CVE-2024-46762: xen: privcmd: Fix possible access to a freed kirqfd instance
In the Linux kernel, the following vulnerability has been resolved:
xen: privcmd: Fix possible access to a freed kirqfd instance
Nothing prevents simultaneous ioctl calls to privcmdirqfdassign() and privcmdirqfddeassign(). If that happens, it is possible that a kirqfd created and added to the irqfdslist by privcmdirqfdassign() may get removed by another thread executing privcmdirqfddeassign(), while the former is still using it after dropping the locks.
This can lead to a situation where an already freed kirqfd instance may be accessed and cause kernel oops.
Use SRCU locking to prevent the same, as is done for the KVM implementation for irqfds.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.51.1-5
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46762?
CVE-2024-46762 is classified as a medium severity vulnerability due to the potential for access to freed memory instances.
How do I fix CVE-2024-46762?
To fix CVE-2024-46762, update the Linux kernel to version 6.12.11-1 or above.
Which versions of the Linux kernel are affected by CVE-2024-46762?
CVE-2024-46762 affects Linux kernel versions up to 6.6.51 and between 6.7 and 6.10.10.
What is the nature of the vulnerability in CVE-2024-46762?
The vulnerability in CVE-2024-46762 arises from the lack of synchronization for simultaneous ioctl calls affecting kirqfd instances.
Are there any specific distributions impacted by CVE-2024-46762?
Yes, Debian Linux versions prior to 6.12.11-1 are impacted by CVE-2024-46762.