CVE-2024-35874: aio: Fix null ptr deref in aio_complete() wakeup
In the Linux kernel, the following vulnerability has been resolved:
aio: Fix null ptr deref in aiocomplete() wakeup
listdelinitcareful() needs to be the last access to the wait queue entry - it effectively unlocks access.
Previously, finishwait() would see the empty list head and skip taking the lock, and then we'd return - but the completion path would still attempt to do the wakeup after the taskstruct pointer had been overwritten.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35874?
CVE-2024-35874 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-35874?
To resolve CVE-2024-35874, update your Linux kernel to a version that includes the fix, such as 5.10.223-1 or later versions.
Which versions of the Linux kernel are affected by CVE-2024-35874?
CVE-2024-35874 affects Linux kernel versions 6.8.x and versions 6.9 up to RC2.
Can CVE-2024-35874 lead to system crashes?
Yes, CVE-2024-35874 can potentially lead to system crashes due to a null pointer dereference in the aio_complete function.
Is there a workaround for CVE-2024-35874?
There is no known workaround for CVE-2024-35874, so upgrading to a patched version of the Linux kernel is recommended.