CVE-2024-41001

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41001
In the Linux kernel, the following vulnerability has been resolved: io_uring/sqpoll: work around a potential audit memory leak kmemleak complains that there's a memory leak related to connect handling: unreferenced object 0xffff0001093bdf00 (size 128): comm "iou-sqp-455", pid 457, jiffies 4294894164 hex dump (first 32 bytes): 02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 2e481b1a): [<00000000c0a26af4>] kmemleak_alloc+0x30/0x38 [<000000009c30bb45>] kmalloc_trace+0x228/0x358 [<000000009da9d39f>] __audit_sockaddr+0xd0/0x138 [<0000000089a93e34>] move_addr_to_kernel+0x1a0/0x1f8 [<000000000b4e80e6>] io_connect_prep+0x1ec/0x2d4 [<00000000abfbcd99>] io_submit_sqes+0x588/0x1e48 [<00000000e7c25e07>] io_sq_thread+0x8a4/0x10e4 [<00000000d999b491>] ret_from_fork+0x10/0x20 which can can happen if: 1) The command type does something on the prep side that triggers an audit call. 2) The thread hasn't done any operations before this that triggered an audit call inside ->issue(), where we have audit_uring_entry() and audit_uring_exit(). Work around this by issuing a blanket NOP operation before the SQPOLL does anything.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/55c22375cbaa24f77dd13f9ae0642915444a1227 Patch
https://git.kernel.org/stable/c/9e810bd995823786ea30543e480e8a573e5e5667 Patch
https://git.kernel.org/stable/c/a40e90d9304629002fb17200f7779823a81191d3 Patch
https://git.kernel.org/stable/c/c4ce0ab27646f4206a9eb502d6fe45cb080e1cae Patch
https://git.kernel.org/stable/c/55c22375cbaa24f77dd13f9ae0642915444a1227 Patch
https://git.kernel.org/stable/c/9e810bd995823786ea30543e480e8a573e5e5667 Patch
https://git.kernel.org/stable/c/a40e90d9304629002fb17200f7779823a81191d3 Patch
https://git.kernel.org/stable/c/c4ce0ab27646f4206a9eb502d6fe45cb080e1cae Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 09:32

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/55c22375cbaa24f77dd13f9ae0642915444a1227 - Patch () https://git.kernel.org/stable/c/55c22375cbaa24f77dd13f9ae0642915444a1227 - Patch
References () https://git.kernel.org/stable/c/9e810bd995823786ea30543e480e8a573e5e5667 - Patch () https://git.kernel.org/stable/c/9e810bd995823786ea30543e480e8a573e5e5667 - Patch
References () https://git.kernel.org/stable/c/a40e90d9304629002fb17200f7779823a81191d3 - Patch () https://git.kernel.org/stable/c/a40e90d9304629002fb17200f7779823a81191d3 - Patch
References () https://git.kernel.org/stable/c/c4ce0ab27646f4206a9eb502d6fe45cb080e1cae - Patch () https://git.kernel.org/stable/c/c4ce0ab27646f4206a9eb502d6fe45cb080e1cae - Patch

21 Aug 2024, 16:17

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: io_uring/sqpoll: solución alternativa a una posible pérdida de memoria de auditoría. kmemleak se queja de que hay una pérdida de memoria relacionada con el manejo de la conexión: objeto sin referencia 0xffff0001093bdf00 (tamaño 128): comm "iou-sqp-455 ", pid 457, jiffies 4294894164 volcado hexadecimal (primeros 32 bytes): 02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ retroceso (crc 2e481b1a): [&lt;00000000c0a26af4&gt;] kmemleak_alloc+0x30/0x38 [&lt;000000009c30bb45&gt;] kmalloc_trace+0x228/0x358 [&lt;000000009da9d39f&gt;] __audit_sockaddr+0xd0/0x138 [&lt;0000000089a93e34&gt;] move_addr_to_kernel+0x1a0/0x1f8 [&lt;000000000b4e80e6&gt;] connect_prep+0x1ec/0x2d4 [&lt;00000000abfbcd99&gt;] io_submit_sqes+0x588/0x1e48 [&lt;00000000e7c25e07&gt;] io_sq_thread+0x8a4/0x10e4 [&lt;00000000d999b491&gt;] ret_from_fork+0x10/0x20 lo que puede suceder si: 1) El tipo de comando hace algo en el lado de preparación que desencadena una llamada de auditoría. 2) El hilo no ha realizado ninguna operación antes de esto que haya desencadenado una llamada de auditoría dentro de -&gt;issue(), donde tenemos audit_uring_entry() y audit_uring_exit(). Evite esto emitiendo una operación NOP general antes de que SQPOLL haga algo.
References () https://git.kernel.org/stable/c/55c22375cbaa24f77dd13f9ae0642915444a1227 - () https://git.kernel.org/stable/c/55c22375cbaa24f77dd13f9ae0642915444a1227 - Patch
References () https://git.kernel.org/stable/c/9e810bd995823786ea30543e480e8a573e5e5667 - () https://git.kernel.org/stable/c/9e810bd995823786ea30543e480e8a573e5e5667 - Patch
References () https://git.kernel.org/stable/c/a40e90d9304629002fb17200f7779823a81191d3 - () https://git.kernel.org/stable/c/a40e90d9304629002fb17200f7779823a81191d3 - Patch
References () https://git.kernel.org/stable/c/c4ce0ab27646f4206a9eb502d6fe45cb080e1cae - () https://git.kernel.org/stable/c/c4ce0ab27646f4206a9eb502d6fe45cb080e1cae - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-401
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

12 Jul 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-12 13:15

Updated : 2024-11-21 09:32

NVD link : CVE-2024-41001

Mitre link : CVE-2024-41001

CVE.ORG link : CVE-2024-41001

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime