CVE-2024-35954: scsi: sg: Avoid sg device teardown race
In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Avoid sg device teardown race
sgremovesfpusercontext() must not use sgdevicedestroy() after calling scsideviceput().
sgdevicedestroy() is accessing the parent scsidevice requestqueue which will already be set to NULL when the preceding call to scsideviceput() removed the last reference to the parent scsidevice.
The resulting NULL pointer exception will then crash the kernel.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Avoid sg device teardown race
The Linux kernel CVE team has assigned CVE-2024-35954 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052018-CVE-2024-35954-cdbf@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.28 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-35954 - Compensating control
If patching is not immediately possible, mitigate by avoiding sg device teardown triggering the affected teardown path (e.g., prevent concurrent removal/unload of sg-related user contexts while SCSI sg devices are active), to reduce the chance of triggering the NULL pointer exception described for sg_device_destroy() after scsi_device_put().
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35954?
CVE-2024-35954 has been classified with a high severity rating due to the potential for a race condition in the Linux kernel.
How do I fix CVE-2024-35954?
To fix CVE-2024-35954, update the Linux kernel to versions 6.6.28, 6.8.7, or 6.9, or apply the patch provided by your Linux distribution.
Which Linux distributions are affected by CVE-2024-35954?
CVE-2024-35954 affects various versions of the Linux kernel across different distributions including Red Hat and Debian.
What is the nature of the vulnerability in CVE-2024-35954?
CVE-2024-35954 is a race condition vulnerability that occurs during the teardown process of SCSI generic (sg) devices, potentially leading to system instability.
Is there a workaround for CVE-2024-35954?
As of now, there is no documented workaround for CVE-2024-35954, and applying the appropriate kernel update is recommended.