In the Linux kernel, the following vulnerability has been resolved:
protect the fetch of ->fd[fd] in do_dup2() from mispredictions
both callers have verified that fd is not greater than ->maxfds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in closefd()/fileclosefdlocked(); the same solution applies - arrayindexnospec(fd, fdt->maxfds) could differ from fd only in case of speculative execution on mispredicted path.
[
{
"id": "CVE-2024-42265-238afa6e",
"target": {
"file": "fs/file.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113894696413097023081287653225602294197",
"228110347308479697376397083448743576993",
"285475441352673324926749900140806960130",
"193618332235000512575157823028340961293"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed42e8ff509d2a61c6642d1825032072dab79f26",
"signature_version": "v1"
},
{
"id": "CVE-2024-42265-49c4c4f0",
"target": {
"file": "fs/file.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113894696413097023081287653225602294197",
"228110347308479697376397083448743576993",
"285475441352673324926749900140806960130",
"193618332235000512575157823028340961293"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8aa37bde1a7b645816cda8b80df4753ecf172bf1",
"signature_version": "v1"
},
{
"id": "CVE-2024-42265-545d3f35",
"target": {
"file": "fs/file.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113894696413097023081287653225602294197",
"228110347308479697376397083448743576993",
"285475441352673324926749900140806960130",
"193618332235000512575157823028340961293"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41a6c31df77bd8e050136b0a200b537da9e1084a",
"signature_version": "v1"
},
{
"id": "CVE-2024-42265-6d460813",
"target": {
"file": "fs/file.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113894696413097023081287653225602294197",
"228110347308479697376397083448743576993",
"285475441352673324926749900140806960130",
"193618332235000512575157823028340961293"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f480493550b6a23d3a65d095d6569d4a7f56a0f",
"signature_version": "v1"
},
{
"id": "CVE-2024-42265-bcdee525",
"target": {
"file": "fs/file.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113894696413097023081287653225602294197",
"228110347308479697376397083448743576993",
"285475441352673324926749900140806960130",
"193618332235000512575157823028340961293"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08775b3d6ed117cf4518754ec7300ee42b6a5368",
"signature_version": "v1"
},
{
"id": "CVE-2024-42265-c65072f1",
"target": {
"file": "fs/file.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113894696413097023081287653225602294197",
"228110347308479697376397083448743576993",
"285475441352673324926749900140806960130",
"193618332235000512575157823028340961293"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1171ceccabfd596ca370c5d2cbb47d110c3f2fe1",
"signature_version": "v1"
},
{
"id": "CVE-2024-42265-ee87efbb",
"target": {
"file": "fs/file.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113894696413097023081287653225602294197",
"228110347308479697376397083448743576993",
"285475441352673324926749900140806960130",
"193618332235000512575157823028340961293"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5db999fff545b924b24c9afd368ef5c17279b176",
"signature_version": "v1"
},
{
"id": "CVE-2024-42265-f9f1b176",
"target": {
"file": "fs/file.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113894696413097023081287653225602294197",
"228110347308479697376397083448743576993",
"285475441352673324926749900140806960130",
"193618332235000512575157823028340961293"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da72e783afd27d9f487836b2e6738146c0edd149",
"signature_version": "v1"
}
]