Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-35855 State: PUBLISHED Published: 2024-05-17T14:47:31.436Z Last Updated: 2025-05-04T09:06:55.614Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update The rule activity update delayed work periodically traverses the list of configured rules and queries their activity from the device. As part of this task it accesses the entry pointed by 'ventry->entry', but this entry can be changed concurrently by the rehash delayed work, leading to a use-after-free [1]. Fix by closing the race and perform the activity query under the 'vregion->lock' mutex.
leading to a use-after-free [1]. Fix by closing the race and perform the activity query under the 'vregion->lock' mutex. [1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181 CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 mlxsw_sp_acl_rule_activity_update_work+0x21
san_report+0xd7/0x110 mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 mlxsw_sp_acl_rule_activity_update_work+0x219/0x400 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 1039: kasan_save_stack+0x3
9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1b73f6e4ea770410a937a8db98f77e52594d23a0 - https://git.kernel.org/stable/c/e24d2487424779
ttps://git.kernel.org/stable/c/1b73f6e4ea770410a937a8db98f77e52594d23a0 - https://git.kernel.org/stable/c/e24d2487424779c02760ff50cd9021b8676e19ef - https://git.kernel.org/stable/c/c17976b42d546ee118ca300db559630ee96fb758 - https://git.kernel.org/stable/c/b996e8699da810e4c915841d6aaef761007f933a - https://git.kernel.org/stable/c/feabdac2057e863d0e140a2adf3d232eb4882db4 - https://git.kernel.org/stable/c/b183b915beef818a25e3154d719ca015a1ae0770 - https://git.kernel.org/stable/c/79b5b4b18bc85b19d3a518483f9abbbe6d7b3ba4
CVE ID: CVE-2024-35856 State: PUBLISHED Published: 2024-05-17T14:47:32.088Z Last Updated: 2025-05-04T09:06:57.177Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Fix double free of skb in coredump hci_devcd_append() would free the skb on error so the caller don't have to free it again otherwise it would cause the double free of skb. Reported-by : Dan Carpenter <dan.carpenter@linaro.org> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/80dfef128cb9f1b1ef67c0fe8c8deb4ea7ad30c1 - https://git.kernel.org/stable/c/e20093c741d8da9f6390
/git.kernel.org/stable/c/80dfef128cb9f1b1ef67c0fe8c8deb4ea7ad30c1 - https://git.kernel.org/stable/c/e20093c741d8da9f6390dd45d75b779861547035 - https://git.kernel.org/stable/c/18bdb386a1a30e7a3d7732a98e45e69cf6b5710d
CVE ID: CVE-2024-35857 State: PUBLISHED Published: 2024-05-17T14:47:32.763Z Last Updated: 2025-05-04T09:06:58.879Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() First problem is a double call to __in_dev_get_rcu(), because the second one could return NULL. if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list) Second problem is a read from dev->ip6_ptr with no NULL check: if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list)) Use the correct RCU API to fix these. v2: add missing include <net/addrconf.h> Additional Analyst Notes: - CISA ADP Vulnrichmen
correct RCU API to fix these. v2: add missing include <net/addrconf.h> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/23b7ee4a8d559bf38eac7ce5bb2f6ebf76f9c401 - https://git.kernel.org/stable/c/599c9ad5e1d43f5c12d869f5fd406ba5d8c55270 - https://git.kernel.org/stable/c/d68dc711d84fdcf698e5d45308c3ddeede586350 - https://git.kernel.org/stable/c/3e2979bf080c40da4f7c93aff8575ab8bc62b767 - https://git.kernel.org/stable/c/c58e88d49097bd12dfcfef4f075b43f5d5830941
CVE ID: CVE-2024-35858 State: PUBLISHED Published: 2024-05-17T14:47:33.401Z Last Updated: 2025-05-04T09:07:00.291Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix memory leak when bringing down interface When bringing down the TX rings we flush the rings but forget to reclaimed the flushed packets. This leads to a memory leak since we do not free the dma mapped buffers. This also leads to tx control block corruption when bringing down the interface for power management. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/09040baf8779ad880e0e0d
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/09040baf8779ad880e0e0d0ea10e57aa929ef3ab - https://git.kernel.org/stable/c/2389ad1990163d29cba5480d693b4c2e31cc545c - https://git.kernel.org/stable/c/9f898fc2c31fbf0ac5ecd289f528a716464cb005
