In the Linux kernel, the following vulnerability has been resolved:
um: Add winch to winch_handlers before registering winch IRQ
Registering a winch IRQ is racy, an interrupt may occur before the winch is added to the winch_handlers list.
If that happens, registerwinchirq() adds to that list a winch that is scheduled to be (or has already been) freed, causing a panic later in winch_cleanup().
Avoid the race by adding the winch to the winchhandlers list before registering the IRQ, and rolling back if umrequest_irq() fails.
[
{
"target": {
"file": "arch/um/drivers/line.c"
},
"digest": {
"line_hashes": [
"163092115562158928534665301451143264088",
"264784369821410591696632397269886257384",
"5008817394736822654082378757651749335",
"259520269527634428298258920172730566064",
"276247555780265951497615339550900636937",
"98245795809299646049405280552147321971",
"284959277960284366009500366278295825275",
"309642333432650883871288558755725994586",
"71929263919843477796246194432454807026",
"324412727888531018580266816176830001937",
"233702448380251631818361185613167444584",
"32612529335168421825969673960561558195",
"68041185066595579450576261839386603598",
"179639145818157069291743168420498067440",
"259436574247795757876347072522696020831",
"21659396573570696203984066761411867164",
"155799728062293872061215166491784896318",
"37637032346511394758428686151777081914"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@351d1a64544944b44732f6a64ed65573b00b9e14",
"deprecated": false,
"id": "CVE-2024-39292-03394e58",
"signature_type": "Line"
},
{
"target": {
"file": "arch/um/drivers/line.c"
},
"digest": {
"line_hashes": [
"163092115562158928534665301451143264088",
"264784369821410591696632397269886257384",
"5008817394736822654082378757651749335",
"259520269527634428298258920172730566064",
"276247555780265951497615339550900636937",
"98245795809299646049405280552147321971",
"284959277960284366009500366278295825275",
"309642333432650883871288558755725994586",
"71929263919843477796246194432454807026",
"324412727888531018580266816176830001937",
"233702448380251631818361185613167444584",
"32612529335168421825969673960561558195",
"68041185066595579450576261839386603598",
"179639145818157069291743168420498067440",
"259436574247795757876347072522696020831",
"21659396573570696203984066761411867164",
"155799728062293872061215166491784896318",
"37637032346511394758428686151777081914"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0fbbd36c156b9f7b2276871d499c9943dfe5101",
"deprecated": false,
"id": "CVE-2024-39292-19cd03db",
"signature_type": "Line"
},
{
"target": {
"file": "arch/um/drivers/line.c"
},
"digest": {
"line_hashes": [
"163092115562158928534665301451143264088",
"264784369821410591696632397269886257384",
"5008817394736822654082378757651749335",
"259520269527634428298258920172730566064",
"276247555780265951497615339550900636937",
"98245795809299646049405280552147321971",
"284959277960284366009500366278295825275",
"309642333432650883871288558755725994586",
"71929263919843477796246194432454807026",
"324412727888531018580266816176830001937",
"233702448380251631818361185613167444584",
"32612529335168421825969673960561558195",
"68041185066595579450576261839386603598",
"179639145818157069291743168420498067440",
"259436574247795757876347072522696020831",
"21659396573570696203984066761411867164",
"155799728062293872061215166491784896318",
"37637032346511394758428686151777081914"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc1ff95602ee908fcd7d8acee7a0dadb61b1a0c0",
"deprecated": false,
"id": "CVE-2024-39292-2023cc1a",
"signature_type": "Line"
},
{
"target": {
"function": "register_winch_irq",
"file": "arch/um/drivers/line.c"
},
"digest": {
"length": 885.0,
"function_hash": "238710744386425158837652774836816184387"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73b8e21f76c7dda4905655d2e2c17dc5a73b87f1",
"deprecated": false,
"id": "CVE-2024-39292-3ce5a544",
"signature_type": "Function"
},
{
"target": {
"function": "register_winch_irq",
"file": "arch/um/drivers/line.c"
},
"digest": {
"length": 885.0,
"function_hash": "238710744386425158837652774836816184387"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0fbbd36c156b9f7b2276871d499c9943dfe5101",
"deprecated": false,
"id": "CVE-2024-39292-476077d7",
"signature_type": "Function"
},
{
"target": {
"function": "register_winch_irq",
"file": "arch/um/drivers/line.c"
},
"digest": {
"length": 885.0,
"function_hash": "238710744386425158837652774836816184387"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@66ea9a7c6824821476914bed21a476cd20094f33",
"deprecated": false,
"id": "CVE-2024-39292-6f278b77",
"signature_type": "Function"
},
{
"target": {
"file": "arch/um/drivers/line.c"
},
"digest": {
"line_hashes": [
"163092115562158928534665301451143264088",
"264784369821410591696632397269886257384",
"5008817394736822654082378757651749335",
"259520269527634428298258920172730566064",
"276247555780265951497615339550900636937",
"98245795809299646049405280552147321971",
"284959277960284366009500366278295825275",
"309642333432650883871288558755725994586",
