NVD

CVE-2024-50228 Detail

Rejected

CVE has been marked "REJECT" in the CVE List. These CVEs are stored in the NVD, but do not show up in search results.

Current Description

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Analysis Description

In the Linux kernel, the following vulnerability has been resolved: mm: shmem: fix data-race in shmem_getattr() I got the following KCSAN report during syzbot testing: ================================================================== BUG: KCSAN: data-race in generic_fillattr / inode_set_ctime_current write to 0xffff888102eb3260 of 4 bytes by task 6565 on cpu 1: inode_set_ctime_to_ts include/linux/fs.h:1638 [inline] inode_set_ctime_current+0x169/0x1d0 fs/inode.c:2626 shmem_mknod+0x117/0x180 mm/shmem.c:3443 shmem_create+0x34/0x40 mm/shmem.c:3497 lookup_open fs/namei.c:3578 [inline] open_last_lookups fs/namei.c:3647 [inline] path_openat+0xdbc/0x1f00 fs/namei.c:3883 do_filp_open+0xf7/0x200 fs/namei.c:3913 do_sys_openat2+0xab/0x120 fs/open.c:1416 do_sys_open fs/open.c:1431 [inline] __do_sys_openat fs/open.c:1447 [inline] __se_sys_openat fs/open.c:1442 [inline] __x64_sys_openat+0xf3/0x120 fs/open.c:1442 x64_sys_call+0x1025/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:258 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e read to 0xffff888102eb3260 of 4 bytes by task 3498 on cpu 0: inode_get_ctime_nsec include/linux/fs.h:1623 [inline] inode_get_ctime include/linux/fs.h:1629 [inline] generic_fillattr+0x1dd/0x2f0 fs/stat.c:62 shmem_getattr+0x17b/0x200 mm/shmem.c:1157 vfs_getattr_nosec fs/stat.c:166 [inline] vfs_getattr+0x19b/0x1e0 fs/stat.c:207 vfs_statx_path fs/stat.c:251 [inline] vfs_statx+0x134/0x2f0 fs/stat.c:315 vfs_fstatat+0xec/0x110 fs/stat.c:341 __do_sys_newfstatat fs/stat.c:505 [inline] __se_sys_newfstatat+0x58/0x260 fs/stat.c:499 __x64_sys_newfstatat+0x55/0x70 fs/stat.c:499 x64_sys_call+0x141f/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:263 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e value changed: 0x2755ae53 -> 0x27ee44d3 Reported by Kernel Concurrency Sanitizer on: CPU: 0 UID: 0 PID: 3498 Comm: udevd Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 ================================================================== When calling generic_fillattr(), if you don't hold read lock, data-race will occur in inode member variables, which can cause unexpected behavior. Since there is no special protection when shmem_getattr() calls generic_fillattr(), data-race occurs by functions such as shmem_unlink() or shmem_mknod(). This can cause unexpected results, so commenting it out is not enough. Therefore, when calling generic_fillattr() from shmem_getattr(), it is appropriate to protect the inode using inode_lock_shared() and inode_unlock_shared() to prevent data-race.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource

