442d044bd64eeac7e7a391f4e - () https://git.kernel.org/stable/c/b0686aedc5f1343442d044bd64eeac7e7a391f4e - Patch
References () https://git.kernel.org/stable/c/bf6be32e2d39f6301ff1831e249d32a8744ab28a - () https://git.kernel.org/stable/c/bf6be32e2d39f6301ff1831e249d32a8744ab28a - Patch
References () https://git.kernel.org/stable/c/c5a85ed88e043474161bbfe54002c89c1cb50ee2 - () https://git.kernel.org/stable/c/c5a85ed88e043474161bbfe54002c89c1cb50ee2 - Patch
References () https://git.kernel.org/stable/c/d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c - () https://git.kernel.org/stable/c/d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c - Patch
First Time Linux linux Kernel
Linux
CWE CWE-416
CWE-362
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.0

23 Oct 2024, 15:13

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: venus: se corrige el error de use after free en venus_remove debido a la condición de ejecución en venus_probe, core->work está vinculado con venus_sys_error_handler, que se usa para manejar el error. El código usa core->sys_err_done para que funcione la sincronización. El core->work se inicia en venus_event_notify. Si llamamos a venus_remove, puede haber un trabajo sin pescar. La secuencia posible es la siguiente: CPU0 CPU1 |venus_sys_error_handler venus_remove | hfi_destroy | venus_hfi_destroy | kfree(hdev); | |hfi_reinit |venus_hfi_queues_reinit |//use hdev Arréglelo cancelando el trabajo en venus_remove.

21 Oct 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-21 18:15

Updated : 2024-11-08 16:15

NVD link : CVE-2024-49981

Mitre link : CVE-2024-49981

CVE.ORG link : CVE-2024-49981

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-416

Use After Free