CVE-2024-49854

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-49854
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49854.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-49854
Downstream
AZL (2)
BELL (1)
DEBIAN (1)
openSUSE (2)
ROOT (1)
SUSE (8)
UBUNTU (1)
Related
openSUSE (2)
SUSE (8)
Published
2024-10-21T12:18:46Z
Modified
2026-10-20T11:04:37Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
block, bfq: fix uaf for accessing waker_bfqq after splitting
Details

In the Linux kernel, the following vulnerability has been resolved:

block, bfq: fix uaf for accessing waker_bfqq after splitting

After commit 42c306ed7233 ("block, bfq: don't break merge chain in bfq_split_bfqq()"), if the current procress is the last holder of bfqq, the bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and then access bfqq->waker_bfqq may trigger UAF. What's more, the waker_bfqq may in the merge chain of bfqq, hence just recored waker_bfqq is still not safe.

Fix the problem by adding a helper bfq_waker_bfqq() to check if bfqq->waker_bfqq is in the merge chain, and current procress is the only holder.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49854.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e0c20d88b7dce85d2703bb6ba77bf359959675cd
Fixed
63a07379fdb6c72450cb05294461c6016b8b7726
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
de6c5e3a456019d2182e345730e59721714fa0b5
Fixed
de0456460f2abf921e356ed2bd8da87a376680bd
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
19f3bec2ac4be329b9bd12b18a989b867618d2d8
Fixed
0780451f03bf518bc032a7c584de8f92e2d39d7f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
13b3d0e8cb121f99b11918a0d4bcc1ce4647d352
Fixed
0b8bda0ff17156cd3f60944527c9d8c9f99f1583
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4780f50ea50cfe8e89fc3747bf3dd155488433bb
Fixed
cae58d19121a70329cf971359e2518c93fec04fe
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
42c306ed723321af4003b2a41bb73728cab54f85
Fixed
1ba0403ac6447f2d63914fb760c44a3b19c44eaf
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.19.323
Fixed
4.20
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.4.285
Fixed
5.5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.10.227
Fixed
5.11
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9e813033594b141f61ff0ef0cfaaef292564b041
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3a5f45a4ad4e1fd36b0a998eef03d76a4f02a2a8
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3630a18846c7853aa326d3b42fd0a855af7b41bc

Affected versions

v4.*
v4.19.323
v4.19.324
v4.19.325
v5.*
v5.10.227
v5.10.228
v5.10.229
v5.10.230
v5.10.231
v5.10.232
v5.10.233
v5.10.234
v5.10.235
v5.10.236
v5.10.237
v5.10.238
v5.10.239
v5.10.240
v5.10.241
v5.10.242
v5.10.243
v5.10.244
v5.10.245
v5.10.246
v5.10.247
v5.10.248
v5.10.249
v5.10.250
v5.10.251
v5.10.252
v5.10.253
v5.10.254
v5.10.255
v5.10.256
v5.10.257
v5.10.258
v5.10.259
v5.10.260
v5.10.261
v5.10.262
v5.10.263
v5.10.264
v5.10.265
v5.10.266
v5.10.267
v5.10.268
v5.10.269
v5.10.270
v5.10.271
v5.10.272
v5.4.285
v5.4.286
v5.4.287
v5.4.288
v5.4.289
v5.4.290
v5.4.291
v5.4.292
v5.4.293
v5.4.294
v5.4.295
v5.4.296
v5.4.297
v5.4.298
v5.4.299
v5.4.300
v5.4.301
v5.4.302

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49854.json"