CVE-2024-42079CWE-476

CVE-2024-42079

Medium · published July 29, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix NULL pointer dereference in gfs2_log_flush

In gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush

lock to provide exclusion against gfs2_log_flush().

In gfs2_log_flush(), check if sdp->sd_jdesc is non-NULL before

dereferencing it. Otherwise, we could run into a NULL pointer

dereference when outstanding glock work races with an unmount

(glock_work_func -> run_queue -> do_xmote -> inode_go_sync ->

gfs2_log_flush).

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2024-07-29T20:15Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernel< 6.6.376.6.37
linux/linux_kernel≥ 6.7, < 6.9.86.9.8
References (10)
EPSS history
Timeline
  • 29 JUL 15:52Z
    gfs2: Fix NULL pointer dereference in gfs2_log_flush
    cvelistv5