CVE-2024-26838

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26838
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix KASAN issue with tasklet KASAN testing revealed the following issue assocated with freeing an IRQ. [50006.466686] Call Trace: [50006.466691] <IRQ> [50006.489538] dump_stack+0x5c/0x80 [50006.493475] print_address_description.constprop.6+0x1a/0x150 [50006.499872] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.505742] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.511644] kasan_report.cold.11+0x7f/0x118 [50006.516572] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.522473] irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.528232] irdma_process_ceq+0xb2/0x400 [irdma] [50006.533601] ? irdma_hw_flush_wqes_callback+0x370/0x370 [irdma] [50006.540298] irdma_ceq_dpc+0x44/0x100 [irdma] [50006.545306] tasklet_action_common.isra.14+0x148/0x2c0 [50006.551096] __do_softirq+0x1d0/0xaf8 [50006.555396] irq_exit_rcu+0x219/0x260 [50006.559670] irq_exit+0xa/0x20 [50006.563320] smp_apic_timer_interrupt+0x1bf/0x690 [50006.568645] apic_timer_interrupt+0xf/0x20 [50006.573341] </IRQ> The issue is that a tasklet could be pending on another core racing the delete of the irq. Fix by insuring any scheduled tasklet is killed after deleting the irq.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc Patch
https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824 Patch
https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa Patch
https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb Patch
https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848 Patch
https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc Patch
https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824 Patch
https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa Patch
https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb Patch
https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
History

02 Apr 2025, 13:18

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-416
CPE cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc - () https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc - Patch
References () https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824 - () https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824 - Patch
References () https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa - () https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa - Patch
References () https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb - () https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb - Patch
References () https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848 - () https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848 - Patch

21 Nov 2024, 09:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc - () https://git.kernel.org/stable/c/0ae8ad0013978f7471f22bcf45b027393e87f5dc -
References () https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824 - () https://git.kernel.org/stable/c/635d79aa477f9912e602feb5498bdd51fb9cb824 -
References () https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa - () https://git.kernel.org/stable/c/b2e4a5266e3d133b4c7f0e43bf40d13ce14fd1aa -
References () https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb - () https://git.kernel.org/stable/c/bd97cea7b18a0a553773af806dfbfac27a7c4acb -
References () https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848 - () https://git.kernel.org/stable/c/c6f1ca235f68b22b3e691b2ea87ac285e5946848 -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: RDMA/irdma: solucione el problema de KASAN con el tasklet Las pruebas de KASAN revelaron el siguiente problema asociado con la liberación de una IRQ. [50006.466686] Seguimiento de llamadas: [50006.466691] [50006.489538] dump_stack+0x5c/0x80 [50006.493475] print_address_description.constprop.6+0x1a/0x150 [50006.499872] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.505742] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.511644] kasan_report.cold.11+0x7f/0x118 [50006.516572] ? irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.522473] irdma_sc_process_ceq+0x483/0x790 [irdma] [50006.528232] irdma_process_ceq+0xb2/0x400 [irdma] [50006.536.53601 irdma_hw_flush_wqes_callback+0x370/0x370 [irdma] [50006.540298] irdma_ceq_dpc+0x44/0x100 [irdma] [50006.545306] tasklet_action_common.isra.14+0x148/0x2c0 [50006.551096 ] __do_softirq+0x1d0/0xaf8 [50006.555396] irq_exit_rcu+0x219/0x260 [50006.559670] irq_exit+0xa/0x20 [50006.563320] smp_apic_timer_interrupt+0x1bf/0x690 [50006.568645] apic_timer_interrupt+0xf/0x20 [50006.573341] El problema es que un tasklet podría estar pendiente en otro núcleo acelerando la eliminación del irq. Solución asegurándose de que cualquier tasklet programado se elimine después de eliminar el irq.

17 Apr 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-17 10:15

Updated : 2025-04-02 13:18

NVD link : CVE-2024-26838

Mitre link : CVE-2024-26838

CVE.ORG link : CVE-2024-26838

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free