CVE-2024-38570CWE-416

CVE-2024-38570

Critical · published June 19, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix potential glock use-after-free on unmount

When a DLM lockspace is released and there ares still locks in that

lockspace, DLM will unlock those locks automatically. Commit

fb6791d100d1b started exploiting this behavior to speed up filesystem

unmount: gfs2 would simply free glocks it didn't want to unlock and then

release the lockspace. This didn't take the bast callbacks for

asynchronous lock contention notifications into account, which remain

active until until a lock is unlocked or its lockspace is released.

To prevent those callbacks from accessing deallocated objects, put the

glocks that should not be unlocked on the sd_dead_glocks list, release

the lockspace, and only then free those glocks.

As an additional measure, ignore unexpected ast and bast callbacks if

the receiving glock is dead.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00676 · 51.7th percentile
Weakness
CWE-416 · Use After Free
Published
2024-06-19T18:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 3.8, < 6.6.336.6.33
linux/linux_kernel≥ 6.7, < 6.8.126.8.12
linux/linux_kernel≥ 6.9, < 6.9.36.9.3
References (8)
EPSS history
Timeline
  • 19 JUN 13:35Z
    gfs2: Fix potential glock use-after-free on unmount
    cvelistv5