CVE ID: CVE-2024-35859 State: PUBLISHED Published: 2024-05-17T14:47:34.057Z Last Updated: 2025-05-04T09:07:01.613Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block: fix module reference leakage from bdev_open_by_dev error path At the time bdev_may_open() is called, module reference is grabbed already, hence module reference should be released if bdev_may_open() failed. This problem is found by code review. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0e9327c67410b129bf85e5c3a5aaea518328636f - https://git.kernel.org/stable/c/9617cd6f24b294552a817f80
.kernel.org/stable/c/0e9327c67410b129bf85e5c3a5aaea518328636f - https://git.kernel.org/stable/c/9617cd6f24b294552a817f80f5225431ef67b540
CVE ID: CVE-2024-35860 State: PUBLISHED Published: 2024-05-19T08:34:19.368Z Last Updated: 2025-05-04T09:07:03.105Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: support deferring bpf_link dealloc to after RCU grace period BPF link for some program types is passed as a "context" which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and multi-uprobes, link is used to fetch BPF cookie values. Because of this runtime dependency, when bpf_link refcnt drops to zero there could still be active BPF programs running accessing link data. This patch adds generic support to defer bpf_link
there could still be active BPF programs running accessing link data. This patch adds generic support to defer bpf_link dealloc callback to after RCU GP, if requested. This is done by exposing two different deallocation callbacks, one synchronous and one deferred. If deferred one is provided, bpf_link_free() will schedule dealloc_deferred() callback to happen after RCU GP. BPF is using two flavors of RCU: "classic" non-sleepable one and RCU tasks trace one. The latter is used when sleepable BPF programs are used. bpf_link_free() accommodates that by checking underlying BPF program's sleepable flag, and goes either through normal RCU GP only for non-sleepable, or through RCU tasks trace GP *a
program's sleepable flag, and goes either through normal RCU GP only for non-sleepable, or through RCU tasks trace GP *and* then normal RCU GP (taking into account rcu_trace_implies_rcu_gp() optimization), if BPF program is sleepable. We use this for multi-kprobe and multi-uprobe links, which dereference link during program run. We also preventively switch raw_tp link to use deferred dealloc callback, as upcoming changes in bpf-next tree expose raw_tp link data (specifically, cookie value) to BPF program at runtime as well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97 - https
- CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97 - https://git.kernel.org/stable/c/5d8d447777564b35f67000e7838e7ccb64d525c8 - https://git.kernel.org/stable/c/1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce
CVE ID: CVE-2024-35861 State: PUBLISHED Published: 2024-05-19T08:34:20.364Z Last Updated: 2025-05-04T09:07:04.611Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7e8360ac8774e19b0b25f44fff84a105bb2417e4 - https://git.kernel.org/stable/c/2cfff21732132e363b4cc275d63ea98f1af726c1 - https://git.kernel.org/stable/c/f9a96a7ad1e8d25dc6662bc7552e0752de74a20d - https://git
2132e363b4cc275d63ea98f1af726c1 - https://git.kernel.org/stable/c/f9a96a7ad1e8d25dc6662bc7552e0752de74a20d - https://git.kernel.org/stable/c/e0e50401cc3921c9eaf1b0e667db174519ea939f
CVE ID: CVE-2024-35862 State: PUBLISHED Published: 2024-05-19T08:34:21.173Z Last Updated: 2025-05-04T09:07:05.818Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_network_name_deleted() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f9414004798d9742c1af23a1d839fe6a9503751c - https://git.kernel.org/stable/c/aa582b33f94453fdeaff1e7d0aa252c505975e01 - https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645 - https://git.ke
53fdeaff1e7d0aa252c505975e01 - https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645 - https://git.kernel.org/stable/c/63981561ffd2d4987807df4126f96a11e18b0c1d
CVE ID: CVE-2024-35863 State: PUBLISHED Published: 2024-05-19T08:34:22.114Z Last Updated: 2025-05-04T09:07:06.972Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/494c91e1e9413b407d12166a61b84200d4d54fac - https://git.kernel.org/stable/c/0a15ba88a32fa7a516aff7ffd27befed5334dff2 - https://git.kernel.org/stable/c/16d58c6a7db5050b9638669084b63fc05f951825 - https://git.kernel.or
