PT-2024-32734
CVE-2024-47679
·
تاريخ النشر
2024-08-23
·
تاريخ التحديث
2026-10-21
الوصف من
CVSS 3.1
7.8
عاليةالمقاييسAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.58
Description
The issue is related to a race condition between
evice inodes() and find inode()&iput() in the Linux kernel's Virtual File System (VFS). This occurs when there are concurrent threads calling iput() and generic shutdown super(), leading to a situation where two threads may simultaneously evict the same inode. This can trigger a bug statement within clear inode() and iput(). The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.Technical details about exploitation include:
- API Endpoints: None specified.
- Vulnerable Parameters or Variables:
inode->i count,I FREEING,I WILL FREE,I NEW. - Function Names:
iput(),find inode(),generic shutdown super(),clear inode(),iget(),inode add lru(),evict inodes().
Recommendations
To resolve the issue, update the Linux kernel to version 6.6.58 or later. As a temporary workaround, consider rechecking the
inode->i count after holding i lock to reduce the overhead of spin lock(). Restrict access to the vulnerable btrfs iget() function to minimize the risk of exploitation. Avoid using the inode variable in the affected API endpoints until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