CVE-2024-35831

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35831
In the Linux kernel, the following vulnerability has been resolved: io_uring: Fix release of pinned pages when __io_uaddr_map fails Looking at the error path of __io_uaddr_map, if we fail after pinning the pages for any reasons, ret will be set to -EINVAL and the error handler won't properly release the pinned pages. I didn't manage to trigger it without forcing a failure, but it can happen in real life when memory is heavily fragmented.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0b6f39c175ba5f0ef72bdb3b9d2a06ad78621d62 Patch
https://git.kernel.org/stable/c/4d376d7ad62b6a8e8dfff56b559d9d275e5b9b3a Patch
https://git.kernel.org/stable/c/67d1189d1095d471ed7fa426c7e384a7140a5dd7 Patch
https://git.kernel.org/stable/c/712e2c8415f55a4a4ddaa98a430b87f624109f69 Patch
https://git.kernel.org/stable/c/0b6f39c175ba5f0ef72bdb3b9d2a06ad78621d62 Patch
https://git.kernel.org/stable/c/4d376d7ad62b6a8e8dfff56b559d9d275e5b9b3a Patch
https://git.kernel.org/stable/c/67d1189d1095d471ed7fa426c7e384a7140a5dd7 Patch
https://git.kernel.org/stable/c/712e2c8415f55a4a4ddaa98a430b87f624109f69 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc7:*:*:*:*:*:*
History

26 Sep 2025, 16:06

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0b6f39c175ba5f0ef72bdb3b9d2a06ad78621d62 - () https://git.kernel.org/stable/c/0b6f39c175ba5f0ef72bdb3b9d2a06ad78621d62 - Patch
References () https://git.kernel.org/stable/c/4d376d7ad62b6a8e8dfff56b559d9d275e5b9b3a - () https://git.kernel.org/stable/c/4d376d7ad62b6a8e8dfff56b559d9d275e5b9b3a - Patch
References () https://git.kernel.org/stable/c/67d1189d1095d471ed7fa426c7e384a7140a5dd7 - () https://git.kernel.org/stable/c/67d1189d1095d471ed7fa426c7e384a7140a5dd7 - Patch
References () https://git.kernel.org/stable/c/712e2c8415f55a4a4ddaa98a430b87f624109f69 - () https://git.kernel.org/stable/c/712e2c8415f55a4a4ddaa98a430b87f624109f69 - Patch
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.6:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc7:*:*:*:*:*:*
CWE CWE-401

21 Nov 2024, 09:20

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring: corregida la liberación de páginas fijadas cuando falla __io_uaddr_map. Mirando la ruta de error de __io_uaddr_map, si fallamos después de fijar las páginas por cualquier motivo, ret se establecerá en -EINVAL y el El controlador de errores no libera correctamente las páginas fijadas. No logré activarlo sin forzar un fallo, pero puede suceder en la vida real cuando la memoria está muy fragmentada.
References () https://git.kernel.org/stable/c/0b6f39c175ba5f0ef72bdb3b9d2a06ad78621d62 - () https://git.kernel.org/stable/c/0b6f39c175ba5f0ef72bdb3b9d2a06ad78621d62 -
References () https://git.kernel.org/stable/c/4d376d7ad62b6a8e8dfff56b559d9d275e5b9b3a - () https://git.kernel.org/stable/c/4d376d7ad62b6a8e8dfff56b559d9d275e5b9b3a -
References () https://git.kernel.org/stable/c/67d1189d1095d471ed7fa426c7e384a7140a5dd7 - () https://git.kernel.org/stable/c/67d1189d1095d471ed7fa426c7e384a7140a5dd7 -
References () https://git.kernel.org/stable/c/712e2c8415f55a4a4ddaa98a430b87f624109f69 - () https://git.kernel.org/stable/c/712e2c8415f55a4a4ddaa98a430b87f624109f69 -

17 May 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-17 14:15

Updated : 2025-09-26 16:06

NVD link : CVE-2024-35831

Mitre link : CVE-2024-35831

CVE.ORG link : CVE-2024-35831

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime