In the Linux kernel, the following vulnerability has been resolved:
net: sched: fix use-after-free in taprio_change()
In 'tapriochange()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advancesched()', and critical section protected by 'q->currententrylock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcureplacepointer()' over 'rcuassignpointer()' to update 'admin' immediately before an attempt to schedule freeing.
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 3590.0,
"function_hash": "35004002588099569375055157755215677598"
},
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_change"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@999612996df28d81f163dad530d7f8026e03aec6",
"signature_version": "v1",
"id": "CVE-2024-50127-62903dce"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"114479716128130044393615951593125414852",
"281596649021588068694733827862281517334",
"213701043813687824395797553408571171277",
"108571872150224825002006311330108208664"
],
"threshold": 0.9
},
"target": {
"file": "net/sched/sch_taprio.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f504465970aebb2467da548f7c1efbbf36d0f44b",
"signature_version": "v1",
"id": "CVE-2024-50127-6455a898"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 4065.0,
"function_hash": "132606916359417864410959954776936489457"
},
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_change"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f504465970aebb2467da548f7c1efbbf36d0f44b",
"signature_version": "v1",
"id": "CVE-2024-50127-a48db1e1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"63007473326084935028573839871288206978",
"281596649021588068694733827862281517334",
"213701043813687824395797553408571171277",
"108571872150224825002006311330108208664"
],
"threshold": 0.9
},
"target": {
"file": "net/sched/sch_taprio.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe371f084073e8672a2d7d46b335c3c060d1e301",
"signature_version": "v1",
"id": "CVE-2024-50127-b0168785"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"63007473326084935028573839871288206978",
"281596649021588068694733827862281517334",
"213701043813687824395797553408571171277",
"108571872150224825002006311330108208664"
],
"threshold": 0.9
},
"target": {
"file": "net/sched/sch_taprio.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f868ce6013548a713c431c679ef73747a66fcf3",
"signature_version": "v1",
"id": "CVE-2024-50127-b6488c3c"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"63007473326084935028573839871288206978",
"281596649021588068694733827862281517334",
"213701043813687824395797553408571171277",
"108571872150224825002006311330108208664"
],
"threshold": 0.9
},
"target": {
"file": "net/sched/sch_taprio.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@999612996df28d81f163dad530d7f8026e03aec6",
"signature_version": "v1",
"id": "CVE-2024-50127-c1ced412"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 3590.0,
"function_hash": "35004002588099569375055157755215677598"
},
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_change"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f868ce6013548a713c431c679ef73747a66fcf3",
"signature_version": "v1",
"id": "CVE-2024-50127-e73f38a8"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 3433.0,
"function_hash": "9559109867276221774828535569913248399"
},
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_change"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe371f084073e8672a2d7d46b335c3c060d1e301",
"signature_version": "v1",
"id": "CVE-2024-50127-ff216400"
}
]