In the Linux kernel, the following vulnerability has been resolved:
iouring: Fix release of pinned pages when _iouaddrmap fails
Looking at the error path of _iouaddr_map, if we fail after pinning the pages for any reasons, ret will be set to -EINVAL and the error handler won't properly release the pinned pages.
I didn't manage to trigger it without forcing a failure, but it can happen in real life when memory is heavily fragmented.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d376d7ad62b6a8e8dfff56b559d9d275e5b9b3a",
"target": {
"file": "io_uring/io_uring.c"
},
"digest": {
"line_hashes": [
"41783477918277882597529542261904847192",
"32657240042864445514995222807214889898",
"331754390717536871105311966069301079158",
"15599877437420238266591934054121584221",
"59021183116705163359245148090792039213",
"279900428044331429355291483848942761521",
"103992482206956632760560271049597853858",
"129531832486144754639657178680830634968",
"331764392306647710246129232191543245934",
"100722023752810198379979746574615797531",
"242913436054291914298449622270745882686",
"25165383882302801468943508337244311600",
"39973189651411655894195334472602397052",
"129739963140709483094685703961240559988",
"308547238250612288840560325081016523844",
"141508295021693505747891769114068725742",
"281367940057912906088648294284830746822",
"49370175293132747498121009426339091368",
"207432195924940794126032045086217648616",
"333293129815707176597150365349409953475",
"88988059614077233519825971656918879731",
"51037931769640557276162167920673711098",
"119532639403973284592994482738992853008",
"319401680076680154558963733583238898290"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-35831-0d104eb5",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@712e2c8415f55a4a4ddaa98a430b87f624109f69",
"target": {
"function": "__io_uaddr_map",
"file": "io_uring/io_uring.c"
},
"digest": {
"function_hash": "158233382629867998213400155524062650040",
"length": 936.0
},
"deprecated": false,
"id": "CVE-2024-35831-1227deae",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67d1189d1095d471ed7fa426c7e384a7140a5dd7",
"target": {
"file": "io_uring/io_uring.c"
},
"digest": {
"line_hashes": [
"41783477918277882597529542261904847192",
"32657240042864445514995222807214889898",
"331754390717536871105311966069301079158",
"15599877437420238266591934054121584221",
"59021183116705163359245148090792039213",
"279900428044331429355291483848942761521",
"103992482206956632760560271049597853858",
"129531832486144754639657178680830634968",
"331764392306647710246129232191543245934",
"100722023752810198379979746574615797531",
"242913436054291914298449622270745882686",
"25165383882302801468943508337244311600",
"39973189651411655894195334472602397052",
"129739963140709483094685703961240559988",
"308547238250612288840560325081016523844",
"141508295021693505747891769114068725742",
"281367940057912906088648294284830746822",
"49370175293132747498121009426339091368",
"207432195924940794126032045086217648616",
"333293129815707176597150365349409953475",
"88988059614077233519825971656918879731",
"51037931769640557276162167920673711098",
"119532639403973284592994482738992853008",
"319401680076680154558963733583238898290"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-35831-19aa63f9",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67d1189d1095d471ed7fa426c7e384a7140a5dd7",
"target": {
"function": "__io_uaddr_map",
"file": "io_uring/io_uring.c"
},
"digest": {
"function_hash": "158233382629867998213400155524062650040",
"length": 936.0
},
"deprecated": false,
"id": "CVE-2024-35831-34c390a2",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b6f39c175ba5f0ef72bdb3b9d2a06ad78621d62",
"target": {
"file": "io_uring/io_uring.c"
},
"digest": {
"line_hashes": [
"41783477918277882597529542261904847192",
"32657240042864445514995222807214889898",
"331754390717536871105311966069301079158",
"15599877437420238266591934054121584221",
"59021183116705163359245148090792039213",
"279900428044331429355291483848942761521",
"103992482206956632760560271049597853858",
"129531832486144754639657178680830634968",
"331764392306647710246129232191543245934",
"100722023752810198379979746574615797531",
"242913436054291914298449622270745882686",
"25165383882302801468943508337244311600",
"39973189651411655894195334472602397052",
"129739963140709483094685703961240559988",
"308547238250612288840560325081016523844",
"141508295021693505747891769114068725742",
"281367940057912906088648294284830746822",
"49370175293132747498121009426339091368",
"207432195924940794126032045086217648616",
"333293129815707176597150365349409953475",
"88988059614077233519825971656918879731",
"51037931769640557276162167920673711098",
"119532639403973284592994482738992853008",
"319401680076680154558963733583238898290"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-35831-8d2d8761",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b6f39c175ba5f0ef72bdb3b9d2a06ad78621d62",
"target": {
"function": "__io_uaddr_map",
"file": "io_uring/io_uring.c"
},
"digest": {
"function_hash": "158233382629867998213400155524062650040",
"length": 936.0
},
"deprecated": false,
"id": "CVE-2024-35831-a703e2a7",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d376d7ad62b6a8e8dfff56b559d9d275e5b9b3a",
"target": {
"function": "__io_uaddr_map",
"file": "io_uring/io_uring.c"
},
"digest": {
"function_hash": "158233382629867998213400155524062650040",
"length": 936.0
},
"deprecated": false,
"id": "CVE-2024-35831-cd84fcd2",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@712e2c8415f55a4a4ddaa98a430b87f624109f69",
"target": {
"file": "io_uring/io_uring.c"
},
"digest": {
"line_hashes": [
"41783477918277882597529542261904847192",
"32657240042864445514995222807214889898",
"331754390717536871105311966069301079158",
"15599877437420238266591934054121584221",
"59021183116705163359245148090792039213",
"279900428044331429355291483848942761521",
"103992482206956632760560271049597853858",
"129531832486144754639657178680830634968",
"331764392306647710246129232191543245934",
"100722023752810198379979746574615797531",
"242913436054291914298449622270745882686",
"25165383882302801468943508337244311600",
"39973189651411655894195334472602397052",
"129739963140709483094685703961240559988",
"308547238250612288840560325081016523844",
"141508295021693505747891769114068725742",
"281367940057912906088648294284830746822",
"49370175293132747498121009426339091368",
"207432195924940794126032045086217648616",
"333293129815707176597150365349409953475",
"88988059614077233519825971656918879731",
"51037931769640557276162167920673711098",
"119532639403973284592994482738992853008",
"319401680076680154558963733583238898290"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2024-35831-f17705b9",
"signature_version": "v1",
"signature_type": "Line"
}
]