ff7ffd27befed5334dff2 - https://git.kernel.org/stable/c/16d58c6a7db5050b9638669084b63fc05f951825 - https://git.kernel.org/stable/c/69ccf040acddf33a3a85ec0f6b45ef84b0f7ec29
CVE ID: CVE-2024-35864 State: PUBLISHED Published: 2024-05-19T08:34:22.936Z Last Updated: 2025-05-04T09:07:08.626Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_lease_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c868cabdf6fdd61bea54532271f4708254e57fc5 - https://git.kernel.org/stable/c/f92739fdd4522c4291277136399353d7c341fae4 - https://git.kernel.org/stable/c/a8344e2b69bde63f713b0aa796d70dbeadffddfb - https://git.kerne
291277136399353d7c341fae4 - https://git.kernel.org/stable/c/a8344e2b69bde63f713b0aa796d70dbeadffddfb - https://git.kernel.org/stable/c/705c76fbf726c7a2f6ff9143d4013b18daaaebf1
CVE ID: CVE-2024-35865 State: PUBLISHED Published: 2024-05-19T08:34:23.853Z Last Updated: 2025-05-04T09:07:09.907Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/84488466b7a69570bdbf76dd9576847ab97d54e7 - https://git.kernel.org/stable/c/21fed37d2bdcde33453faf61d3d4d96c355f04bd - https://git.kernel.org/stable/c/3dba0e5276f131e36d6d8043191d856f49238628 - https://git.kern
33453faf61d3d4d96c355f04bd - https://git.kernel.org/stable/c/3dba0e5276f131e36d6d8043191d856f49238628 - https://git.kernel.org/stable/c/22863485a4626ec6ecf297f4cc0aef709bc862e4
CVE ID: CVE-2024-35866 State: PUBLISHED Published: 2024-05-19T08:34:24.877Z Last Updated: 2025-11-03T19:29:56.706Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_dump_full_key() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d798fd98e3563027c5162259ead517057d6fa794 - https://git.kernel.org/stable/c/f4a60d360d9114b5085701a3702a0102b0d6d846 - https://git.kernel.org/stable/c/10e17ca4000ec34737bde002a13435c38ace2682 - https://git.kernel.org/s
a3702a0102b0d6d846 - https://git.kernel.org/stable/c/10e17ca4000ec34737bde002a13435c38ace2682 - https://git.kernel.org/stable/c/3103163ccd3be4adcfa37e15608fb497be044113 - https://git.kernel.org/stable/c/58acd1f497162e7d282077f816faa519487be045
CVE ID: CVE-2024-35867 State: PUBLISHED Published: 2024-05-19T08:34:25.911Z Last Updated: 2025-11-03T19:29:58.093Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/838ec01ea8d3deb5d123e8ed9022e8162dc3f503 - https://git.kernel.org/stable/c/bb6570085826291dc392005f9fec16ea5da3c8ad - https://git.kernel.org/stable/c/16b7d785775eb03929766819415055e367398f49 - https://git.kernel.org
005f9fec16ea5da3c8ad - https://git.kernel.org/stable/c/16b7d785775eb03929766819415055e367398f49 - https://git.kernel.org/stable/c/c3cf8b74c57924c0985e49a1fdf02d3395111f39 - https://git.kernel.org/stable/c/1e12f0d5c66f07c934041621351973a116fa13c7 - https://git.kernel.org/stable/c/0865ffefea197b437ba78b5dd8d8e256253efd65
CVE ID: CVE-2024-35868 State: PUBLISHED Published: 2024-05-19T08:34:26.806Z Last Updated: 2025-05-04T09:07:14.108Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_write() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8fefd166fcb368c5fcf48238e3f7c8af829e0a72 - https://git.kernel.org/stable/c/cf03020c56d3ed28c4942280957a007b5e9544f7 - https://git.kernel.org/stable/c/5b5475ce69f02ecc1b13ea23106e5b89c690429b - https://git.kernel.or
42280957a007b5e9544f7 - https://git.kernel.org/stable/c/5b5475ce69f02ecc1b13ea23106e5b89c690429b - https://git.kernel.org/stable/c/d3da25c5ac84430f89875ca7485a3828150a7e0a
CVE ID: CVE-2024-35869 State: PUBLISHED Published: 2024-05-19T08:34:27.645Z Last Updated: 2025-05-04T09:07:15.865Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at it, too. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/645f332c6b
nalyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc - https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79 - https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a
CVE ID: CVE-2024-35870 State: PUBLISHED Published: 2024-05-19T08:34:28.419Z Last Updated: 2025-11-03T20:37:37.141Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2_reconnect_server() The UAF bug is due to smb2_reconnect_server() accessing a session that is already being teared down by another thread that is executing __cifs_put_smb_ses(). This can happen when (a) the client has connection to the server but no session or (b) another thread ends up setting @ses->ses_status again to something different than SES_EXITING. To fix this, we need to make sure to unconditionally set @ses->ses_status to SES_EXIT
