CVE-2024-35904: selinux: avoid dereference of garbage after mount failure
In the Linux kernel, the following vulnerability has been resolved:
selinux: avoid dereference of garbage after mount failure
In case kernmount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer.
While on it drop the never read static variable selinuxfsmount.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
selinux: avoid dereference of garbage after mount failure
The Linux kernel CVE team has assigned CVE-2024-35904 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051953-CVE-2024-35904-7f85@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.26 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.8.9-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.26 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.8.5 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35904?
CVE-2024-35904 is categorized with a high severity level due to its potential impact on the Linux kernel's stability.
How do I fix CVE-2024-35904?
To address CVE-2024-35904, update the Linux kernel to versions 6.6.26, 6.8.5, or 6.9-rc1 or later.
Which Linux kernel versions are affected by CVE-2024-35904?
CVE-2024-35904 affects Linux kernel versions from 4.17 up to and including 6.6.26, 6.8.5, and 6.9-rc1.
What components are involved in CVE-2024-35904?
CVE-2024-35904 involves an issue within the SELinux component of the Linux kernel related to dereferencing an error pointer.
What can happen if CVE-2024-35904 is exploited?
Exploitation of CVE-2024-35904 may lead to system instability and potentially allow unauthorized access if the kernel dereferences invalid pointers.