{"timestamp":"2024-09-10T17:08:11.447058Z","id":"CVE-2024-39371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/io_uring.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a76c0b31eef50fdb8b21d53a6d050f59241fb88e","lessThan":"c2844d5e58576c55d8e8d4a9f74902d3f7be8044","versionType":"git","status":"affected"},{"version":"a76c0b31eef50fdb8b21d53a6d050f59241fb88e","lessThan":"43cfac7b88adedfb26c27834386992650f1642f3","versionType":"git","status":"affected"},{"version":"a76c0b31eef50fdb8b21d53a6d050f59241fb88e","lessThan":"65561b4c1c9e01443cb76387eb36a9109e7048ee","versionType":"git","status":"affected"},{"version":"a76c0b31eef50fdb8b21d53a6d050f59241fb88e","lessThan":"5fc16fa5f13b3c06fdb959ef262050bd810416a2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/io_uring.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.1.95","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.35","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.9.5","lessThanOrEqual":"6.9.*","versionType":"semver","status":"unaffected"},{"version":"6.10","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

https://git.kernel.org/stable/c/43cfac7b88adedfb26c27834386992650f1642f3

https://git.kernel.org/stable/c/5fc16fa5f13b3c06fdb959ef262050bd810416a2

https://git.kernel.org/stable/c/65561b4c1c9e01443cb76387eb36a9109e7048ee

https://git.kernel.org/stable/c/c2844d5e58576c55d8e8d4a9f74902d3f7be8044

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NIST CWE-476

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.19 up to (excluding) 6.1.95
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.35
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.9.5
     *cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*

https://git.kernel.org/stable/c/43cfac7b88adedfb26c27834386992650f1642f3 No Types Assigned

https://git.kernel.org/stable/c/43cfac7b88adedfb26c27834386992650f1642f3 Patch

https://git.kernel.org/stable/c/5fc16fa5f13b3c06fdb959ef262050bd810416a2 No Types Assigned

https://git.kernel.org/stable/c/5fc16fa5f13b3c06fdb959ef262050bd810416a2 Patch

https://git.kernel.org/stable/c/65561b4c1c9e01443cb76387eb36a9109e7048ee No Types Assigned

https://git.kernel.org/stable/c/65561b4c1c9e01443cb76387eb36a9109e7048ee Patch

https://git.kernel.org/stable/c/c2844d5e58576c55d8e8d4a9f74902d3f7be8044 No Types Assigned

https://git.kernel.org/stable/c/c2844d5e58576c55d8e8d4a9f74902d3f7be8044 Patch

In the Linux kernel, the following vulnerability has been resolved:

io_uring: check for non-NULL file pointer in io_file_can_poll()

In earlier kernels, it was possible to trigger a NULL pointer
dereference off the forced async preparation path, if no file had
been assigned. The trace leading to that looks as follows:

BUG: kernel NULL pointer dereference, address: 00000000000000b0
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP
CPU: 67 PID: 1633 Comm: buf-ring-invali Not tainted 6.8.0-rc3+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 2/2/2022
RIP: 0010:io_buffer_select+0xc3/0x210
Code: 00 00 48 39 d1 0f 82 ae 00 00 00 48 81 4b 48 00 00 01 00 48 89 73 70 0f b7 50 0c 66 89 53 42 85 ed 0f 85 d2 00 00 00 48 8b 13 <48> 8b 92 b0 00 00 00 48 83 7a 40 00 0f 84 21 01 00 00 4c 8b 20 5b
RSP: 0018:ffffb7bec38c7d88 EFLAGS: 00010246
RAX: ffff97af2be61000 RBX: ffff97af234f1700 RCX: 0000000000000040
RDX: 0000000000000000 RSI: ffff97aecfb04820 RDI: ffff97af234f1700
RBP: 0000000000000000 R08: 0000000000200030 R09: 0000000000000020
R10: ffffb7bec38c7dc8 R11: 000000000000c000 R12: ffffb7bec38c7db8
R13: ffff97aecfb05800 R14: ffff97aecfb05800 R15: ffff97af2be5e000
FS:  00007f852f74b740(0000) GS:ffff97b1eeec0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000b0 CR3: 000000016deab005 CR4: 0000000000370ef0
Call Trace:
 <TASK>
 ? __die+0x1f/0x60
 ? page_fault_oops+0x14d/0x420
 ? do_user_addr_fault+0x61/0x6a0
 ? exc_page_fault+0x6c/0x150
 ? asm_exc_page_fault+0x22/0x30
 ? io_buffer_select+0xc3/0x210
 __io_import_iovec+0xb5/0x120
 io_readv_prep_async+0x36/0x70
 io_queue_sqe_fallback+0x20/0x260
 io_submit_sqes+0x314/0x630
 __do_sys_io_uring_enter+0x339/0xbc0
 ? __do_sys_io_uring_register+0x11b/0xc50
 ? vm_mmap_pgoff+0xce/0x160
 do_syscall_64+0x5f/0x180
 entry_SYSCALL_64_after_hwframe+0x46/0x4e
RIP: 0033:0x55e0a110a67e
Code: ba cc 00 00 00 45 31 c0 44 0f b6 92 d0 00 00 00 31 d2 41 b9 08 00 00 00 41 83 e2 01 41 c1 e2 04 41 09 c2 b8 aa 01 00 00 0f 05 <c3> 90 89 30 eb a9 0f 1

kernel.org https://git.kernel.org/stable/c/43cfac7b88adedfb26c27834386992650f1642f3 [No types assigned]

kernel.org https://git.kernel.org/stable/c/5fc16fa5f13b3c06fdb959ef262050bd810416a2 [No types assigned]

kernel.org https://git.kernel.org/stable/c/65561b4c1c9e01443cb76387eb36a9109e7048ee [No types assigned]

kernel.org https://git.kernel.org/stable/c/c2844d5e58576c55d8e8d4a9f74902d3f7be8044 [No types assigned]