CVE-2024-40938: landlock: Fix d_parent walk
In the Linux kernel, the following vulnerability has been resolved:
landlock: Fix dparent walk
The WARNONONCE() in collectdomainaccesses() can be triggered when trying to link a root mount point. This cannot work in practice because this directory is mounted, but the VFS check is done after the call to securitypathlink().
Do not use source directory's dparent when the source directory is the mount point.
[mic: Fix commit message]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.99-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the Landlock d_parent walk, do not use the source directory's d_parent when the source directory is the mount point.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40938?
The severity of CVE-2024-40938 is classified as moderate due to its potential impact on system stability.
How do I fix CVE-2024-40938?
To fix CVE-2024-40938, update your Linux kernel to version 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.
Which Linux distributions are affected by CVE-2024-40938?
CVE-2024-40938 affects Debian-based Linux distributions that are using the specified vulnerable kernel versions.
What is the nature of CVE-2024-40938?
CVE-2024-40938 is a vulnerability related to the Landlock security module in the Linux kernel affecting directory linking.
Is there any known exploit for CVE-2024-40938?
As of now, there are no known public exploits specifically targeting CVE-2024-40938.