Weakness Enumeration

CWE-ID	CWE Name	Source

Change History

4 change records found show changes

CVE Modified by kernel.org 11/28/2024 12:15:19 PM

Action	Type	Old Value	New Value
Changed	Description	Record truncated, showing 500 of 2856 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: mm: shmem: fix data-race in shmem_getattr() I got the following KCSAN report during syzbot testing: ================================================================== BUG: KCSAN: data-race in generic_fillattr / inode_set_ctime_current write to 0xffff888102eb3260 of 4 bytes by task 6565 on cpu 1: inode_set_ctime_to_ts include/linux/fs.h:1638 [inline] inode_set_ctime_current+0x169/0x1d0 fs/inode.c:2626 shmem_mknod+0x117/0x1	Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Removed	CVSS V3.1	NIST: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Removed	CWE	NIST: CWE-362
Removed	CPE Configuration	Record truncated, showing 500 of 1126 characters. View Entire Change Record 2527387 Config Identifier: 0, OR cpe:2.3:o:linux:linux_kernel:6.12:rc1::::::* cpe:2.3:o:linux:linux_kernel:6.12:rc2::::::* cpe:2.3:o:linux:linux_kernel:6.12:rc4::::::* cpe:2.3:o:linux:linux_kernel:6.12:rc3::::::* cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 5.5 from (excluding) 5.10.229 cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 4.20 from (excluding)
Removed	Reference	kernel.org: https://git.kernel.org/stable/c/3d9528484480e8f4979b3a347930ed383be99f89
Removed	Reference	kernel.org: https://git.kernel.org/stable/c/7cc30ada84323be19395094d567579536e0d187e
Removed	Reference	kernel.org: https://git.kernel.org/stable/c/82cae1e30bd940253593c2d4f16d88343d1358f4
Removed	Reference	kernel.org: https://git.kernel.org/stable/c/9fb9703cd43ee20a6de8ccdef991677b7274cec0
Removed	Reference	kernel.org: https://git.kernel.org/stable/c/bda1a99a0dd644f31a87d636ac624eeb975cb65a
Removed	Reference	kernel.org: https://git.kernel.org/stable/c/d949d1d14fa281ace388b1de978e8f2cd52875cf
Removed	Reference	kernel.org: https://git.kernel.org/stable/c/edd1f905050686fdc4cfe233d818469fdf7d5ff8
Removed	Reference	kernel.org: https://git.kernel.org/stable/c/ffd56612566bc23877c8f45def2801f3324a222a
Removed	Reference Type	kernel.org: https://git.kernel.org/stable/c/3d9528484480e8f4979b3a347930ed383be99f89 Types: Patch
Removed	Reference Type	kernel.org: https://git.kernel.org/stable/c/7cc30ada84323be19395094d567579536e0d187e Types: Patch
Removed	Reference Type	kernel.org: https://git.kernel.org/stable/c/82cae1e30bd940253593c2d4f16d88343d1358f4 Types: Patch
Removed	Reference Type	kernel.org: https://git.kernel.org/stable/c/9fb9703cd43ee20a6de8ccdef991677b7274cec0 Types: Patch
Removed	Reference Type	kernel.org: https://git.kernel.org/stable/c/bda1a99a0dd644f31a87d636ac624eeb975cb65a Types: Patch
Removed	Reference Type	kernel.org: https://git.kernel.org/stable/c/d949d1d14fa281ace388b1de978e8f2cd52875cf Types: Patch
Removed	Reference Type	kernel.org: https://git.kernel.org/stable/c/edd1f905050686fdc4cfe233d818469fdf7d5ff8 Types: Patch
Removed	Reference Type	kernel.org: https://git.kernel.org/stable/c/ffd56612566bc23877c8f45def2801f3324a222a Types: Patch

