CVE-2024-41020: filelock: Fix fcntl/close race recovery compat path
First published: Mon Jul 29 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport... Apply exactly the same fix to the compat path for 32-bit kernels.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <4.19.319 | 4.19.319 |
| redhat/kernel | <5.4.281 | 5.4.281 |
| redhat/kernel | <5.10.223 | 5.10.223 |
| redhat/kernel | <5.15.164 | 5.15.164 |
| redhat/kernel | <6.1.102 | 6.1.102 |
| redhat/kernel | <6.6.43 | 6.6.43 |
| redhat/kernel | <6.9.12 | 6.9.12 |
| redhat/kernel | <6.10.2 | 6.10.2 |
| redhat/kernel | <6.11 | 6.11 |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.128-1 6.12.12-1 6.12.13-1 | |
| debian/linux-6.1 | 6.1.119-1~deb11u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/4c43ad4ab41602201d34c66ac62130fe339d686f
- https://git.kernel.org/stable/c/53e21cfa68a7d12de378b7116c75571f73e0dfa2
- https://git.kernel.org/stable/c/5b0af8e4c70e4b884bb94ff5f0cd49ecf1273c02
- https://git.kernel.org/stable/c/73ae349534ebc377328e7d21891e589626c6e82c
- https://git.kernel.org/stable/c/911cc83e56a2de5a40758766c6a70d6998248860
- https://git.kernel.org/stable/c/a561145f3ae973ebf3e0aee41624e92a6c5cb38d
- https://git.kernel.org/stable/c/ed898f9ca3fa32c56c858b463ceb9d9936cc69c4
- https://git.kernel.org/stable/c/f4d0775c6e2f1340ca0725f0337de149aaa989ca
- https://git.kernel.org/stable/c/f8138f2ad2f745b9a1c696a05b749eabe44337ea
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41020
- https://nvd.nist.gov/vuln/detail/CVE-2024-41020
- https://launchpad.net/bugs/cve/CVE-2024-41020
- https://security-tracker.debian.org/tracker/CVE-2024-41020
- https://ubuntu.com/security/CVE-2024-41020
- https://git.kernel.org/linus/f8138f2ad2f745b9a1c696a05b749eabe44337ea
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2300901
- https://lore.kernel.org/linux-cve-announce/2024072927-CVE-2024-41020-52c6@gregkh/
- https://access.redhat.com/errata/RHSA-2024:9315
- https://bugzilla.redhat.com/show_bug.cgi?id=2300363
Frequently Asked Questions
What is the severity of CVE-2024-41020?
CVE-2024-41020 has been classified with a medium severity level due to its potential impact on users of affected Linux kernel versions.
How do I fix CVE-2024-41020?
To address CVE-2024-41020, users should upgrade to the recommended kernel versions specified for Red Hat or Debian.
What Linux kernel versions are affected by CVE-2024-41020?
CVE-2024-41020 affects several versions, including Red Hat kernel versions up to 4.19.319, 5.4.281, 5.10.223, 5.15.164, 6.1.102, 6.6.43, 6.9.12, 6.10.2, 6.11 and Debian Linux kernel variants.
What type of vulnerability is CVE-2024-41020?
CVE-2024-41020 is a race condition vulnerability in the file lock handling of the Linux kernel.
Is CVE-2024-41020 actively being exploited?
There is currently no public information indicating that CVE-2024-41020 is actively being exploited in the wild.
- agent/title
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-41020
- agent/software-canonical-lookup
- agent/references
- agent/severity
- collector/nvd-cve
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/tags
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/source
- package-manager/redhat
- package-manager/debian