CVE-2024-26898

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-26898
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26898.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26898
Downstream
Related
Published
2024-04-17T10:27:48.466Z
Modified
2026-03-14T12:30:03.741608Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
Details

In the Linux kernel, the following vulnerability has been resolved:

aoe: fix the potential use-after-free problem in aoecmdcfgpkts

This patch is against CVE-2023-6270. The description of cve is:

A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmdcfgpkts() function improperly updates the refcnt on struct net_device, and a use-after-free can be triggered by racing between the free on the struct and the access through the skbtxq global queue. This could lead to a denial of service condition or potential code execution.

In aoecmdcfgpkts(), it always calls devput(ifp) when skb initial code is finished. But the netdevice ifp will still be used in later tx()->devqueuexmit() in kthread. Which means that the devput(ifp) should NOT be called in the success path of skb initial code in aoecmdcfgpkts(). Otherwise tx() may run into use-after-free because the netdevice is freed.

This patch removed the devput(ifp) in the success path in aoecmdcfgpkts(), and added devput() after skb xmit in tx().

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26898.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7562f876cd93800f2f8c89445f2a563590b24e09
Fixed
ad80c34944d7175fa1f5c7a55066020002921a99
Fixed
1a54aa506b3b2f31496731039e49778f54eee881
Fixed
faf0b4c5e00bb680e8e43ac936df24d3f48c8e65
Fixed
7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4
Fixed
74ca3ef68d2f449bc848c0a814cefc487bf755fa
Fixed
eb48680b0255a9e8a9bdc93d6a55b11c31262e62
Fixed
079cba4f4e307c69878226fdf5228c20aa1c969c
Fixed
a16fbb80064634b254520a46395e36b87ca4731e
Fixed
f98364e926626c678fb4b9004b75cacf92ff0662

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26898.json"