CVE-2024-35954

{"id": "CVE-2024-35954", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35954", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T17:01:34.449905Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "db59133e927916d8a25ee1fd8264f2808040909d", "lessThan": "46af9047523e2517712ae8e71d984286c626e022", "versionType": "git"}, {"status": "affected", "version": "db59133e927916d8a25ee1fd8264f2808040909d", "lessThan": "b0d1ebcc1a9560e494ea9b3ee808540db26c5086", "versionType": "git"}, {"status": "affected", "version": "db59133e927916d8a25ee1fd8264f2808040909d", "lessThan": "27f58c04a8f438078583041468ec60597841284d", "versionType": "git"}, {"status": "affected", "version": "4cc664e59bf2553771e4c9e90f758f7434cfdc22", "versionType": "git"}, {"status": "affected", "version": "6.4.7", "lessThan": "6.5", "versionType": "semver"}], "programFiles": ["drivers/scsi/sg.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.28", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.7", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/scsi/sg.c"], "defaultStatus": "affected"}]}], "published": "2024-05-20T10:15:10.780", "references": [{"url": "https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284d", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Avoid sg device teardown race\n\nsg_remove_sfp_usercontext() must not use sg_device_destroy() after calling\nscsi_device_put().\n\nsg_device_destroy() is accessing the parent scsi_device request_queue which\nwill already be set to NULL when the preceding call to scsi_device_put()\nremoved the last reference to the parent scsi_device.\n\nThe resulting NULL pointer exception will then crash the kernel."}, {"lang": "es", "value": " En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: scsi: sg: Evite la ejecuci\u00f3n de desmontaje del dispositivo sg sg_remove_sfp_usercontext() no debe usar sg_device_destroy() despu\u00e9s de llamar a scsi_device_put(). sg_device_destroy() est\u00e1 accediendo al scsi_device principal request_queue que ya estar\u00e1 configurado en NULL cuando la llamada anterior a scsi_device_put() elimin\u00f3 la \u00faltima referencia al scsi_device principal. La excepci\u00f3n de puntero NULL resultante bloquear\u00e1 el kernel."}], "lastModified": "2026-06-17T07:35:47.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B86F4EE1-72C4-46B3-A0E8-2532E186FFC4", "versionEndExcluding": "6.6.28", "versionStartIncluding": "6.4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "531BDFB5-EF6A-4707-902E-146368303499", "versionEndExcluding": "6.8.7", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}