CVE-2024-46762

Nothing prevents simultaneous ioctl calls to privcmdirqfdassign() and privcmdirqfddeassign(). If that happens, it is possible that a kirqfd created and added to the irqfdslist by privcmdirqfdassign() may get removed by another thread executing privcmdirqfd_deassign(), while the former is still using it after dropping the locks.

This can lead to a situation where an already freed kirqfd instance may be accessed and cause kernel oops.

Use SRCU locking to prevent the same, as is done for the KVM implementation for irqfds.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46762.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

f8941e6c4c712948663ec5d7bbb546f1a0f4e3f6

Fixed

e997b357b13a7d95de31681fc54fcc34235fa527

Fixed

112fd2f02b308564724b8e81006c254d20945c4b

Fixed

611ff1b1ae989a7bcce3e2a8e132ee30e968c557

Affected versions

v6.*

v6.10

v6.10-rc1

v6.10-rc2

v6.10-rc3

v6.10-rc4

v6.10-rc5

v6.10-rc6

v6.10-rc7

v6.10.1

v6.10.2

v6.10.3

v6.10.4

v6.10.5

v6.10.6

v6.10.7

v6.10.8

v6.10.9

v6.5

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.6.1

v6.6.10

v6.6.11

v6.6.12

v6.6.13

v6.6.14

v6.6.15

v6.6.16

v6.6.17

v6.6.18

v6.6.19

v6.6.2

v6.6.20

v6.6.21

v6.6.22

v6.6.23

v6.6.24

v6.6.25

v6.6.26

v6.6.27

v6.6.28

v6.6.29

v6.6.3

v6.6.30

v6.6.31

v6.6.32

v6.6.33

v6.6.34

v6.6.35

v6.6.36

v6.6.37

v6.6.38

v6.6.39

v6.6.4

v6.6.40

v6.6.41

v6.6.42

v6.6.43

v6.6.44

v6.6.45

v6.6.46

v6.6.47

v6.6.48

v6.6.49

v6.6.5

v6.6.50

v6.6.6

v6.6.7

v6.6.8

v6.6.9

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-46762.json"

vanir_signatures

[
    {
        "signature_version": "v1",
        "target": {
            "file": "drivers/xen/privcmd.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@112fd2f02b308564724b8e81006c254d20945c4b",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "96137993833842492690771681821627440889",
                "240219500721213329052294543528971470597",
                "26347230739480085890049122620562536407",
                "77213926055359437193813727079643859918",
                "13937542942468708650479141277930907280",
                "288282542724980093868957458907341789965",
                "295134874113579836192107649978899933404",
                "5189591097209504040513526302208841226",
                "145663757012680301547003987069694132325",
                "13933401522059798088316076383470960671",
                "205335393625794217847013010235878356846",
                "43329674374574184514757304802229119835",
                "188032508039361807018192604848951161369",
                "6514471894976878139795514411077056385",
                "76051473059952412304455313753385845029",
                "203381211149173130784387460844511169230",
                "166350127100562003786337451514893924506",
                "143118305588996460328202994455948116283",
                "243148745573849373167939129845584253608",
                "175668432955279305343648625693106276437",
                "252373870728412953332996884095455238670"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-46762-016daf0d",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "drivers/xen/privcmd.c",
            "function": "irqfd_shutdown"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@112fd2f02b308564724b8e81006c254d20945c4b",
        "deprecated": false,
        "digest": {
            "function_hash": "10013000051697741555146486338281853491",
            "length": 275.0
        },
        "id": "CVE-2024-46762-226f6f55",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "drivers/xen/privcmd.c",
            "function": "privcmd_irqfd_assign"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@112fd2f02b308564724b8e81006c254d20945c4b",
        "deprecated": false,
        "digest": {
            "function_hash": "238278074846097271078633729280037960837",
            "length": 1359.0
        },
        "id": "CVE-2024-46762-b1add0af",
        "signature_type": "Function"
    }
]