CVE-2024-39463: Linux Kernel Plan 9 File System Race Condition Local Privilege Escalation Vulnerability
In the Linux kernel, the following vulnerability has been resolved:
9p: add missing locking around taking dentry fid list
Fix a use-after-free on dentry's dfsdata fid list when a thread looks up a fid through dentry while another thread unlinks it:
UAF thread: refcountt: addition on 0; use-after-free. p9fidget linux/./include/net/9p/client.h:262 v9fsfidfind+0x236/0x280 linux/fs/9p/fid.c:129 v9fsfidlookupwithuid linux/fs/9p/fid.c:181 v9fsfidlookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fsvfsgetattrdotl+0xf9/0x360 linux/fs/9p/vfsinodedotl.c:400 vfsstatx+0xdd/0x4d0 linux/fs/stat.c:248
Freed by: p9fiddestroy (inlined) p9clientclunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9fidput linux/./include/net/9p/client.h:278 v9fsdentryrelease+0xb5/0x140 linux/fs/9p/vfsdentry.c:55 v9fsremove+0x38f/0x620 linux/fs/9p/vfsinode.c:518 vfsunlink+0x29a/0x810 linux/fs/namei.c:4335
The problem is that dfsdata was not accessed under dlock, because drelease() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fsremove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the p9fid object. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39463?
CVE-2024-39463 has a moderate severity level, as it involves a use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2024-39463?
To fix CVE-2024-39463, update your Linux kernel to a version that includes the patches for this vulnerability, specifically versions such as 5.10.223-1 or 6.12.12-1.
Which Linux kernel versions are affected by CVE-2024-39463?
CVE-2024-39463 affects Linux kernel versions from 5.11 to 6.1.94, from 6.2 to 6.6.34, and from 6.7 to 6.9.5, along with version 6.10-rc1.
Is CVE-2024-39463 exploitable?
Yes, CVE-2024-39463 is potentially exploitable in environments where a use-after-free condition can be exploited by unprivileged users.
What systems are most at risk from CVE-2024-39463?
Systems running vulnerable versions of the Linux kernel without the latest patches are at the highest risk for CVE-2024-39463.