In the Linux kernel, the following vulnerability has been resolved:
nbd: fix race between timeout and normal completion
If request timetout is handled by nbdrequeuecmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered.
Fix the race by clearing NBDCMDINFLIGHT in nbdrequeuecmd(), meantime make sure that cmd->lock is grabbed for clearing the flag and the requeue.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49855.json",
"cna_assigner": "Linux"
}[
{
"id": "CVE-2024-49855-3ba05e37",
"signature_version": "v1",
"digest": {
"function_hash": "326837376759182567742194232604094022936",
"length": 162.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc",
"signature_type": "Function",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_requeue_cmd"
}
},
{
"id": "CVE-2024-49855-4799a39a",
"signature_version": "v1",
"digest": {
"function_hash": "326837376759182567742194232604094022936",
"length": 162.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5236ada8ebbd9e7461f17477357582f5be4f46f7",
"signature_type": "Function",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_requeue_cmd"
}
},
{
"id": "CVE-2024-49855-6610460e",
"signature_version": "v1",
"digest": {
"function_hash": "139391628315583585142970733870966937899",
"length": 2025.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e73b946a379a1dfbb62626af93843bdfb53753d",
"signature_type": "Function",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_xmit_timeout"
}
},
{
"id": "CVE-2024-49855-671faeba",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125654232293413073766435356104885139527",
"119234602599385306559932509257191917854",
"303692813771750753955214278373923074356",
"37082458648883362371736793410764741556",
"280537385661854359001488812618103992755",
"156984792725686989975411358537870026100",
"328424810361088377414338401222603677472",
"144409930361049672049848577515781510765"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c25faf72d780a9c71081710cd48759d61ff6e9b",
"signature_type": "Line",
"target": {
"file": "drivers/block/nbd.c"
}
},
{
"id": "CVE-2024-49855-7f924f1b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125654232293413073766435356104885139527",
"119234602599385306559932509257191917854",
"303692813771750753955214278373923074356",
"37082458648883362371736793410764741556",
"280537385661854359001488812618103992755",
"156984792725686989975411358537870026100",
"328424810361088377414338401222603677472",
"144409930361049672049848577515781510765"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9ea57c91f03bcad415e1a20113bdb2077bcf990",
"signature_type": "Line",
"target": {
"file": "drivers/block/nbd.c"
}
},
{
"id": "CVE-2024-49855-872080c4",
"signature_version": "v1",
"digest": {
"function_hash": "305843100298895347513036720216453569496",
"length": 2049.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c25faf72d780a9c71081710cd48759d61ff6e9b",
"signature_type": "Function",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_xmit_timeout"
}
},
{
"id": "CVE-2024-49855-87a33ae4",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125654232293413073766435356104885139527",
"119234602599385306559932509257191917854",
"303692813771750753955214278373923074356",
"37082458648883362371736793410764741556",
"280537385661854359001488812618103992755",
"156984792725686989975411358537870026100",
"328424810361088377414338401222603677472",
"144409930361049672049848577515781510765"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5236ada8ebbd9e7461f17477357582f5be4f46f7",
"signature_type": "Line",
"target": {
"file": "drivers/block/nbd.c"
}
},
{
"id": "CVE-2024-49855-87d3a920",
"signature_version": "v1",
"digest": {
"function_hash": "139391628315583585142970733870966937899",
"length": 2025.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5236ada8ebbd9e7461f17477357582f5be4f46f7",
"signature_type": "Function",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_xmit_timeout"
}
},
{
"id": "CVE-2024-49855-88209412",
"signature_version": "v1",
"digest": {
"function_hash": "326837376759182567742194232604094022936",
"length": 162.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e73b946a379a1dfbb62626af93843bdfb53753d",
"signature_type": "Function",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_requeue_cmd"
}
},
{
"id": "CVE-2024-49855-981c4a6e",
"signature_version": "v1",
"digest": {
"function_hash": "326837376759182567742194232604094022936",
"length": 162.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c25faf72d780a9c71081710cd48759d61ff6e9b",
"signature_type": "Function",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_requeue_cmd"
}
},
{
"id": "CVE-2024-49855-a69b5f00",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125654232293413073766435356104885139527",
"119234602599385306559932509257191917854",
"303692813771750753955214278373923074356",
"37082458648883362371736793410764741556",
"280537385661854359001488812618103992755",
"156984792725686989975411358537870026100",
"328424810361088377414338401222603677472",
"144409930361049672049848577515781510765"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc",
"signature_type": "Line",
"target": {
"file": "drivers/block/nbd.c"
}
},
{
"id": "CVE-2024-49855-b36b546c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125654232293413073766435356104885139527",
"119234602599385306559932509257191917854",
"303692813771750753955214278373923074356",
"37082458648883362371736793410764741556",
"280537385661854359001488812618103992755",
"156984792725686989975411358537870026100",
"328424810361088377414338401222603677472",
"144409930361049672049848577515781510765"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e73b946a379a1dfbb62626af93843bdfb53753d",
"signature_type": "Line",
"target": {
"file": "drivers/block/nbd.c"
}
},
{
"id": "CVE-2024-49855-c70db14e",
"signature_version": "v1",
"digest": {
"function_hash": "139391628315583585142970733870966937899",
"length": 2025.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9ea57c91f03bcad415e1a20113bdb2077bcf990",
"signature_type": "Function",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_xmit_timeout"
}
},
{
"id": "CVE-2024-49855-efb13191",
"signature_version": "v1",
"digest": {
"function_hash": "326837376759182567742194232604094022936",
"length": 162.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9ea57c91f03bcad415e1a20113bdb2077bcf990",
"signature_type": "Function",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_requeue_cmd"
}
},
{
"id": "CVE-2024-49855-f336e623",
"signature_version": "v1",
"digest": {
"function_hash": "139391628315583585142970733870966937899",
"length": 2025.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc",
"signature_type": "Function",
"target": {
"file": "drivers/block/nbd.c",
"function": "nbd_xmit_timeout"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49855.json"