CVE-2024-35954
published 2024-05-20CVE-2024-35954: In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Avoid sg device teardown race sg_remove_sfp_usercontext() must not use…
PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.24%
15.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Avoid sg device teardown race
sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling
scsi_device_put().
sg_device_destroy() is accessing the parent scsi_device request_queue which
will already be set to NULL when the preceding call to scsi_device_put()
removed the last reference to the parent scsi_device.
The resulting NULL pointer exception will then crash the kernel.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.8.9-1 (forky) | linux 6.8.9-1 (forky) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 6.4.7 < 6.5 | 6.5 |
| linux | linux | >= db59133e927916d8a25ee1fd8264f2808040909d < 46af9047523e2517712ae8e71d984286c626e022 | 46af9047523e2517712ae8e71d984286c626e022 |
| linux | linux | >= db59133e927916d8a25ee1fd8264f2808040909d < b0d1ebcc1a9560e494ea9b3ee808540db26c5086 | b0d1ebcc1a9560e494ea9b3ee808540db26c5086 |
| linux | linux | >= db59133e927916d8a25ee1fd8264f2808040909d < 27f58c04a8f438078583041468ec60597841284d | 27f58c04a8f438078583041468ec60597841284d |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.8.9-1 | 6.8.9-1 |
| linux | linux_kernel | >= 0 < 6.8.9-1 | 6.8.9-1 |
| linux | linux_kernel | >= 0 < 6.8.0-38.38 | 6.8.0-38.38 |
| linux | linux_kernel | >= 6.4.7 < 6.6.28 | 6.6.28 |
| linux | linux_kernel | >= 6.7 < 6.8.7 | 6.8.7 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.8MEDIUM
vendor_debian4.7LOW
vendor_redhat4.7MEDIUM
vendor_ubuntu4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.6.27/6.8.6 scsi sg_remove_sfp_usercontext null pointer dereference (46af9047523e/b0d1ebcc1a95/27f58c04a8f4 / EUVD-2024-35672)
vuldb·2026-08-06·CVSS 4.7
CVE-2024-35954 [MEDIUM] Linux Kernel up to 6.6.27/6.8.6 scsi sg_remove_sfp_usercontext null pointer dereference (46af9047523e/b0d1ebcc1a95/27f58c04a8f4 / EUVD-2024-35672)
A vulnerability was found in Linux Kernel up to 6.6.27/6.8.6. It has been rated as critical. Affected by this vulnerability is the function sg_remove_sfp_usercontext of the component scsi. The manipulation leads to null pointer dereference.
This vulnerability is referenced as CVE-2024-35954. The attack needs to be initiated within the local network. No exploit is available.
Upgrading the affected component is advised.
OSV
linux-oracle vulnerabilities
osv·2024-07-26
linux-oracle vulnerabilities
linux-oracle vulnerabilities
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- Cryptographic API;
- Buffer Sharing and Synchronization framew
OSV
linux-aws vulnerabilities
osv·2024-07-23·CVSS 6.8
CVE-2024-24857 [MEDIUM] linux-aws vulnerabilities
linux-aws vulnerabilities
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- Cryptographic AP
OSV
linux-gke, linux-nvidia vulnerabilities
osv·2024-07-16·CVSS 6.8
CVE-2024-24857 [MEDIUM] linux-gke, linux-nvidia vulnerabilities
linux-gke, linux-nvidia vulnerabilities
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- Cr
OSV
linux, linux-azure, linux-gcp, linux-ibm, linux-intel, linux-lowlatency, linux-oem-6.8, linux-raspi vulnerabilities
osv·2024-07-11·CVSS 6.8
CVE-2024-24857 [MEDIUM] linux, linux-azure, linux-gcp, linux-ibm, linux-intel, linux-lowlatency, linux-oem-6.8, linux-raspi vulnerabilities
linux, linux-azure, linux-gcp, linux-ibm, linux-intel, linux-lowlatency, linux-oem-6.8, linux-raspi vulnerabilities
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
-
GHSA
GHSA-v35f-xcmj-3g2x: In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Avoid sg device teardown race
sg_remove_sfp_usercontext() must not use
ghsa_unreviewed·2024-05-20
CVE-2024-35954 GHSA-v35f-xcmj-3g2x: In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Avoid sg device teardown race
sg_remove_sfp_usercontext() must not use
In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Avoid sg device teardown race
sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling
scsi_device_put().
sg_device_destroy() is accessing the parent scsi_device request_queue which
will already be set to NULL when the preceding call to scsi_device_put()
removed the last reference to the parent scsi_device.
The resulting NULL pointer exception will then crash the kernel.
OSV
CVE-2024-35954: In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Avoid sg device teardown race sg_remove_sfp_usercontext() must not use s
osv·2024-05-20·CVSS 4.7
CVE-2024-35954 [MEDIUM] CVE-2024-35954: In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Avoid sg device teardown race sg_remove_sfp_usercontext() must not use s
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Avoid sg device teardown race sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling scsi_device_put(). sg_device_destroy() is accessing the parent scsi_device request_queue which will already be set to NULL when the preceding call to scsi_device_put() removed the last reference to the parent scsi_device. The resulting NULL pointer exception will then crash the kernel.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-26
CVE-2024-35929 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framework and drivers;
- Data acquisition framework and
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-23·CVSS 4.6
CVE-2024-35967 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framewo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-16·CVSS 4.6
CVE-2024-35946 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framewo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-11·CVSS 4.6
CVE-2024-35977 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- Accessibility subsystem;
- Android drivers;
- Drivers core;
- Bluetooth drivers;
- Clock framewo
Red Hat
kernel: scsi: sg: Avoid sg device teardown race
vendor_redhat·2024-05-20·CVSS 4.7
CVE-2024-35954 [MEDIUM] kernel: scsi: sg: Avoid sg device teardown race
kernel: scsi: sg: Avoid sg device teardown race
In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Avoid sg device teardown race
sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling
scsi_device_put().
sg_device_destroy() is accessing the parent scsi_device request_queue which
will already be set to NULL when the preceding call to scsi_device_put()
removed the last reference to the parent scsi_device.
The resulting NULL pointer exception will then crash the kernel.
The bug is about a race condition in the Linux kernel's SCSI generic (sg) driver. The problem occurs during the removal of devices when the driver accesses a resource (request_queue) that may have already been freed, leading to a NULL pointer dereference. This issue can result in
Debian
CVE-2024-35954: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: sg: A...
vendor_debian·2024·CVSS 4.7
CVE-2024-35954 [MEDIUM] CVE-2024-35954: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: sg: A...
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Avoid sg device teardown race sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling scsi_device_put(). sg_device_destroy() is accessing the parent scsi_device request_queue which will already be set to NULL when the preceding call to scsi_device_put() removed the last reference to the parent scsi_device. The resulting NULL pointer exception will then crash the kernel.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.8.9-1)
sid: resolved (fixed in 6.8.9-1)
trixie: resolved (fixed in 6.8.9-1)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284dhttps://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086https://git.kernel.org/stable/c/27f58c04a8f438078583041468ec60597841284dhttps://git.kernel.org/stable/c/46af9047523e2517712ae8e71d984286c626e022https://git.kernel.org/stable/c/b0d1ebcc1a9560e494ea9b3ee808540db26c5086
2024-05-20
Published