CVE-2024-46762CWE-416

CVE-2024-46762

High · published September 18, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
14.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

xen: privcmd: Fix possible access to a freed kirqfd instance

Nothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and

privcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd

created and added to the irqfds_list by privcmd_irqfd_assign() may get

removed by another thread executing privcmd_irqfd_deassign(), while the

former is still using it after dropping the locks.

This can lead to a situation where an already freed kirqfd instance may

be accessed and cause kernel oops.

Use SRCU locking to prevent the same, as is done for the KVM

implementation for irqfds.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00245 · 14.8th percentile
Weakness
CWE-416 · Use After Free
Published
2024-09-18T12:15Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernel< 6.6.516.6.51
linux/linux_kernel≥ 6.7, < 6.10.106.10.10
References (3)
EPSS history
Timeline
  • 18 SEP 07:12Z
    xen: privcmd: Fix possible access to a freed kirqfd instance
    cvelistv5