CVE-2024-50174CWE-362

CVE-2024-50174

High · published November 8, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Fix race when converting group handle to group object

XArray provides it's own internal lock which protects the internal array

when entries are being simultaneously added and removed. However there

is still a race between retrieving the pointer from the XArray and

incrementing the reference count.

To avoid this race simply hold the internal XArray lock when

incrementing the reference count, this ensures there cannot be a racing

call to xa_erase().

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00198 · 9.1th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2024-11-08T11:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 6.10, < 6.10.146.10.14
linux/linux_kernel≥ 6.11, < 6.11.36.11.3
linux/linux_kernelall versions—
References (3)
EPSS history
Timeline
  • 08 NOV 05:23Z
    drm/panthor: Fix race when converting group handle to group object
    cvelistv5