CVE-2024-38583
"Linux nilfs2 Timer Use-After-Free Vulnerability"
Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of timer for log writer thread Patch series "nilfs2: fix log writer related issues". This bug fix series covers three nilfs2 log writer-related issues, including a timer use-after-free issue and potential deadlock issue on unmount, and a potential freeze issue in event synchronization found during their analysis. Details are described in each commit log. This patch (of 3): A use-after-free issue has been reported regarding the timer sc_timer on the nilfs_sc_info structure. The problem is that even though it is used to wake up a sleeping log writer thread, sc_timer is not shut down until the nilfs_sc_info structure is about to be freed, and is used regardless of the thread's lifetime. Fix this issue by limiting the use of sc_timer only while the log writer thread is alive.
INFO
Published Date :
June 19, 2024, 2:15 p.m.
Last Modified :
Aug. 1, 2024, 7:51 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-38583.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-38583 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-38583 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Aug. 01, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Reference Type https://git.kernel.org/stable/c/2f12b2c03c5dae1a0de0a9e5853177e3d6eee3c6 No Types Assigned https://git.kernel.org/stable/c/2f12b2c03c5dae1a0de0a9e5853177e3d6eee3c6 Patch Changed Reference Type https://git.kernel.org/stable/c/67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148 No Types Assigned https://git.kernel.org/stable/c/67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148 Patch Changed Reference Type https://git.kernel.org/stable/c/68e738be5c518fc3c4e9146b66f67c8fee0135fb No Types Assigned https://git.kernel.org/stable/c/68e738be5c518fc3c4e9146b66f67c8fee0135fb Patch Changed Reference Type https://git.kernel.org/stable/c/822ae5a8eac30478578a75f7e064f0584931bf2d No Types Assigned https://git.kernel.org/stable/c/822ae5a8eac30478578a75f7e064f0584931bf2d Patch Changed Reference Type https://git.kernel.org/stable/c/82933c84f188dcfe89eb26b0b48ab5d1ca99d164 No Types Assigned https://git.kernel.org/stable/c/82933c84f188dcfe89eb26b0b48ab5d1ca99d164 Patch Changed Reference Type https://git.kernel.org/stable/c/86a30d6302deddb9fb97ba6fc4b04d0e870b582a No Types Assigned https://git.kernel.org/stable/c/86a30d6302deddb9fb97ba6fc4b04d0e870b582a Patch Changed Reference Type https://git.kernel.org/stable/c/e65ccf3a4de4f0c763d94789615b83e11f204438 No Types Assigned https://git.kernel.org/stable/c/e65ccf3a4de4f0c763d94789615b83e11f204438 Patch Changed Reference Type https://git.kernel.org/stable/c/f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 No Types Assigned https://git.kernel.org/stable/c/f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 Patch Changed Reference Type https://git.kernel.org/stable/c/f9186bba4ea282b07293c1c892441df3a5441cb0 No Types Assigned https://git.kernel.org/stable/c/f9186bba4ea282b07293c1c892441df3a5441cb0 Patch Added CWE NIST CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.35 up to (excluding) 4.19.316 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.278 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.219 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.161 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.8.12 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.9 up to (excluding) 6.9.3 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 15, 2024
Action Type Old Value New Value Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 27, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html [No types assigned] -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 19, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of timer for log writer thread Patch series "nilfs2: fix log writer related issues". This bug fix series covers three nilfs2 log writer-related issues, including a timer use-after-free issue and potential deadlock issue on unmount, and a potential freeze issue in event synchronization found during their analysis. Details are described in each commit log. This patch (of 3): A use-after-free issue has been reported regarding the timer sc_timer on the nilfs_sc_info structure. The problem is that even though it is used to wake up a sleeping log writer thread, sc_timer is not shut down until the nilfs_sc_info structure is about to be freed, and is used regardless of the thread's lifetime. Fix this issue by limiting the use of sc_timer only while the log writer thread is alive. Added Reference kernel.org https://git.kernel.org/stable/c/822ae5a8eac30478578a75f7e064f0584931bf2d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/82933c84f188dcfe89eb26b0b48ab5d1ca99d164 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/e65ccf3a4de4f0c763d94789615b83e11f204438 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/86a30d6302deddb9fb97ba6fc4b04d0e870b582a [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/f9186bba4ea282b07293c1c892441df3a5441cb0 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/2f12b2c03c5dae1a0de0a9e5853177e3d6eee3c6 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/68e738be5c518fc3c4e9146b66f67c8fee0135fb [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-38583 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-38583
weaknesses.