CVE-2024-35874

Summary

In the Linux kernel, the following vulnerability has been resolved:

aio: Fix null ptr deref in aio_complete() wakeup

list_del_init_careful() needs to be the last access to the wait queue entry - it effectively unlocks access.

Previously, finish_wait() would see the empty list head and skip taking the lock, and then we'd return - but the completion path would still attempt to do the wakeup after the task_struct pointer had been overwritten.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux71eb6b6b0ba93b1467bccff57b5de746b09113d2 < 9678bcc6234d83759fe091c197f5017a32b468daaffected
LinuxLinux71eb6b6b0ba93b1467bccff57b5de746b09113d2 < caeb4b0a11b3393e43f7fa8e0a5a18462acc66bdaffected
LinuxLinux6.8affected
LinuxLinux0 < 6.8unaffected
LinuxLinux6.8.5 <= 6.8.*unaffected
LinuxLinux6.9 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References