CVE-2024-41068: s390/sclp: Fix sclp_init() cleanup on failure
In the Linux kernel, the following vulnerability has been resolved:
s390/sclp: Fix sclpinit() cleanup on failure
If sclpinit() fails it only partially cleans up: if there are multiple failing calls to sclpinit() sclpstatechangeevent will be added several times to sclpreglist, which results in the following warning:
------------[ cut here ]------------ listadd double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10. WARNING: CPU: 0 PID: 1 at lib/listdebug.c:35 listaddvalidorreport+0xde/0xf8 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3 Krnl PSW : 0404c00180000000 000003ffe0d6076a (listaddvalidorreport+0xe2/0xf8) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 ... Call Trace: [<000003ffe0d6076a>] listaddvalidorreport+0xe2/0xf8 ([<000003ffe0d60766>] listaddvalidorreport+0xde/0xf8) [<000003ffe0a8d37e>] sclpinit+0x40e/0x450 [<000003ffe00009f2>] dooneinitcall+0x42/0x1e0 [<000003ffe15b77a6>] doinitcalls+0x126/0x150 [<000003ffe15b7a0a>] kernelinitfreeable+0x1ba/0x1f8 [<000003ffe0d6650e>] kernelinit+0x2e/0x180 [<000003ffe000301c>] retfromfork+0x3c/0x60 [<000003ffe0d759ca>] retfromfork+0xa/0x30
Fix this by removing sclpstatechangeevent from sclpreglist when sclpinit() fails.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41068?
CVE-2024-41068 has been classified with a severity level that indicates moderate risk due to the potential for a denial of service in the Linux kernel.
How do I fix CVE-2024-41068?
To fix CVE-2024-41068, upgrade your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, or 6.12.12-1.
Which systems are affected by CVE-2024-41068?
Systems running the specified vulnerable versions of the Linux kernel are affected by CVE-2024-41068.
What is the nature of the vulnerability CVE-2024-41068?
CVE-2024-41068 is a vulnerability related to improper cleanup in the sclp_init() function of the Linux kernel.
Is CVE-2024-41068 exploitable remotely?
CVE-2024-41068 is not generally considered remotely exploitable, as it primarily affects local kernel operations.