Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: check for non-NULL file pointer in io_file_can_poll() In earlier kernels, it was possible to trigger a NULL pointer dereference off the forced async preparation path, if no file had been assigned. The trace leading to that looks as follows: BUG: kernel NULL pointer dereference, address: 00000000000000b0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP CPU: 67 PID: 1633 Comm: buf-ring-invali Not tainted 6.8.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 2/2/2022 RIP: 0010:io_buffer_select+0xc3/0x210 Code: 00 00 48 39 d1 0f 82 ae 00 00 00 48 81 4b 48 00 00 01 00 48 89 73 70 0f b7 50 0c 66 89 53 42 85 ed 0f 85 d2 00 00 00 48 8b 13 <48> 8b 92 b0 00 00 00 48 83 7a 40 00 0f 84 21 01 00 00 4c 8b 20 5b RSP: 0018:ffffb7bec38c7d88 EFLAGS: 00010246 RAX: ffff97af2be61000 RBX: ffff97af234f1700 RCX: 0000000000000040 RDX: 0000000000000000 RSI: ffff97aecfb04820 RDI: ffff97af234f1700 RBP: 0000000000000000 R08: 0000000000200030 R09: 0000000000000020 R10: ffffb7bec38c7dc8 R11: 000000000000c000 R12: ffffb7bec38c7db8 R13: ffff97aecfb05800 R14: ffff97aecfb05800 R15: ffff97af2be5e000 FS: 00007f852f74b740(0000) GS:ffff97b1eeec0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000b0 CR3: 000000016deab005 CR4: 0000000000370ef0 Call Trace: <TASK> ? __die+0x1f/0x60 ? page_fault_oops+0x14d/0x420 ? do_user_addr_fault+0x61/0x6a0 ? exc_page_fault+0x6c/0x150 ? asm_exc_page_fault+0x22/0x30 ? io_buffer_select+0xc3/0x210 __io_import_iovec+0xb5/0x120 io_readv_prep_async+0x36/0x70 io_queue_sqe_fallback+0x20/0x260 io_submit_sqes+0x314/0x630 __do_sys_io_uring_enter+0x339/0xbc0 ? __do_sys_io_uring_register+0x11b/0xc50 ? vm_mmap_pgoff+0xce/0x160 do_syscall_64+0x5f/0x180 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x55e0a110a67e Code: ba cc 00 00 00 45 31 c0 44 0f b6 92 d0 00 00 00 31 d2 41 b9 08 00 00 00 41 83 e2 01 41 c1 e2 04 41 09 c2 b8 aa 01 00 00 0f 05 <c3> 90 89 30 eb a9 0f 1f 40 00 48 8b 42 20 8b 00 a8 06 75 af 85 f6 because the request is marked forced ASYNC and has a bad file fd, and hence takes the forced async prep path. Current kernels with the request async prep cleaned up can no longer hit this issue, but for ease of backporting, let's add this safety check in here too as it really doesn't hurt. For both cases, this will inevitably end with a CQE posted with -EBADF.

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  5.5 MEDIUM

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/43cfac7b88adedfb26c27834386992650f1642f3	Patch
https://git.kernel.org/stable/c/43cfac7b88adedfb26c27834386992650f1642f3	Patch
https://git.kernel.org/stable/c/5fc16fa5f13b3c06fdb959ef262050bd810416a2	Patch
https://git.kernel.org/stable/c/5fc16fa5f13b3c06fdb959ef262050bd810416a2	Patch
https://git.kernel.org/stable/c/65561b4c1c9e01443cb76387eb36a9109e7048ee	Patch
https://git.kernel.org/stable/c/65561b4c1c9e01443cb76387eb36a9109e7048ee	Patch
https://git.kernel.org/stable/c/c2844d5e58576c55d8e8d4a9f74902d3f7be8044	Patch
https://git.kernel.org/stable/c/c2844d5e58576c55d8e8d4a9f74902d3f7be8044	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-476	NULL Pointer Dereference	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

3 change records found show changes

CVE Modified by CVE 11/21/2024 4:27:32 AM

Action	Type	Old Value	New Value
Added	Reference		https://git.kernel.org/stable/c/43cfac7b88adedfb26c27834386992650f1642f3
Added	Reference		https://git.kernel.org/stable/c/5fc16fa5f13b3c06fdb959ef262050bd810416a2
Added	Reference		https://git.kernel.org/stable/c/65561b4c1c9e01443cb76387eb36a9109e7048ee
Added	Reference		https://git.kernel.org/stable/c/c2844d5e58576c55d8e8d4a9f74902d3f7be8044

Initial Analysis by NIST 8/19/2024 3:40:41 PM

Action	Type	Old Value	New Value
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Added	CWE		NIST CWE-476
Added	CPE Configuration		OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.19 up to (excluding) 6.1.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.35 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.9.5 *cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
Changed	Reference Type	https://git.kernel.org/stable/c/43cfac7b88adedfb26c27834386992650f1642f3 No Types Assigned	https://git.kernel.org/stable/c/43cfac7b88adedfb26c27834386992650f1642f3 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/5fc16fa5f13b3c06fdb959ef262050bd810416a2 No Types Assigned	https://git.kernel.org/stable/c/5fc16fa5f13b3c06fdb959ef262050bd810416a2 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/65561b4c1c9e01443cb76387eb36a9109e7048ee No Types Assigned	https://git.kernel.org/stable/c/65561b4c1c9e01443cb76387eb36a9109e7048ee Patch
Changed	Reference Type	https://git.kernel.org/stable/c/c2844d5e58576c55d8e8d4a9f74902d3f7be8044 No Types Assigned	https://git.kernel.org/stable/c/c2844d5e58576c55d8e8d4a9f74902d3f7be8044 Patch

New CVE Received from kernel.org 6/25/2024 11:15:14 AM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 2456 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: io_uring: check for non-NULL file pointer in io_file_can_poll() In earlier kernels, it was possible to trigger a NULL pointer dereference off the forced async preparation path, if no file had been assigned. The trace leading to that looks as follows: BUG: kernel NULL pointer dereference, address: 00000000000000b0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP CPU: 67 PID: 1633 Comm: buf-ring-invali Not tainted 6.8.0-rc3+ #1 Hardware
Added	Reference		kernel.org https://git.kernel.org/stable/c/43cfac7b88adedfb26c27834386992650f1642f3 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/5fc16fa5f13b3c06fdb959ef262050bd810416a2 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/65561b4c1c9e01443cb76387eb36a9109e7048ee [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/c2844d5e58576c55d8e8d4a9f74902d3f7be8044 [No types assigned]