CVE-2024-35815
Assigner: Linux
Published: 2024-05-17T13:23:20.326Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion

The first kiocb_set_cancel_fn() argument may point at a struct kiocb
that is not embedded inside struct aio_kiocb. With the current code,
depending on the compiler, the req->ki_ctx read happens either before
the IOCB_AIO_RW test or after that test. Move the req->ki_ctx read such
that it is guaranteed that the IOCB_AIO_RW test happens first.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 337b543e274f
lessThan: 10ca82aff584
status: affected
versionType: git
version: b4eea7a05ee0
lessThan: 396dbbc18963
status: affected
versionType: git
version: ea1cd64d59f2
lessThan: 94eb0293703c
status: affected
versionType: git
version: d7b6fa97ec89
lessThan: a71cba07783a
status: affected
versionType: git
version: 18f614369def
lessThan: 18d5fc3c16cc
status: affected
versionType: git
version: e7e23fc5d5fe
lessThan: c01ed748847f
status: affected
versionType: git
version: 1dc7d74fe456
lessThan: 5c43d0041e3a
status: affected
versionType: git
version: b820de741ae4
lessThan: 961ebd120565
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 4.19.308
lessThan: 4.19.312
status: affected
versionType: custom
version: 5.4.270
lessThan: 5.4.274
status: affected
versionType: custom
version: 5.10.211
lessThan: 5.10.215
status: affected
versionType: custom
version: 5.15.150
lessThan: 5.15.154
status: affected
versionType: custom
version: 6.1.80
lessThan: 6.1.84
status: affected
versionType: custom
version: 6.6.19
lessThan: 6.6.24
status: affected
versionType: custom
version: 6.7.7
lessThan: 6.7.12
status: affected
versionType: custom
title: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
x_generator: engine: bippy-d175d3acf727