"71929263919843477796246194432454807026",
"324412727888531018580266816176830001937",
"233702448380251631818361185613167444584",
"32612529335168421825969673960561558195",
"68041185066595579450576261839386603598",
"179639145818157069291743168420498067440",
"259436574247795757876347072522696020831",
"21659396573570696203984066761411867164",
"155799728062293872061215166491784896318",
"37637032346511394758428686151777081914"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73b8e21f76c7dda4905655d2e2c17dc5a73b87f1",
"deprecated": false,
"id": "CVE-2024-39292-75b226e1",
"signature_type": "Line"
},
{
"target": {
"function": "register_winch_irq",
"file": "arch/um/drivers/line.c"
},
"digest": {
"length": 885.0,
"function_hash": "238710744386425158837652774836816184387"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc1ff95602ee908fcd7d8acee7a0dadb61b1a0c0",
"deprecated": false,
"id": "CVE-2024-39292-7bb5112a",
"signature_type": "Function"
},
{
"target": {
"function": "register_winch_irq",
"file": "arch/um/drivers/line.c"
},
"digest": {
"length": 885.0,
"function_hash": "238710744386425158837652774836816184387"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@351d1a64544944b44732f6a64ed65573b00b9e14",
"deprecated": false,
"id": "CVE-2024-39292-8cd83c16",
"signature_type": "Function"
},
{
"target": {
"function": "register_winch_irq",
"file": "arch/um/drivers/line.c"
},
"digest": {
"length": 885.0,
"function_hash": "238710744386425158837652774836816184387"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@434a06c38ee1217a8baa0dd7c37cc85d50138fb0",
"deprecated": false,
"id": "CVE-2024-39292-be6614e5",
"signature_type": "Function"
},
{
"target": {
"file": "arch/um/drivers/line.c"
},
"digest": {
"line_hashes": [
"163092115562158928534665301451143264088",
"264784369821410591696632397269886257384",
"5008817394736822654082378757651749335",
"259520269527634428298258920172730566064",
"276247555780265951497615339550900636937",
"98245795809299646049405280552147321971",
"284959277960284366009500366278295825275",
"309642333432650883871288558755725994586",
"71929263919843477796246194432454807026",
"324412727888531018580266816176830001937",
"233702448380251631818361185613167444584",
"32612529335168421825969673960561558195",
"68041185066595579450576261839386603598",
"179639145818157069291743168420498067440",
"259436574247795757876347072522696020831",
"21659396573570696203984066761411867164",
"155799728062293872061215166491784896318",
"37637032346511394758428686151777081914"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@31960d991e43c8d6dc07245f19fc13398e90ead2",
"deprecated": false,
"id": "CVE-2024-39292-cb867fb0",
"signature_type": "Line"
},
{
"target": {
"file": "arch/um/drivers/line.c"
},
"digest": {
"line_hashes": [
"163092115562158928534665301451143264088",
"264784369821410591696632397269886257384",
"5008817394736822654082378757651749335",
"259520269527634428298258920172730566064",
"276247555780265951497615339550900636937",
"98245795809299646049405280552147321971",
"284959277960284366009500366278295825275",
"309642333432650883871288558755725994586",
"71929263919843477796246194432454807026",
"324412727888531018580266816176830001937",
"233702448380251631818361185613167444584",
"32612529335168421825969673960561558195",
"68041185066595579450576261839386603598",
"179639145818157069291743168420498067440",
"259436574247795757876347072522696020831",
"21659396573570696203984066761411867164",
"155799728062293872061215166491784896318",
"37637032346511394758428686151777081914"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@66ea9a7c6824821476914bed21a476cd20094f33",
"deprecated": false,
"id": "CVE-2024-39292-d087f401",
"signature_type": "Line"
},
{
"target": {
"function": "register_winch_irq",
"file": "arch/um/drivers/line.c"
},
"digest": {
"length": 885.0,
"function_hash": "238710744386425158837652774836816184387"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@31960d991e43c8d6dc07245f19fc13398e90ead2",
"deprecated": false,
"id": "CVE-2024-39292-de329c4c",
"signature_type": "Function"
},
{
"target": {
"file": "arch/um/drivers/line.c"
},
"digest": {
"line_hashes": [
"163092115562158928534665301451143264088",
"264784369821410591696632397269886257384",
"5008817394736822654082378757651749335",
"259520269527634428298258920172730566064",
"276247555780265951497615339550900636937",
"98245795809299646049405280552147321971",
"284959277960284366009500366278295825275",
"309642333432650883871288558755725994586",
"71929263919843477796246194432454807026",
"324412727888531018580266816176830001937",
"233702448380251631818361185613167444584",
"32612529335168421825969673960561558195",
"68041185066595579450576261839386603598",
"179639145818157069291743168420498067440",
"259436574247795757876347072522696020831",
"21659396573570696203984066761411867164",
"155799728062293872061215166491784896318",
"37637032346511394758428686151777081914"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@434a06c38ee1217a8baa0dd7c37cc85d50138fb0",
"deprecated": false,
"id": "CVE-2024-39292-e267b3d2",
"signature_type": "Line"
}
]