Initial Analysis by NIST 11/13/2024 1:38:25 PM

Action	Type	Old Value	New Value
Added	CVSS V3.1		NIST AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Added	CWE		NIST CWE-362
Added	CPE Configuration		Record truncated, showing 500 of 1035 characters. View Entire Change Record OR cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 4.3 up to (excluding) 4.19.323 cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 4.20 up to (excluding) 5.4.285 cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 5.5 up to (excluding) 5.10.229 cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 5.11 up to (excluding) 5.15.171 cpe:2.3:o:linux:linux_kernel::::::::* versions from
Changed	Reference Type	https://git.kernel.org/stable/c/3d9528484480e8f4979b3a347930ed383be99f89 No Types Assigned	https://git.kernel.org/stable/c/3d9528484480e8f4979b3a347930ed383be99f89 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/7cc30ada84323be19395094d567579536e0d187e No Types Assigned	https://git.kernel.org/stable/c/7cc30ada84323be19395094d567579536e0d187e Patch
Changed	Reference Type	https://git.kernel.org/stable/c/82cae1e30bd940253593c2d4f16d88343d1358f4 No Types Assigned	https://git.kernel.org/stable/c/82cae1e30bd940253593c2d4f16d88343d1358f4 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/9fb9703cd43ee20a6de8ccdef991677b7274cec0 No Types Assigned	https://git.kernel.org/stable/c/9fb9703cd43ee20a6de8ccdef991677b7274cec0 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/bda1a99a0dd644f31a87d636ac624eeb975cb65a No Types Assigned	https://git.kernel.org/stable/c/bda1a99a0dd644f31a87d636ac624eeb975cb65a Patch
Changed	Reference Type	https://git.kernel.org/stable/c/d949d1d14fa281ace388b1de978e8f2cd52875cf No Types Assigned	https://git.kernel.org/stable/c/d949d1d14fa281ace388b1de978e8f2cd52875cf Patch
Changed	Reference Type	https://git.kernel.org/stable/c/edd1f905050686fdc4cfe233d818469fdf7d5ff8 No Types Assigned	https://git.kernel.org/stable/c/edd1f905050686fdc4cfe233d818469fdf7d5ff8 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/ffd56612566bc23877c8f45def2801f3324a222a No Types Assigned	https://git.kernel.org/stable/c/ffd56612566bc23877c8f45def2801f3324a222a Patch

New CVE Received from kernel.org 11/09/2024 6:15:08 AM

Action	Type	New Value
Added	Description	Record truncated, showing 500 of 2856 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: mm: shmem: fix data-race in shmem_getattr() I got the following KCSAN report during syzbot testing: ================================================================== BUG: KCSAN: data-race in generic_fillattr / inode_set_ctime_current write to 0xffff888102eb3260 of 4 bytes by task 6565 on cpu 1: inode_set_ctime_to_ts include/linux/fs.h:1638 [inline] inode_set_ctime_current+0x169/0x1d0 fs/inode.c:2626 shmem_mknod+0x117/0x1
Added	Reference	kernel.org https://git.kernel.org/stable/c/3d9528484480e8f4979b3a347930ed383be99f89 [No types assigned]
Added	Reference	kernel.org https://git.kernel.org/stable/c/7cc30ada84323be19395094d567579536e0d187e [No types assigned]
Added	Reference	kernel.org https://git.kernel.org/stable/c/82cae1e30bd940253593c2d4f16d88343d1358f4 [No types assigned]
Added	Reference	kernel.org https://git.kernel.org/stable/c/9fb9703cd43ee20a6de8ccdef991677b7274cec0 [No types assigned]
Added	Reference	kernel.org https://git.kernel.org/stable/c/bda1a99a0dd644f31a87d636ac624eeb975cb65a [No types assigned]
Added	Reference	kernel.org https://git.kernel.org/stable/c/d949d1d14fa281ace388b1de978e8f2cd52875cf [No types assigned]
Added	Reference	kernel.org https://git.kernel.org/stable/c/edd1f905050686fdc4cfe233d818469fdf7d5ff8 [No types assigned]
Added	Reference	kernel.org https://git.kernel.org/stable/c/ffd56612566bc23877c8f45def2801f3324a222a [No types assigned]

Quick Info

CVE Dictionary Entry:
CVE-2024-50228
NVD Published Date:
11/09/2024
NVD Last Modified:
11/28/2024
Source:
kernel.org

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2024-50228 Detail

Current Description

Analysis Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Change History

CVE Modified by kernel.org 11/28/2024 12:15:19 PM

CVE Rejected by kernel.org 11/28/2024 12:15:19 PM

Initial Analysis by NIST 11/13/2024 1:38:25 PM

New CVE Received from kernel.org 11/09/2024 6:15:08 AM

Quick Info