4.7

CVE-2024-26878

quota: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved:

quota: Fix potential NULL pointer dereference

Below race may cause NULL pointer dereference

P1					P2
dquot_free_inode			quota_off
					  drop_dquot_ref
					   remove_dquot_ref
					   dquots = i_dquot(inode)
  dquots = i_dquot(inode)
  srcu_read_lock
  dquots[cnt]) != NULL (1)
					     dquots[type] = NULL (2)
  spin_lock(&dquots[cnt]->dq_dqb_lock) (3)
   ....

If dquot_free_inode(or other routines) checks inode's quota pointers (1)
before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer
dereference will be triggered.

So let's fix it by using a temporary pointer to avoid this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 4.19.311
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.273
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.214
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.153
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.83
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.23
Linux ≫ Linux Kernel Version >= 6.7 < 6.7.11
Linux ≫ Linux Kernel Version >= 6.8 < 6.8.2
Debian ≫ Debian Linux Version10.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.19% 0.086
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.7 1 3.6
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Mailing List
https://git.kernel.org/stable/c/1ca72a3de915f87232c9a4cb9bebbd3af8ed3e25
Patch
https://git.kernel.org/stable/c/40a673b4b07efd6f74ff3ab60f38b26aa91ee5d5
Patch
https://git.kernel.org/stable/c/49669f8e7eb053f91d239df7b1bfb4500255a9d0
Patch
https://git.kernel.org/stable/c/61380537aa6dd32d8a723d98b8f1bd1b11d8fee0
Patch
https://git.kernel.org/stable/c/6afc9f4434fa8063aa768c2bf5bf98583aee0877
Patch
https://git.kernel.org/stable/c/7f9e833fc0f9b47be503af012eb5903086939754
Patch
https://git.kernel.org/stable/c/8514899c1a4edf802f03c408db901063aa3f05a1
Patch
https://git.kernel.org/stable/c/d0aa72604fbd80c8aabb46eda00535ed35570f1f
Patch
https://git.kernel.org/stable/c/f2649d98aa9ca8623149b3cb8df00c944f5655c7
Patch
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html