ething different than SES_EXITING. To fix this, we need to make sure to unconditionally set @ses->ses_status to SES_EXITING and prevent any other threads from setting a new status while we're still tearing it down. The following can be reproduced by adding some delay to right after the ipc is freed in __cifs_put_smb_ses() - which will give smb2_reconnect_server() worker a chance to run and then accessing @ses->ipc: kinit ... mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10 [disconnect srv] ls /mnt/1 &>/dev/null sleep 30 kdestroy [reconnect srv] sleep 10 umount /mnt/1 ... CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in
10 umount /mnt/1 ... CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0 Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad de 48 39 c2 74 61 48 b8 22 01
d_or_report+0x33/0xf0 Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75 7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8 RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83 RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800 RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000 R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000 FS: 0000000000000000(0000) GS:ffff888157c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 00000000800
FS: 0000000000000000(0000) GS:ffff888157c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? die_addr+0x36/0x90 ? exc_general_protection+0x1c1/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? __list_del_entry_valid_or_report+0x33/0xf0 __cifs_put_smb_ses+0x1ae/0x500 [cifs] smb2_reconnect_server+0x4ed/0x710 [cifs] process_one_work+0x205/0x6b0 worker_thread+0x191/0x360 ? __pfx_worker_thread+0x10/0x10 kthread+0xe2/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Additional Analyst Notes: - CISA AD
et_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/755fe68cd4b59e1d2a2dd3286177fd4404f57fed - https://git.kernel.org/stable/c/6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0 - https://git.kernel.org/stable/c/45f2beda1f1bc3d962ec07db1ccc3197c25499a5 - https://git.kernel.org/stable/c/24a9799aa8efecd0eb55a75e35f9d8e6400063aa
CVE ID: CVE-2024-35871 State: PUBLISHED Published: 2024-05-19T08:34:29.292Z Last Updated: 2025-05-04T09:07:18.449Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: riscv: process: Fix kernel gp leakage childregs represents the registers which are active for the new thread in user context. For a kernel thread, childregs->gp is never used since the kernel gp is not touched by switch_to. For a user mode helper, the gp value can be observed in user space after execve or possibly by other means. [From the email thread] The /* Kernel thread */ comment is somewhat inaccurate in that it is also used for user_mode_helper threads, which ex
d] The /* Kernel thread */ comment is somewhat inaccurate in that it is also used for user_mode_helper threads, which exec a user process, e.g. /sbin/init or when /proc/sys/kernel/core_pattern is a pipe. Such threads do not have PF_KTHREAD set and are valid targets for ptrace etc. even before they exec. childregs is the *user* context during syscall execution and it is observable from userspace in at least five ways: 1. kernel_execve does not currently clear integer registers, so the starting register state for PID 1 and other user processes started by the kernel has sp = user stack, gp = kernel __global_pointer$, all other integer registers zeroed by the memset in the patch comment. This is
ser stack, gp = kernel __global_pointer$, all other integer registers zeroed by the memset in the patch comment. This is a bug in its own right, but I'm unwilling to bet that it is the only way to exploit the issue addressed by this patch. 2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread before it execs, but ptrace requires SIGSTOP to be delivered which can only happen at user/kernel boundaries. 3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for user_mode_helpers before the exec completes, but gp is not one of the registers it returns. 4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel addresses via PERF_SAMPLE_REGS_I