CVE-2024-41020: filelock: Fix fcntl/close race recovery compat path
In the Linux kernel, the following vulnerability has been resolved:
filelock: Fix fcntl/close race recovery compat path
When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport...
Apply exactly the same fix to the compat path for 32-bit kernels.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.319 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.281 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.223 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.164 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.102 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.43 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.11 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 3cad1bc01041
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41020?
CVE-2024-41020 has been classified with a medium severity level due to its potential impact on users of affected Linux kernel versions.
How do I fix CVE-2024-41020?
To address CVE-2024-41020, users should upgrade to the recommended kernel versions specified for Red Hat or Debian.
What Linux kernel versions are affected by CVE-2024-41020?
CVE-2024-41020 affects several versions, including Red Hat kernel versions up to 4.19.319, 5.4.281, 5.10.223, 5.15.164, 6.1.102, 6.6.43, 6.9.12, 6.10.2, 6.11 and Debian Linux kernel variants.
What type of vulnerability is CVE-2024-41020?
CVE-2024-41020 is a race condition vulnerability in the file lock handling of the Linux kernel.
Is CVE-2024-41020 actively being exploited?
There is currently no public information indicating that CVE-2024-41020 is actively being exploited in the wild.