5.5

CVE-2024-42250

cachefiles: add missing lock protection when polling

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: add missing lock protection when polling

Add missing lock protection in poll routine when iterating xarray,
otherwise:

Even with RCU read lock held, only the slot of the radix tree is
ensured to be pinned there, while the data structure (e.g. struct
cachefiles_req) stored in the slot has no such guarantee.  The poll
routine will iterate the radix tree and dereference cachefiles_req
accordingly.  Thus RCU read lock is not adequate in this case and
spinlock is needed here.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.8 < 6.9.10
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.06
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-667 Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

https://git.kernel.org/stable/c/6bb6bd3dd6f382dfd36220d4b210a0c77c066651
Patch
https://git.kernel.org/stable/c/8eadcab7f3dd809edbe5ae20533ff843dfea3a07
Patch
https://git.kernel.org/stable/c/97cfd5e20ddc2e33e16ce369626ce76c9a475fd7
Patch
https://git.kernel.org/stable/c/cf5bb09e742a9cf6349127e868329a8f69b7a014
Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html