ntb:ntb_hw_switchtec:修复由于竞争条件导致的 switchtec_ntb_remove 中的释放后使用漏洞(CVE-2024-50059)

admin 2024-10-25 00:40:31 Ali_nvd 来源:ZONE.CI 全球网 0 阅读模式
ntb:ntb_hw_switchtec:修复由于竞争条件导致的 switchtec_ntb_remove 中的释放后使用漏洞(CVE-2024-50059)

CVE编号

CVE-2024-50059

利用情况

暂无

补丁情况

N/A

披露时间

2024-10-22
漏洞描述
In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev function, then &sndev->check_link_status_work is bound with check_link_status_work. switchtec_ntb_link_notification may be called to start the work. If we remove the module which will call switchtec_ntb_remove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | check_link_status_work switchtec_ntb_remove| kfree(sndev); | | if (sndev->link_force_down) | // use sndev Fix it by ensuring that the work is canceled before proceeding with the cleanup in switchtec_ntb_remove.
解决建议
建议您更新当前系统或软件至最新版,完成漏洞的修复。
参考链接
https://git.kernel.org/stable/c/177925d9c8715a897bb79eca62628862213ba956
https://git.kernel.org/stable/c/3ae45be8492460a35b5aebf6acac1f1d32708946
https://git.kernel.org/stable/c/92728fceefdaa2a0a3aae675f86193b006eeaa43
https://git.kernel.org/stable/c/b650189687822b705711f0567a65a164a314d8df
https://git.kernel.org/stable/c/e51aded92d42784313ba16c12f4f88cc4f973bbb
https://git.kernel.org/stable/c/fa840ba4bd9f3bad7f104e5b32028ee73af8b3dd
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
系统 linux linux_kernel * Up to (excluding) 5.10.227
运行在以下环境
系统 linux linux_kernel * From (including) 5.11 Up to (excluding) 5.15.168
运行在以下环境
系统 linux linux_kernel * From (including) 5.16 Up to (excluding) 6.1.113
运行在以下环境
系统 linux linux_kernel * From (including) 6.2 Up to (excluding) 6.6.57
运行在以下环境
系统 linux linux_kernel * From (including) 6.7 Up to (excluding) 6.11.4
CVSS3评分 7.0
  • 攻击路径 本地
  • 攻击复杂度 高
  • 权限要求 低
  • 影响范围 未更改
  • 用户交互 无
  • 可用性 高
  • 保密性 高
  • 完整性 高
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-ID 漏洞类型
CWE-416 释放后使用
- avd.aliyun.com
weinxin
版权声明
本站原创文章转载请注明文章出处及链接,谢谢合作!
评论:0   参与:  0