CVE-2024-53092
Vulnerability from cvelistv5
Published
2024-11-21 18:17
Modified
2024-12-19 09:38
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio_pci: Fix admin vq cleanup by using correct info pointer
vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq
resources by virtio_pci_vq_info pointer. The info pointer of admin
vq is stored in vp_dev->admin_vq.info instead of vp_dev->vqs[].
Using the info pointer from vp_dev->vqs[] for admin vq causes a
kernel NULL pointer dereference bug.
In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer
from vp_dev->admin_vq.info for admin vq to clean up the resources.
Also make info ptr as argument of vp_del_vq() to be symmetric with
vp_setup_vq().
vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace:
==================================================================
BUG: kernel NULL pointer dereference, address:0000000000000000
...
CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1
RIP: 0010:vp_reset+0x57/0x90 [virtio_pci]
Call Trace:
<TASK>
...
? vp_reset+0x57/0x90 [virtio_pci]
? vp_reset+0x38/0x90 [virtio_pci]
virtio_reset_device+0x1d/0x30
remove_vq_common+0x1c/0x1a0 [virtio_net]
virtnet_remove+0xa1/0xc0 [virtio_net]
virtio_dev_remove+0x46/0xa0
...
virtio_pci_driver_exit+0x14/0x810 [virtio_pci]
==================================================================
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/virtio/virtio_pci_common.c",
"drivers/virtio/virtio_pci_common.h",
"drivers/virtio/virtio_pci_modern.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "018d3d4ad4be7fbc95d8a2367642a32d21df55c7",
"status": "affected",
"version": "4c3b54af907e709609d3d8beca92d65e2f0cfd83",
"versionType": "git"
},
{
"lessThan": "97ee04feb682c906a1fa973ebe586fe91567d165",
"status": "affected",
"version": "4c3b54af907e709609d3d8beca92d65e2f0cfd83",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/virtio/virtio_pci_common.c",
"drivers/virtio/virtio_pci_common.h",
"drivers/virtio/virtio_pci_modern.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_pci: Fix admin vq cleanup by using correct info pointer\n\nvp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq\nresources by virtio_pci_vq_info pointer. The info pointer of admin\nvq is stored in vp_dev-\u003eadmin_vq.info instead of vp_dev-\u003evqs[].\nUsing the info pointer from vp_dev-\u003evqs[] for admin vq causes a\nkernel NULL pointer dereference bug.\nIn vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer\nfrom vp_dev-\u003eadmin_vq.info for admin vq to clean up the resources.\nAlso make info ptr as argument of vp_del_vq() to be symmetric with\nvp_setup_vq().\n\nvp_reset calls vp_modern_avq_cleanup, and causes the Call Trace:\n==================================================================\nBUG: kernel NULL pointer dereference, address:0000000000000000\n...\nCPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1\nRIP: 0010:vp_reset+0x57/0x90 [virtio_pci]\nCall Trace:\n \u003cTASK\u003e\n...\n ? vp_reset+0x57/0x90 [virtio_pci]\n ? vp_reset+0x38/0x90 [virtio_pci]\n virtio_reset_device+0x1d/0x30\n remove_vq_common+0x1c/0x1a0 [virtio_net]\n virtnet_remove+0xa1/0xc0 [virtio_net]\n virtio_dev_remove+0x46/0xa0\n...\n virtio_pci_driver_exit+0x14/0x810 [virtio_pci]\n=================================================================="
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T09:38:58.882Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/018d3d4ad4be7fbc95d8a2367642a32d21df55c7"
},
{
"url": "https://git.kernel.org/stable/c/97ee04feb682c906a1fa973ebe586fe91567d165"
}
],
"title": "virtio_pci: Fix admin vq cleanup by using correct info pointer",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53092",
"datePublished": "2024-11-21T18:17:09.045Z",
"dateReserved": "2024-11-19T17:17:24.981Z",
"dateUpdated": "2024-12-19T09:38:58.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-53092\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-21T19:15:12.380\",\"lastModified\":\"2024-11-21T19:15:12.380\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvirtio_pci: Fix admin vq cleanup by using correct info pointer\\n\\nvp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq\\nresources by virtio_pci_vq_info pointer. The info pointer of admin\\nvq is stored in vp_dev-\u003eadmin_vq.info instead of vp_dev-\u003evqs[].\\nUsing the info pointer from vp_dev-\u003evqs[] for admin vq causes a\\nkernel NULL pointer dereference bug.\\nIn vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer\\nfrom vp_dev-\u003eadmin_vq.info for admin vq to clean up the resources.\\nAlso make info ptr as argument of vp_del_vq() to be symmetric with\\nvp_setup_vq().\\n\\nvp_reset calls vp_modern_avq_cleanup, and causes the Call Trace:\\n==================================================================\\nBUG: kernel NULL pointer dereference, address:0000000000000000\\n...\\nCPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1\\nRIP: 0010:vp_reset+0x57/0x90 [virtio_pci]\\nCall Trace:\\n \u003cTASK\u003e\\n...\\n ? vp_reset+0x57/0x90 [virtio_pci]\\n ? vp_reset+0x38/0x90 [virtio_pci]\\n virtio_reset_device+0x1d/0x30\\n remove_vq_common+0x1c/0x1a0 [virtio_net]\\n virtnet_remove+0xa1/0xc0 [virtio_net]\\n virtio_dev_remove+0x46/0xa0\\n...\\n virtio_pci_driver_exit+0x14/0x810 [virtio_pci]\\n==================================================================\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio_pci: Arreglar la limpieza de admin vq usando el puntero de informaci\u00f3n correcto vp_modern_avq_cleanup() y vp_del_vqs() limpian los recursos de admin vq mediante el puntero virtio_pci_vq_info. El puntero de informaci\u00f3n de admin vq se almacena en vp_dev-\u0026gt;admin_vq.info en lugar de vp_dev-\u0026gt;vqs[]. Usar el puntero de informaci\u00f3n de vp_dev-\u0026gt;vqs[] para admin vq causa un error de desreferencia de puntero NULL en el kernel. En vp_modern_avq_cleanup() y vp_del_vqs(), obtener el puntero de informaci\u00f3n de vp_dev-\u0026gt;admin_vq.info para admin vq para limpiar los recursos. Tambi\u00e9n hacer que info ptr como argumento de vp_del_vq() sea sim\u00e9trico con vp_setup_vq(). vp_reset llama a vp_modern_avq_cleanup y provoca el seguimiento de llamadas: ===================================================================== ERROR: desreferencia de puntero NULL del n\u00facleo, direcci\u00f3n:000000000000000 ... CPU: 49 UID: 0 PID: 4439 Comm: modprobe No contaminado 6.11.0-rc5 #1 RIP: 0010:vp_reset+0x57/0x90 [virtio_pci] Seguimiento de llamadas: ... ? vp_reset+0x57/0x90 [virtio_pci] ? vp_reset+0x38/0x90 [virtio_pci] virtio_reset_device+0x1d/0x30 remove_vq_common+0x1c/0x1a0 [virtio_net] virtnet_remove+0xa1/0xc0 [virtio_net] virtio_dev_remove+0x46/0xa0 ... virtio_pci_driver_exit+0x14/0x810 [virtio_pci] ==================================================================\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/018d3d4ad4be7fbc95d8a2367642a32d21df55c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/97ee04feb682c906a1fa973ebe586fe91567d165\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.