CVE-2024-36919 — Improper Locking in Linux

CWE-667 — Improper Locking40 documents6 sources
Severity
5.5MEDIUMNVD
OSV7.8OSV6.5
EPSS
0.0%
top 98.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
LinuxLinux KernelDebian Linux+1 more
Timeline
PublishedMay 30
Latest updateSep 18

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as these fields won't be used any longer. The offload and upload calls are sequential, hence lock is not required. This will suppress following BUG_ON(): [ 449.843143] ------------[ cut here ]--------…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶NVDlinux/linux_kernel3.1 — 4.19.314+7
▶Debianlinux/linux_kernel< 5.10.218-1+3
▶Ubuntulinux/linux_kernel< 5.4.0-192.212+2
▶CVEListV5linux/linux619c5cb6885b936c44ae1422ef805b69c6291485 — 468f3e3c15076338367b0945b041105b67cf31e3+8
▶debiandebian/linux< linux 6.1.94-1 (bookworm)

Also affects: Debian Linux 10.0

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

19
OSV
linux-xilinx-zynqmp vulnerabilities↗2024-09-18
▶
OSV
linux-raspi-5.4 vulnerabilities↗2024-08-22
▶
OSV
linux-hwe-5.15 vulnerabilities↗2024-08-21
▶
OSV
linux-bluefield vulnerabilities↗2024-08-21
▶
OSV
linux-azure-5.4 vulnerabilities↗2024-08-19
▶

📋Vendor Advisories

19
Ubuntu
Linux kernel vulnerabilities↗2024-09-18
▶
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities↗2024-08-22
▶
Ubuntu
Linux kernel (HWE) vulnerabilities↗2024-08-21
▶
Ubuntu
Linux kernel (BlueField) vulnerabilities↗2024-08-21
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2024-08-19
▶

💬Community

1
Bugzilla
CVE-2024-36919 kernel: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload↗2024-06-03
▶