CVE-2024-42250Improper Locking in Linux

CWE-667Improper Locking25 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 88.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 7
Latest updateDec 12

Description

In the Linux kernel, the following vulnerability has been resolved: cachefiles: add missing lock protection when polling Add missing lock protection in poll routine when iterating xarray, otherwise: Even with RCU read lock held, only the slot of the radix tree is ensured to be pinned there, while the data structure (e.g. struct cachefiles_req) stored in the slot has no such guarantee. The poll routine will iterate the radix tree and dereference cachefiles_req accordingly. Thus RCU read lock i

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages6 packages

NVDlinux/linux_kernel6.86.9.10
Debianlinux/linux_kernel< 6.1.106-1+2
Ubuntulinux/linux_kernel< 6.8.0-48.48
CVEListV5linux/linux0e19a18f998dcabe8be590e0b39660a1f230209b97cfd5e20ddc2e33e16ce369626ce76c9a475fd7+4
debiandebian/linux< linux 6.1.106-1 (bookworm)

Patches

🔴Vulnerability Details

12
OSV
linux-gkeop vulnerabilities2024-12-12
OSV
linux-lowlatency, linux-lowlatency-hwe-6.8 vulnerabilities2024-11-19
OSV
linux-gke vulnerabilities2024-11-15
OSV
linux-raspi vulnerabilities2024-11-14
OSV
linux-oem-6.8 vulnerabilities2024-11-13

📋Vendor Advisories

12
Ubuntu
Linux kernel (GKE) vulnerabilities2024-12-12
Ubuntu
Linux kernel (Low Latency) vulnerabilities2024-11-19
Ubuntu
Linux kernel vulnerabilities2024-11-15
Ubuntu
Linux kernel vulnerabilities2024-11-14
Ubuntu
Linux kernel vulnerabilities2024-11-13